# Commands

Every lockpick command and its options, generated from the CLI itself.

{/* Generated by scripts/docs-generate.mts. Do not edit; run `pnpm docs:generate`. */}

Lockpick from your terminal: quick checks, sites, status, findings, repair briefs, Pulse scans, Deep scans you approve and rechecks for you and your coding agents.

Run `lockpick <command> --help` to see the same options in your terminal. Every command also takes `--host` and `--json`.

## lockpick login

Sign in through the browser and store a key for one workspace

```bash title="Usage"
lockpick login [options]
```

| Argument       | What it does                                                                                                                                                         |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--no-browser` | Print the sign-in link without opening the browser                                                                                                                   |
| `--pulse`      | Ask for permission to start Pulse scans, quick checks and free DNS checks again, set or pause Pulse auto-checks and share Pulse results (you tick it in the browser) |
| `--sites`      | Ask for permission to add sites, switch your free site and import accepted or dismissed findings (you tick it in the browser)                                        |
| `--deep`       | Ask for permission to prepare Deep scans and Deep auto-checks that you approve in Lockpick (you tick it in the browser)                                              |
| `--local`      | Request permission for local assessments                                                                                                                             |

## lockpick logout

Revoke this terminal’s key and forget it

```bash title="Usage"
lockpick logout
```

## lockpick whoami

Show the user, workspace and key this terminal uses

```bash title="Usage"
lockpick whoami
```

## lockpick doctor

Check CLI, host, connection, authentication and workspace access without starting a scan

```bash title="Usage"
lockpick doctor [options]
```

| Argument          | What it does                                |
| ----------------- | ------------------------------------------- |
| `--scope <value>` | Scope to check: pulse, sites, deep or local |

## lockpick projects

List projects with their latest Pulse and Deep scans

```bash title="Usage"
lockpick projects
```

## lockpick status

Status report for a project (or an overview of all of them)

```bash title="Usage"
lockpick status [project]
```

| Argument    | What it does       |
| ----------- | ------------------ |
| `<project>` | Project id or name |

## lockpick sites

List sites, add one with `lockpick sites add \<url\>`, move the free Pulse with `lockpick sites switch \<siteId\> --yes`, or read a site's history with `lockpick sites history \<site\>`

```bash title="Usage"
lockpick sites
```

## lockpick sites add

Add a site you own or are allowed to test (needs a key allowed to add sites). Adding does not scan it.

```bash title="Usage"
lockpick sites add <url> [options]
```

| Argument         | What it does                                                      |
| ---------------- | ----------------------------------------------------------------- |
| `<url>`          | Site address, e.g. [https://atlas.example](https://atlas.example) |
| `--name <value>` | Name shown in Lockpick                                            |

## lockpick sites switch

Remove the site that holds this month's free Pulse so another site can use it (needs a key allowed to add sites and start Pulse). With --check, also starts a Pulse on that quick check's site, using one free Pulse.

```bash title="Usage"
lockpick sites switch <site> [options]
```

| Argument          | What it does                                                                        |
| ----------------- | ----------------------------------------------------------------------------------- |
| `<site>`          | Id of the site to remove (from `lockpick sites`)                                    |
| `--check <value>` | Quick check id of the new site; its Pulse starts with the switch                    |
| `--yes`           | Confirm the removal. The site stops being monitored; it can be restored in Lockpick |

## lockpick sites history

A site's security history: each scan depth's score trend, broken where the engine changed, open findings over time, fixes, regressions and the median time to fix

```bash title="Usage"
lockpick sites history <site>
```

| Argument | What it does                            |
| -------- | --------------------------------------- |
| `<site>` | Site id or name (from `lockpick sites`) |

## lockpick runs

List Pulse and Deep scans, newest first

```bash title="Usage"
lockpick runs [options]
```

| Argument            | What it does                                                                      |
| ------------------- | --------------------------------------------------------------------------------- |
| `--project <value>` | Project id or name                                                                |
| `--kind <value>`    | pulse \| box                                                                      |
| `--status <value>`  | queued \| running \| cancelling \| succeeded \| incomplete \| failed \| cancelled |
| `--limit <value>`   | How many (default 20, max 100)                                                    |

## lockpick run

Show one run

```bash title="Usage"
lockpick run <runId>
```

| Argument  | What it does |
| --------- | ------------ |
| `<runId>` | Run id       |

## lockpick watch

Follow a run until it finishes (exit 3 unless it succeeds)

```bash title="Usage"
lockpick watch <runId> [options]
```

| Argument             | What it does                                                                             |
| -------------------- | ---------------------------------------------------------------------------------------- |
| `<runId>`            | Run id                                                                                   |
| `--fail-on <value>`  | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |
| `--interval <value>` | Seconds between checks (default 5, backs off to 30)                                      |
| `--timeout <value>`  | Maximum wait in seconds (default 600, max 3600)                                          |

## lockpick pulse

Start a Pulse scan on a project and wait for the result (needs a key allowed to start Pulses)

```bash title="Usage"
lockpick pulse <project> [options]
```

| Argument             | What it does                                                                                                                            |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| `<project>`          | Project id or name                                                                                                                      |
| `--no-wait`          | Return once the scan starts without waiting for the result                                                                              |
| `--interval <value>` | Seconds between checks while waiting (default 5)                                                                                        |
| `--timeout <value>`  | Maximum wait in seconds (default 600, max 3600)                                                                                         |
| `--fail-on <value>`  | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI)                                                |
| `--lockfile`         | Send (or with --no-lockfile, never send) this folder's package names and versions for this run; otherwise Lockpick asks once per folder |

## lockpick recheck

Full recheck of a site: a new Pulse that uses one Pulse scan from the allowance. With --dns \<findingId>, a free DNS check again of one finding of a scan, which never changes its grade. With --finding \<findingId>, Check this fix: a free recheck of one finding of a Deep scan that reads again only what it was seen on (capped each day).

```bash title="Usage"
lockpick recheck <target> [options]
```

| Argument             | What it does                                                                                                                            |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| `<target>`           | Site id or name; with --dns or --finding, the scan id                                                                                   |
| `--dns <value>`      | Finding id to check again from public DNS records (free, never contacts the site)                                                       |
| `--finding <value>`  | Deep finding id to check after a fix (free, capped each day; reads only what the finding was seen on)                                   |
| `--no-wait`          | Return once the scan starts without waiting for the result                                                                              |
| `--interval <value>` | Seconds between checks while waiting (default 5)                                                                                        |
| `--timeout <value>`  | Maximum wait in seconds (default 600, max 3600)                                                                                         |
| `--fail-on <value>`  | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI)                                                |
| `--lockfile`         | Send (or with --no-lockfile, never send) this folder's package names and versions for this run; otherwise Lockpick asks once per folder |

## lockpick deps

Send this project's package names and exact versions (never code) to a site, and list the advisories that affect them. Reads package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, pdm.lock, composer.lock, go.mod, Gemfile.lock, gems.locked, gradle.lockfile, Cargo.lock, packages.lock.json, pubspec.lock, mix.lock, Package.resolved and pom.xml (needs a key allowed to manage sites).

```bash title="Usage"
lockpick deps <site> [options]
```

| Argument                 | What it does                                                                               |
| ------------------------ | ------------------------------------------------------------------------------------------ |
| `<site>`                 | Site id or name                                                                            |
| `--path <value>`         | Project folder with the lockfiles (default: this folder)                                   |
| `--completeness <value>` | complete, partial or unknown (default unknown; declare complete only for a full inventory) |
| `--revision <value>`     | Optional source revision; does not prove deployment                                        |
| `--environment <value>`  | production, staging, development or unknown                                                |
| `--dry-run`              | Only print what would be sent                                                              |
| `--forget`               | Forget the site's package list in Lockpick                                                 |

## lockpick github status

Show a site's linked repository, branch, lockfiles, last read and pull request comments, and whether your GitHub list is fresh

```bash title="Usage"
lockpick github status [target] [options]
```

| Argument         | What it does                                      |
| ---------------- | ------------------------------------------------- |
| `<target>`       | Site id or name                                   |
| `--site <value>` | Site id or name (the same as the positional site) |

## lockpick github repos

List the GitHub repositories you can link a site to

```bash title="Usage"
lockpick github repos [options]
```

| Argument           | What it does                               |
| ------------------ | ------------------------------------------ |
| `--search <value>` | Only repositories whose name contains this |
| `--limit <value>`  | How many to show (1 to 100, default 50)    |

## lockpick github link

Link a site to a GitHub repository; when GitHub needs you, opens an approval page and waits until you decide

```bash title="Usage"
lockpick github link [target] [options]
```

| Argument                | What it does                                                                                                                                                                            |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<target>`              | Site id or name                                                                                                                                                                         |
| `--site <value>`        | Site id or name (the same as the positional site)                                                                                                                                       |
| `--repo <value>`        | The repository as owner/name (required)                                                                                                                                                 |
| `--ref <value>`         | Branch, tag or commit to read (default: the repository's default branch)                                                                                                                |
| `--lockfile <value>`    | A lockfile path in the repository to check; repeat it for several (at most 20), kept as chosen. Without it or --lockfiles, a relink keeps a chosen list, else every lockfile is checked |
| `--lockfiles <value>`   | auto: check every lockfile in the repository, found again on each read (replaces a chosen list)                                                                                         |
| `--pr-comments <value>` | The Deep pull request comment for this link: on (default; paused without Deep) or off                                                                                                   |
| `--no-open`             | Print the approval page instead of opening a browser                                                                                                                                    |
| `--no-wait`             | Print the approval page and request id and return at once                                                                                                                               |

## lockpick github unlink

Unlink a site from its GitHub repository

```bash title="Usage"
lockpick github unlink [target] [options]
```

| Argument         | What it does                                      |
| ---------------- | ------------------------------------------------- |
| `<target>`       | Site id or name                                   |
| `--site <value>` | Site id or name (the same as the positional site) |

## lockpick github pr-comments

Turn the Deep pull request security comment on or off for a site

```bash title="Usage"
lockpick github pr-comments [target] [state] [options]
```

| Argument         | What it does                                      |
| ---------------- | ------------------------------------------------- |
| `<target>`       | Site id or name                                   |
| `<state>`        | on or off                                         |
| `--site <value>` | Site id or name (the same as the positional site) |

## lockpick schedule status

Show a site's Pulse and Deep auto-checks and the cadences its plan allows

```bash title="Usage"
lockpick schedule status <site>
```

| Argument | What it does    |
| -------- | --------------- |
| `<site>` | Site id or name |

## lockpick schedule set

Set or change a site's auto-check; Pulse changes at once, Deep (--deep) opens an approval page and waits until you decide

```bash title="Usage"
lockpick schedule set <site> [options]
```

| Argument          | What it does                                                                                         |
| ----------------- | ---------------------------------------------------------------------------------------------------- |
| `<site>`          | Site id or name                                                                                      |
| `--every <value>` | How often it runs: daily \| weekly \| monthly                                                        |
| `--at <value>`    | The UTC hour runs aim for, 0 to 23                                                                   |
| `--any-time`      | Run at any time of day (clears the hour)                                                             |
| `--deep`          | Act on the Deep auto-check instead of Pulse (setting or resuming it needs your approval in Lockpick) |
| `--no-open`       | Print the approval page instead of opening a browser                                                 |
| `--no-wait`       | Print the approval page and request id and return at once                                            |

## lockpick schedule pause

Pause a site's Pulse auto-check, or its Deep one with --deep

```bash title="Usage"
lockpick schedule pause <site> [options]
```

| Argument | What it does                                                                                         |
| -------- | ---------------------------------------------------------------------------------------------------- |
| `<site>` | Site id or name                                                                                      |
| `--deep` | Act on the Deep auto-check instead of Pulse (setting or resuming it needs your approval in Lockpick) |

## lockpick schedule resume

Resume a paused or removed auto-check with its cadence; Deep (--deep) needs your approval in Lockpick

```bash title="Usage"
lockpick schedule resume <site> [options]
```

| Argument    | What it does                                                                                         |
| ----------- | ---------------------------------------------------------------------------------------------------- |
| `<site>`    | Site id or name                                                                                      |
| `--deep`    | Act on the Deep auto-check instead of Pulse (setting or resuming it needs your approval in Lockpick) |
| `--no-open` | Print the approval page instead of opening a browser                                                 |
| `--no-wait` | Print the approval page and request id and return at once                                            |

## lockpick share list

List a site's Pulse results that have a live public link

```bash title="Usage"
lockpick share list <site>
```

| Argument | What it does    |
| -------- | --------------- |
| `<site>` | Site id or name |

## lockpick share create

Publish a completed Pulse result at a public link; Lockpick shows the link only once

```bash title="Usage"
lockpick share create <runId> [options]
```

| Argument    | What it does                               |
| ----------- | ------------------------------------------ |
| `<runId>`   | Pulse scan (run) id                        |
| `--replace` | Make a new link; the old one stops working |

## lockpick share revoke

Stop sharing a Pulse result; its public link stops working

```bash title="Usage"
lockpick share revoke <runId>
```

| Argument  | What it does        |
| --------- | ------------------- |
| `<runId>` | Pulse scan (run) id |

## lockpick monitor

Browse current security advisories and matches for sites you can read.

```bash title="Usage"
lockpick monitor [options]
```

| Argument              | What it does                                 |
| --------------------- | -------------------------------------------- |
| `--site <value>`      | Filter to a site id or name                  |
| `--query <value>`     | Search advisory ids, titles or package names |
| `--ecosystem <value>` | all, npm, pypi, composer or wordpress        |
| `--kind <value>`      | all, vulnerability or malicious_package      |
| `--view <value>`      | latest, sites, exploited or following        |
| `--severity <value>`  | all, critical, high, medium, low or unknown  |
| `--days <value>`      | 7, 30, 90, 365 or 0 for all history          |
| `--cursor <value>`    | Next cursor from a previous response         |
| `--advisory <value>`  | Read one advisory id                         |

## lockpick check

Free quick check of a website (homepage and public DNS), or of a public GitHub repository before you install it: a skill, plugin, MCP server or app (needs a key allowed to start Pulses)

```bash title="Usage"
lockpick check <url> [options]
```

| Argument            | What it does                                                                                                                                                                                |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<url>`             | Website address (atlas.example) or GitHub repository (github.com/owner/repo, owner/repo)                                                                                                    |
| `--no-wait`         | Return once the scan starts without waiting for the result                                                                                                                                  |
| `--timeout <value>` | Maximum wait in seconds (default 90, max 3600)                                                                                                                                              |
| `--deep`            | For a GitHub repository: a Deep repository check. It also reads every lockfile and the last 50 commits for leaked keys, with a stronger review. Needs the Deep plan and uses one Deep scan. |

## lockpick verify

Verify you own a site once. Prints the site's value and where to publish it, and --wait looks for it (needs a key allowed to prepare Deep scans)

```bash title="Usage"
lockpick verify <site> [options]
```

| Argument           | What it does                                                            |
| ------------------ | ----------------------------------------------------------------------- |
| `<site>`           | Site id or name                                                         |
| `--method <value>` | dns (default), file or meta (a tag in the homepage head) Default `dns`. |
| `--wait`           | Keep looking for it for about five minutes (uses the proof's checks)    |

## lockpick deep local

Run deterministic local repository checks after project authorization

```bash title="Usage"
lockpick deep local <path> [options]
```

| Argument                      | What it does                                                                                                                                                           |
| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<path>`                      | Physical repository directory (pwd -P); no symlink roots                                                                                                               |
| `--project <value>`           | Project ID or unambiguous name                                                                                                                                         |
| `--dismissals <value>`        | Accepted / dismissed (JSON)                                                                                                                                            |
| `--baseline <value>`          | Previous deep local --json report to compare with: findings are labelled new or unchanged and fixed ones are listed                                                    |
| `--browser-artifacts <value>` | Browser artifact directory relative to the repository; repeatable                                                                                                      |
| `--dotenv <value>`            | Explicit environment file relative to the repository; repeatable                                                                                                       |
| `--dockerfile <value>`        | Dockerfile path relative to the repository; repeatable                                                                                                                 |
| `--migration-file <value>`    | SQL migration file relative to the repository; repeat in execution order                                                                                               |
| `--build-context <value>`     | Build context relative to the repository; pair with --dockerfile in the same order (use . for the root)                                                                |
| `--config-file <value>`       | Deployment configuration file relative to the repository, as \<family>:\<path> (actions-policy, compose-policy or hosting-config); adds that check                     |
| `--checks <value>`            | Comma-separated check IDs; unsupported requested checks remain incomplete                                                                                              |
| `--history`                   | Include bounded Git history inspection                                                                                                                                 |
| `--source-maps`               | Inspect embedded sources in supplied browser source maps                                                                                                               |
| `--php-version`               | Read the PHP version from tracked files and check it for php2shell (CVE-2026-109618, CVE-2026-109619)                                                                  |
| `--fail-on <value>`           | Exit 8 when open findings are this severe or worse: critical, high, medium, low; add new (repeat the flag, or high,new) to count only findings missing from --baseline |

## lockpick deep verify

Start an ownership proof for a Deep scan: a DNS TXT record, a file or a homepage meta tag you publish (needs a key allowed to prepare Deep scans)

```bash title="Usage"
lockpick deep verify <site> [options]
```

| Argument           | What it does                                                            |
| ------------------ | ----------------------------------------------------------------------- |
| `<site>`           | Site id or name                                                         |
| `--method <value>` | dns (default), file or meta (a tag in the homepage head) Default `dns`. |
| `--wait`           | Keep looking for it for about five minutes (uses the proof's checks)    |

## lockpick deep check

Look once for a published ownership proof (each check uses one of its attempts)

```bash title="Usage"
lockpick deep check <site> <verificationId>
```

| Argument           | What it does                     |
| ------------------ | -------------------------------- |
| `<site>`           | Site id or name                  |
| `<verificationId>` | The id from lockpick deep verify |

## lockpick deep prepare

Prepare a Deep scan with a verified proof and open its approval page; nothing starts until you approve it in Lockpick

```bash title="Usage"
lockpick deep prepare <site> <verificationId> [options]
```

| Argument           | What it does                                        |
| ------------------ | --------------------------------------------------- |
| `<site>`           | Site id or name                                     |
| `<verificationId>` | The verified proof id                               |
| `--no-browser`     | Print the approval link without opening the browser |

## lockpick deep start

Start a Deep scan you approved in Lockpick and wait for it (one Deep scan from the allowance, as shown when prepared)

```bash title="Usage"
lockpick deep start <operationId> [options]
```

| Argument             | What it does                                                                             |
| -------------------- | ---------------------------------------------------------------------------------------- |
| `<operationId>`      | The id from lockpick deep prepare                                                        |
| `--no-wait`          | Return once the scan starts without waiting for the result                               |
| `--interval <value>` | Seconds between checks while waiting (default 5)                                         |
| `--timeout <value>`  | Maximum wait in seconds (default 600, max 3600)                                          |
| `--fail-on <value>`  | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |

## lockpick findings

Findings for a run that need attention

```bash title="Usage"
lockpick findings <runId> [options]
```

| Argument             | What it does                                                                             |
| -------------------- | ---------------------------------------------------------------------------------------- |
| `<runId>`            | Run id                                                                                   |
| `--severity <value>` | critical \| high \| medium \| low \| info                                                |
| `--all`              | Include passing and not-assessed checks                                                  |
| `--fail-on <value>`  | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |

## lockpick report

Export an existing assessment and its redacted findings as Markdown or JSON

```bash title="Usage"
lockpick report <runId> [options]
```

| Argument        | What it does                                                  |
| --------------- | ------------------------------------------------------------- |
| `<runId>`       | Run id                                                        |
| `--out <value>` | Create a new report file; refuses to overwrite existing files |

## lockpick export

Save a finished scan as a PDF: plain words for clients, or technical with --technical

```bash title="Usage"
lockpick export <runId> [options]
```

| Argument        | What it does                                                                          |
| --------------- | ------------------------------------------------------------------------------------- |
| `<runId>`       | Run id                                                                                |
| `--out <value>` | The PDF file to create (required); refuses to replace an existing file unless --force |
| `--technical`   | The technical report for engineers instead of plain words                             |
| `--force`       | Replace the file if it already exists                                                 |

## lockpick finding

Show one finding with its evidence

```bash title="Usage"
lockpick finding <runId> <findingId>
```

| Argument      | What it does               |
| ------------- | -------------------------- |
| `<runId>`     | Run id                     |
| `<findingId>` | Finding id or its LP- code |

## lockpick brief

Markdown brief that fixes everything in a run that needs attention (or one finding)

```bash title="Usage"
lockpick brief <runId> [options]
```

| Argument            | What it does                                                                                      |
| ------------------- | ------------------------------------------------------------------------------------------------- |
| `<runId>`           | Run id                                                                                            |
| `--finding <value>` | Only this finding                                                                                 |
| `--agent <value>`   | Tailor it for this agent: claude-code, codex, cursor, vscode, opencode, lovable, bolt, replit, v0 |
| `--out <value>`     | Write the markdown to this file                                                                   |

## lockpick fix

Save the fix-all brief to lockpick-fixes.md and print the command that starts your agent on it

```bash title="Usage"
lockpick fix <runId> [options]
```

| Argument          | What it does                                                                                      |
| ----------------- | ------------------------------------------------------------------------------------------------- |
| `<runId>`         | Run id                                                                                            |
| `--agent <value>` | Tailor it for this agent: claude-code, codex, cursor, vscode, opencode, lovable, bolt, replit, v0 |
| `--out <value>`   | Where to save the brief (default: lockpick-fixes.md)                                              |

## lockpick compare

Compare a Pulse recheck with its baseline

```bash title="Usage"
lockpick compare <runId>
```

| Argument  | What it does   |
| --------- | -------------- |
| `<runId>` | Recheck run id |

## lockpick import

Read a Codex Security findings.json or SARIF file and correlate it with a run, on your machine

```bash title="Usage"
lockpick import <file> [options]
```

| Argument        | What it does                                                                                    |
| --------------- | ----------------------------------------------------------------------------------------------- |
| `<file>`        | Path to findings.json or a SARIF 2.1.0 file                                                     |
| `--run <value>` | Correlate with this run id (omit to just read the file)                                         |
| `--upload`      | Build the minimal correlation keys (route paths, rule ids, severities) to share; off by default |

## lockpick open

Open a run or project in the browser

```bash title="Usage"
lockpick open <id>
```

| Argument | What it does                       |
| -------- | ---------------------------------- |
| `<id>`   | Run id, project id or project name |

## lockpick mcp

Run the MCP server on stdio for a coding agent

```bash title="Usage"
lockpick mcp [options]
```

| Argument               | What it does                                           |
| ---------------------- | ------------------------------------------------------ |
| `--local-root <value>` | Absolute local scan root to enable for MCP; repeatable |

## lockpick mcp config

Print MCP setup for claude, cursor, vscode, codex

```bash title="Usage"
lockpick mcp config <client> [options]
```

| Argument               | What it does                                                           |
| ---------------------- | ---------------------------------------------------------------------- |
| `<client>`             | claude \| cursor \| vscode \| codex                                    |
| `--local-root <value>` | Absolute local scan root to enable for MCP; repeatable                 |
| `--hosted`             | Use the hosted OAuth connector instead of the local stdio server       |
| `--apply`              | Merge into a Cursor, VS Code or Codex config with a private backup     |
| `--file <value>`       | Config file to update with --apply (defaults to the standard location) |

## lockpick mcp rollback

Restore a Lockpick MCP config backup if it has not changed since setup

```bash title="Usage"
lockpick mcp rollback <backup>
```

| Argument   | What it does                              |
| ---------- | ----------------------------------------- |
| `<backup>` | Backup path printed by mcp config --apply |

## lockpick skills

Add the Lockpick skills to your coding agent (npx skills add promptadvisers/lockpick-skills)

```bash title="Usage"
lockpick skills [options]
```

| Argument          | What it does                                                 |
| ----------------- | ------------------------------------------------------------ |
| `--agent <value>` | Agents to add them to, e.g. claude-code,codex (default: ask) |
| `--global`        | Add them for your user instead of this project               |

## lockpick docs

Search the Lockpick docs from the terminal, or list the CLI guides (--open opens the first match)

```bash title="Usage"
lockpick docs [query] [options]
```

| Argument  | What it does                                          |
| --------- | ----------------------------------------------------- |
| `<query>` | What to look for, e.g. "fix a missing CSP"            |
| `--open`  | Open the best match (or the CLI guide) in the browser |

## lockpick ci init

Write a GitHub Actions workflow (.github/workflows/lockpick.yml) that runs a Pulse on each release and fails on serious findings

```bash title="Usage"
lockpick ci init <site> [options]
```

| Argument            | What it does                                                                                            |
| ------------------- | ------------------------------------------------------------------------------------------------------- |
| `<site>`            | Site id or name to check                                                                                |
| `--fail-on <value>` | Fail the workflow at this severity or worse: critical, high, medium, low (default high) Default `high`. |
| `--file <value>`    | Where to write it (default .github/workflows/lockpick.yml)                                              |
| `--action`          | Use the Lockpick GitHub Action instead of running the CLI with npx (preview)                            |
| `--force`           | Replace an existing workflow file                                                                       |
| `--dry-run`         | Print the workflow instead of writing it                                                                |

## lockpick ci check

Check an existing assessment without starting a scan or consuming allowance

```bash title="Usage"
lockpick ci check <runId> [options]
```

| Argument                  | What it does                                                                             |
| ------------------------- | ---------------------------------------------------------------------------------------- |
| `<runId>`                 | Exact run id to evaluate                                                                 |
| `--max-age-hours <value>` | Maximum age since completion in hours (optional)                                         |
| `--min-coverage <value>`  | Minimum reported coverage percent; unknown fails (optional)                              |
| `--fail-on <value>`       | Exit 8 when open findings are this severe or worse: critical, high, medium, low (for CI) |

## lockpick dismissals

Manage accepted findings and reasons for this project. Undo makes a finding active again; changed evidence or scanner rules require review.

```bash title="Usage"
lockpick dismissals [options]
```

| Argument            | What it does                   |
| ------------------- | ------------------------------ |
| `--project <value>` | Project ID or unambiguous name |
| `--file <value>`    | Accepted / dismissed (JSON)    |
| `--push`            | Save changes → Lockpick        |