Install and sign in

The Lockpick CLI lets you and your coding assistant use Lockpick from a terminal. It needs Node.js 20.9 or later.

Install

npm install -g lockpicks

The package is lockpicks, with an s, and it installs a lockpick command. You can also run it without installing, with npx lockpicks.

Sign in

lockpick login --host https://www.lockpick.app

The snippet names this Lockpick server with --host. There is no built-in default host. The CLI uses --host, then LOCKPICK_HOST, then your saved profile. After the first sign-in, lockpick login can reuse that profile.

Your browser opens and asks you to approve the sign-in. The key goes straight to your terminal, and you never copy it by hand.

By default the key can read your sites and reports. Ask for more when you sign in.

• --pulse lets it start Pulse scans, quick checks and the free Re-read this record.
• --sites lets it add sites, switch your free site, send your package versions to Monitor and import which findings you accepted or dismissed (lockpick dismissals --push).
• --deep lets it prepare Deep scans, which you still approve in Lockpick.
• --no-browser prints the sign-in address instead of opening it.

Check who you are signed in as with lockpick whoami, and sign out with lockpick logout, which also revokes the key.

Your first commands

lockpick whoami
lockpick sites
lockpick status

These commands read your account and existing results without starting a scan. Run lockpick doctor if the connection is not working.

To start a check, sign in with --pulse and use a site you own or are authorized to test. atlas.example is an example address, not a live test target. Starting a scan uses the allowance shown by Lockpick; reading its status or report does not use another scan.

Every command accepts --json for scripts and --help for its options. Commands lists them all.

Exit codes

Errors end with a link to the page that explains them. lockpick doctor checks your setup, and lockpick docs <words> searches these docs from your terminal.