lockpicks 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +62 -0
- package/dist/lockpick.mjs +35100 -0
- package/package.json +43 -0
package/README.md
ADDED
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
# lockpicks
|
|
2
|
+
|
|
3
|
+
Read your Lockpick results from the terminal, and give coding agents the same access over MCP: project status, runs, findings, repair briefs and recheck comparisons. If you allow it, agents can also start a Pulse check on your sites and wait for the result. Deep scans and pentests only start in the Lockpick web app, and the CLI never cancels or changes anything.
|
|
4
|
+
|
|
5
|
+
## Sign in
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npx lockpicks login --host https://<your-lockpick>
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
The browser opens a device page. Confirm the code, pick a workspace and approve. To let the key start Pulse checks, tick **Also let it start Pulse checks**; that box is your statement that you own the workspace's sites or may test them, and each Pulse started with the key is recorded under your name. Without it the key only reads. The terminal receives a key bound to that workspace, stored in your OS keychain (or `~/.config/lockpick/config.json`, mode 0600, when no keychain is available). Each use extends the key; an idle key expires after the workspace's lifetime (30 days by default). Revoke it with `lockpick logout` or in the web app under **Workspace settings → CLI & agent access**.
|
|
12
|
+
|
|
13
|
+
After an `npx` login, the CLI offers to install itself so you can type `lockpick` (or `lockpicks`) instead of `npx lockpicks`. To do it yourself:
|
|
14
|
+
|
|
15
|
+
```bash
|
|
16
|
+
npm install -g lockpicks
|
|
17
|
+
```
|
|
18
|
+
|
|
19
|
+
With it installed, `lockpick mcp config` points agents at `lockpick mcp`; without it, at `npx -y lockpicks mcp`.
|
|
20
|
+
|
|
21
|
+
## Commands
|
|
22
|
+
|
|
23
|
+
| Command | What it shows |
|
|
24
|
+
| -------------------------------------- | --------------------------------------------------------------------------------------- |
|
|
25
|
+
| `lockpick whoami` | The user, workspace and key this terminal uses |
|
|
26
|
+
| `lockpick projects` | Projects with their latest Pulse and pentest |
|
|
27
|
+
| `lockpick status [project]` | One project's report, or an overview of all of them |
|
|
28
|
+
| `lockpick runs` | Pulse assessments and pentests, newest first |
|
|
29
|
+
| `lockpick run <runId>` | One run: status, open findings, coverage and limits |
|
|
30
|
+
| `lockpick watch <runId>` | Follows a run until it finishes |
|
|
31
|
+
| `lockpick pulse <project>` | Starts a Pulse (a recheck of the latest one when possible) and waits for the result |
|
|
32
|
+
| `lockpick findings <runId>` | Findings that need attention (`--all` for informational ones) |
|
|
33
|
+
| `lockpick finding <runId> <findingId>` | One finding with its evidence |
|
|
34
|
+
| `lockpick brief <runId>` | A markdown repair brief (`--finding <id>` for one finding, `--out brief.md` to save it) |
|
|
35
|
+
| `lockpick compare <runId>` | What a Pulse recheck changed against its baseline |
|
|
36
|
+
| `lockpick open <id>` | Opens a run or project in the browser |
|
|
37
|
+
| `lockpick skills` | Adds the Lockpick skills to your coding agent (`npx skills add`) |
|
|
38
|
+
|
|
39
|
+
Every command takes `--host` and `--json`. With `--json`, errors are printed to stderr as `{ "error": "…", "code": "…" }`.
|
|
40
|
+
|
|
41
|
+
Exit codes: `0` ok, `1` error, `2` login needed, `3` a watched or started run did not succeed.
|
|
42
|
+
|
|
43
|
+
Each Pulse uses one of your account's runs, the same as starting it in the web app.
|
|
44
|
+
|
|
45
|
+
## Coding agents (MCP)
|
|
46
|
+
|
|
47
|
+
```bash
|
|
48
|
+
lockpick mcp config claude # or cursor, vscode, codex
|
|
49
|
+
```
|
|
50
|
+
|
|
51
|
+
prints the setup for your agent. The server (`lockpick mcp`, stdio) offers ten reading tools, `lockpick_start_pulse` (only for keys allowed to start Pulses), a repair-brief resource and a `fix-lockpick-findings` prompt. Evidence captured from scanned sites is fenced as untrusted data, and agents are told never to follow instructions inside it.
|
|
52
|
+
|
|
53
|
+
## Environment
|
|
54
|
+
|
|
55
|
+
| Variable | Use |
|
|
56
|
+
| --------------------- | ---------------------------------------------------------- |
|
|
57
|
+
| `LOCKPICK_HOST` | The Lockpick URL, instead of `--host` or your last login |
|
|
58
|
+
| `LOCKPICK_KEY` | A key to use without logging in (CI) |
|
|
59
|
+
| `LOCKPICK_CONFIG_DIR` | Where the config file lives (default `~/.config/lockpick`) |
|
|
60
|
+
| `LOCKPICK_KEYCHAIN=0` | Skip the OS keychain and use the config file |
|
|
61
|
+
|
|
62
|
+
Requires Node.js 20.9 or later.
|