@index365/cli

Website findings your coding agent can use.

The index365 CLI scans a URL and returns a score plus findings with stable IDs, evidence, and machine-readable remediation, from your terminal, CI, or an AI agent. It is a thin wrapper over the public /api/v1, so anything it does, your own agents can do too.

Two products ship on the CLI today: AI-Readiness (how well AI agents and AI search can read a site) and Marketing Signal (can demand find the site, trust the offer, act, and be measured). Website Security arrives when its report projection ships.

Install

npm install -g @index365/cli

Update later with npm i -g @index365/cli. The CLI shows an update box when a newer version is available.

Quickstart

index365 login                                # opens your browser; the key saves itself
index365 scan yoursite.com                        # resolve the project from the domain, wait, render the score card
index365 scan yoursite.com --product marketing-signal
index365 scan yoursite.com --no-wait              # queue and print the run id (CI, async)
index365 findings                             # findings from your latest run - no ids needed
index365 findings get 1                       # first finding, full detail plus a fix prompt
index365 findings get 1 --prompt | pbcopy     # just the raw fix prompt, for your agent
index365 report                               # score card for your latest run (JSON when piped)
index365 report yoursite.com --save report.json   # full report: context plus every finding
index365 results                              # your scan results, newest first, with score and age
index365 results yoursite.com                 # that site's score over time
index365 check                                # is a scan done yet? (pairs with scan --no-wait)
index365 scan local http://localhost:3000/    # score a local page before deploy
index365 --status                             # auth, plan, credits, and your latest run

No command ever requires a project or run id: every noun defaults to your latest completed run and echoes back what it resolved (yoursite.com · scanned 2m ago). A pasted run id may be shortened to any unique prefix, and a domain always works where a run id would.

scan resolves the project from the url's domain automatically. A new domain asks exactly one question, <domain> is new. Create the project and scan it for N credits? [Y/n] (the cost and your balance come from your plan), and --yes answers it for scripts. Non-interactive shells never prompt. A scan waits by default and renders the score card; --no-wait queues it and prints the run id.

Signing in

index365 login opens your browser; you authorize on the dashboard and the key is saved automatically (loopback + PKCE, so the secret never travels through a URL). Nothing to copy or paste.

For CI or headless machines, set INDEX365_API_KEY (preferred; it keeps the key out of shell history and process lists) or pass index365 login --key <key>.

Add --json to any command for machine-readable output; run-scoped responses carry a resolved block naming the run that "latest" resolved to. Keys live at ~/.config/index365/config.json (mode 0600); INDEX365_API_KEY overrides the file.

Migrating from 0.x

CLI 1.0 unified the grammar around scan and id-free reads; 1.1 renamed the read commands to results and check. Every old spelling keeps working as a hidden alias for at least 90 days; it prints a one-line redirect note on stderr and then runs the new path.

| Old | New (1.1) | | --------- | --------- | | runs list | results (scan history; a domain narrows it) | | runs get [runId \| domain] | check [runId \| domain] (is a scan done yet?) | | runs start --project <id> [--url <url>] [--wait] | scan <url> (waits by default; --no-wait to queue) | | marketing run --project <id> [--wait] | scan <url> --product marketing-signal | | marketing report --project <id> | report --project <id> --product marketing-signal | | marketing findings --run <id> [--stage <s>] | findings list --run <id> [--stage <s>] | | reports context <runId> | report <runId> | | reports download <runId> [--output <file>] | report <runId> --save [file] | | projects delete <id> | projects archive <id> |

Projects

Project removal is reversible. projects archive preserves scan history and API keys, and projects restore reactivates the same row. Use projects list --status archived to find recoverable projects or --status all for every lifecycle state.

Exit codes

0 ok · 1 error · 2 usage · 3 auth · 4 not found · 5 quota/conflict/rate

Also available as index365 help exit-codes.

MCP

index365 mcp config   # prints ready-to-paste config for Claude Code, Codex, and Cursor

Docs

Full reference: https://index365.co/docs/developers/cli

License

MIT