@inkog-io/cli

The pre-flight check for AI agents. Find logic flaws, security risks, and compliance gaps before deployment.

Quick Start

npx -y @inkog-io/cli scan .

What It Does

Inkog scans your AI agent code for logic flaws and security risks:

• Infinite Loops in agentic systems
• Token Bombing attacks
• SQL Injection via LLM output
• Prompt Injection vulnerabilities
• Missing Human Oversight (EU AI Act Article 14)
• Hardcoded Credentials

Supports 20+ frameworks including LangChain, CrewAI, LangGraph, OpenAI, n8n, Flowise, and more.

Installation

# Run directly (no install needed)
npx -y @inkog-io/cli scan .

# Or install globally
npm install -g @inkog-io/cli
inkog scan .

# Alternative: Homebrew
brew tap inkog-io/inkog && brew install inkog

# Alternative: Direct download
curl -fsSL https://inkog.io/install.sh | sh

Usage

# Scan current directory
inkog scan .

# Scan specific path
inkog scan ./my-agent

# JSON output (for CI/CD)
inkog scan . -output json

# EU AI Act compliance
inkog scan . --policy eu-ai-act

# SARIF output (GitHub Security tab)
inkog scan . -output sarif

API Key

A free API key is required for full scans. Without one, you get a preview scan of a single file.

Get your key at app.inkog.io (takes 30 seconds), then:

export INKOG_API_KEY=sk_live_your_key_here
inkog scan .

How It Works

This npm package downloads the Inkog CLI (a Go binary) on first run and caches it at ~/.inkog/bin/. The binary is verified with SHA256 checksums.

To use a pre-installed binary (e.g., in corporate environments):

export INKOG_BINARY_PATH=/path/to/inkog
npx -y @inkog-io/cli scan .

Links

• Documentation
• GitHub
• Website
• MCP Server