aegilabs — the AegiLabs audit CLI

Runs the AegiLabs security-audit agent from your own machine, against your own working copy — we never clone or upload your repository. Point it at a repo or a URL:

aegi ./path/to/repo          # static audit of a code repository
aegi http://localhost:3000   # authorized assessment of a live target

Install

npm install -g aegilabs      # the package is `aegilabs`; the command is `aegi`

Or run it without installing:

npx --package=aegilabs aegi ./my-app

Node 20 or newer is the only prerequisite. The audit agent ships inside the package — there is no separate CLI to install.

Configure

You need the Aegi key we issued you. Easiest: just run aegi and paste the key when prompted — it's stored in ~/.aegi/config.toml and reused after that. Or set it yourself:

export AEGI_KEY=aegi_live_...            # env var
# or ~/.aegi/config.toml:
#   key = "aegi_live_..."
# or per-run: aegi --key aegi_live_... ./repo

The proxy URL defaults to AegiLabs' — you don't set it. Precedence for both: flag → env → ~/.aegi/config.toml.

What each mode does

| Target | Mode | Tools | Notes | |---|---|---|---| | a directory | repo | Read/Grep/Glob/Bash (read-only) | secrets, creds, vulnerable deps, injection/authz sinks | | a URL | url | Bash | active assessment — prompts for authorization first (skip with --yes) |

Detection is automatic: an existing directory → repo; anything starting http(s):// (or a bare host:port / localhost:port) → url.

What leaves your machine

The audit is performed by a language model, so be clear-eyed about this: the parts of your code the agent reads are sent off your machine. Specifically:

• The agent reads files locally and puts what it reads into the model's context. That context goes to the AegiLabs metering proxy, which authenticates your key and counts tokens, and on to Anthropic's API, which runs the model.
• What is not sent: your repository as a whole. Nothing is cloned or uploaded, and only the files and snippets the agent actually opens during the run pass through. The transcript records which ones, so the exposure is auditable after the fact.
• Scanner output is generated locally but also goes into the model context as grounding. Note that gitleaks and trufflehog output can contain the actual secret values they found.
• The proxy records usage counts, not request bodies. What Anthropic does with API traffic is governed by their own terms, not by us.

If a client's code cannot be sent to a third-party model at all, this tool is not appropriate for that engagement — no configuration option changes that.

Output

Streams progress to the terminal, then writes (stem taken from --out, default aegi-report):

• aegi-report.pdf — the branded, client-ready report, compiled from the bundled AegiLabs Typst template. Requires typst on PATH (run aegi doctor for the install command). Without it, an HTML fallback (aegi-report.html) is written instead.
• aegi-report.data.json — the structured findings (report-data.json schema); the only file you'd edit to tweak wording before sending.
• aegi-report.transcript.md — the raw agent transcript (audit trail).

Finally prints tokens used against your quota. Reports are Swedish by default (--lang en for English).

What a run costs you

When the run finishes, aegi prints what it was billed and what is left:

Billed: 43 616 units across 3 model calls — 1 697 748 of 2 000 000 left

That figure comes from the metering proxy, not from the local agent — the two disagree, and the proxy is the one that matches your account. If the proxy can't be reached the line falls back to a local (estimate), which is exact on input tokens but under-counts output.

A unit is the cost of one input token on the default model; an output token costs five, and cheaper models consume proportionally fewer units per token. So switching to --model claude-haiku-4-5 makes a given quota go about five times further.

Note that a repo audit costs roughly 43,000 units per model call regardless of how small the target is — most of that is the agent's own system prompt and tool definitions, not your code. There is no such thing as a cheap audit.

Options

aegi <target> [--max-turns N] [--lang sv|en] [--out PATH] [--title T] [--key KEY] [--model M] [--yes]

| Option | Default | What it does | |---|---|---| | <target> (required) | — | What to audit: a directory → static repo audit, or a URL (http(s)://…, or bare host:port) → live assessment. Detected automatically. | | --max-turns N | 30 | Cap on the agent's reasoning/tool turns. Higher digs deeper but costs more tokens and time; if the cap is hit, the run stops, the report is still written, and it notes the truncation. Raise it (e.g. 60) for large repos. | | --lang sv\|en | sv | Language the report prose is written in. | | --out PATH | aegi-report.pdf | Where to write the PDF. Its filename stem also names the siblings: <stem>.data.json and <stem>.transcript.md. | | --title T | per-language default | Title printed on the report cover. | | --key KEY | prompt / env / config | Use this Aegi key for the run, overriding AEGI_KEY and ~/.aegi/config.toml. | | --model M | claude-opus-5 | Model that performs the audit. Resolves flag -> $AEGI_MODEL -> model = "..." in ~/.aegi/config.toml -> the pinned default. A cheaper tier (e.g. claude-haiku-4-5) costs less per token but is likelier to miss findings and to stray from the report contract; the default is pinned so an aegi upgrade never moves your audits to a different model silently. aegi doctor prints the model it would use. | | --yes | off | Skip the "are you authorized to test this URL?" confirmation (repo audits never prompt). |

Run aegi doctor to check optional tools and your key.

Prerequisites

• Node 20+ — the only hard requirement.
• Typst (typst) — compiles the PDF. Optional; HTML fallback otherwise.
• Scanners (optional, repo mode) — gitleaks, osv-scanner, semgrep, trufflehog. Any that are on PATH are run and used to ground findings.

aegi doctor reports what's present and prints the exact install command for your OS.

Editor integration

Every run also prints its findings one per line, compiler-style:

src/db.js:6: error: [critical] Hardcoded admin credential
src/config.js:2: error: [high] Query built by string concatenation
package.json:2: info: [info] Dependency drift

VS Code turns those into clickable Problems-panel entries on its own — no extension to install. Drop this in .vscode/tasks.json:

{
  "version": "2.0.0",
  "tasks": [{
    "label": "aegi audit",
    "type": "shell",
    "command": "aegi . --lang en",
    "problemMatcher": {
      "owner": "aegi",
      "fileLocation": ["relative", "${workspaceFolder}"],
      "pattern": {
        "regexp": "^(.+?):(\\d+):\\s+(error|warning|info):\\s+\\[(critical|high|medium|low|info)\\]\\s+(.+)$",
        "file": 1, "line": 2, "severity": 3, "code": 4, "message": 5
      }
    }
  }]
}

Then Terminal → Run Task → aegi audit. Findings land in the Problems panel, clickable to the exact line, with the real severity kept as the problem code.

Other editors: the format is the usual file:line: level: message, so anything that reads compiler output (Vim quickfix :set errorformat=%f:%l:\ %t%*[^:]:\ %m, Emacs compile) works the same way.

URL audits are skipped in this output — there is no file for an editor to open.

Notes / limits

• URL scope is prompt-enforced, not sandboxed — the agent is told to touch only the target host. Treat as a soft guard; only run against targets you're authorized to test.
• Repo mode runs any installed deterministic scanners and feeds their real output to the agent as ground truth, then the agent triages and writes the report. With none installed it falls back to a read-only LLM review (CVE claims are then memory-based — install scanners to ground them).

In CI

The same audit runs as a GitHub Action on your own runner — inline findings on the pull request, a job summary, and the PDF as a run artifact. See AegiLabs/aegi-action.