composedai

Zero-dependency CLI for Composed AI security reviews — built for developers and coding agents.

Install

npm install -g composedai
# or zero-install one-off:
npx composedai@latest review myfile.py

Quick start

# Save your API key
composedai auth --key cai_your_key_here

# Review a file — exits 0 if clean, 1 if findings above threshold
composedai review api/users.py --fail-on high

Agent usage

# Pipe a git diff — great for pre-commit hooks and CI
git diff HEAD~1 | composedai review --stdin --lang python --json

# Full pipeline: review then verify top finding
composedai review src/api.py --json --output-file /tmp/review.json
composedai verify \
  --type $(jq -r '.findings[0].severity' /tmp/review.json) \
  --target $STAGING_URL \
  --json

# Async: submit and poll separately
JOB=$(composedai review bigfile.py --async --json | jq -r '.job_id')
composedai status $JOB --wait --json

Multi-file review

Review multiple files at once:

composedai review src/auth.py src/db.py src/api.py
composedai review 'src/**/*.py'

Jobs are submitted in parallel. Results are shown per file.

Git diff review

Review only the changes in your working branch:

composedai review --diff           # diff against HEAD
composedai review --diff main      # diff against main branch

Ideal for CI pipelines and pre-commit hooks.

Commands

| Command | Description | |---------|-------------| | auth | Save, show, or remove your API key | | review <file> | Security review a file or piped diff | | verify | Verify a finding is exploitable via ComposedRed | | status <job-id> | Check or wait for an async job | | capabilities | Show supported languages, tiers, and rate limits |

Options (global)

| Flag | Description | |------|-------------| | --json | Machine-readable JSON output (errors to stderr) | | --async | Return job ID immediately, don't wait for completion | | --fail-on <severity> | Exit 1 if findings ≥ severity (critical/high/medium/low/any) | | --timeout <seconds> | Max wait time in seconds (default: 120 for review, 300 for verify) | | --output-file <path> | Write output to a file in addition to stdout | | --key <api-key> | Override saved API key | | --api-url <url> | Override API base URL (useful for self-hosted) |

Exit codes

| Code | Meaning | |------|---------| | 0 | Clean — no findings at or above --fail-on threshold | | 1 | Findings found at or above threshold | | 2 | Error — auth failure, network error, timeout |

Configuration

API key is stored at ~/.composedai/config.json (mode 0600).

Priority order: --key flag > COMPOSEDAI_API_KEY env var > config file.

API URL override: --api-url flag > COMPOSEDAI_API_URL env var > config file > default.