Fuzzi CLI

Run Fuzzi security scans from your terminal. Interactive shell for daily use, scriptable commands for CI.

Web app: fuzzi-ten.vercel.app

npm install -g fuzzi-cli
fuzzi

First run (30 seconds)

1. Install the CLI (above)
2. Run fuzzi
3. You'll see Sign in to continue — press Enter
4. Your browser opens to fuzzi-ten.vercel.app — log in or sign up
5. After authorizing, return to the terminal — you're in

› /scan example.com        # scan a site (https:// added automatically)
› /scans                   # browse past scans
› /help                    # all commands
› /palette                 # search commands

No browser? Use /auth-key to paste an API key from Settings → API Keys.

Windows

Works in Windows Terminal, PowerShell, and cmd. Requires Node.js 18+.

npm install -g fuzzi-cli
fuzzi

If fuzzi is not found, restart the terminal or add %AppData%\npm to your PATH.

Two ways to use it

| You want… | Do this | |-----------|---------| | Explore scans interactively | fuzzi (opens the shell) | | One command in CI / a script | fuzzi scan <url> --fail-on critical |

Interactive shell

Slash commands (type at the › prompt):

| Command | What it does | |---------|----------------| | /scan <url> | Run a scan, show live progress | | /scans | Browse recent scans | | /status | Account, API key expiry, rate limits | | /keys | List / revoke / create API keys | | /auth | Sign in via browser again | | /auth-key | Paste an API key manually | | /config key=value | Set CLI defaults | | /palette | Fuzzy-search all commands | | /help | Command reference | | /exit | Quit |

Tips

• Tab completes command names
• Bare domains work: /scan netflix.com → https://netflix.com
• auth login and fuzzi auth login are rewritten to /auth in the shell

Scriptable commands (CI & automation)

# Scan and wait for result (default)
fuzzi scan https://staging.example.com

# Fail CI if risk is HIGH or above
fuzzi scan https://staging.example.com --fail-on high

# JSON for pipelines
fuzzi scan https://example.com --format json

# Exit codes: 0 = pass, 1 = risk threshold met, 2 = error

All commands

fuzzi auth login              # browser sign-in (default)
fuzzi auth login --api-key    # paste key non-interactively
fuzzi auth status
fuzzi auth logout

fuzzi scan <url> [--wait] [--no-wait] [--format table|json|markdown]
               [--env production|staging|development]
               [--fail-on low|medium|high|critical]

fuzzi scans list | get <scan-id>
fuzzi report <scan-id> --format pdf|csv|json
fuzzi whatif <scan-id> --set dimension=0.5
fuzzi compare <scan-a> <scan-b>
fuzzi config list | get | set
fuzzi status
fuzzi --help

Configuration

| File | Purpose | |------|---------| | ~/.fuzzi/credentials | API key (mode 600) | | ~/.fuzzi/config | CLI defaults | | .fuzzirc / fuzzi.toml | Project defaults |

Default API: https://fuzzi-ten.vercel.app/api

fuzzi config set default_env staging
export FUZZI_API_URL=https://fuzzi-ten.vercel.app/api   # override if needed
export FUZZI_DEBUG=1

CI example

- name: Fuzzi security gate
  run: |
    npm install -g fuzzi-cli
    fuzzi auth login --api-key "${{ secrets.FUZZI_API_KEY }}"
    fuzzi scan https://staging.example.com --fail-on critical

For web developers

Browser login and API contracts for fuzzi-ten.vercel.app:

See docs/frontend-integration.md

Development

npm install && npm test && npm run build
npm link   # optional global `fuzzi` command

Publish

npm publish --access public