Scan in your terminal

Install and sign in

npm install -g @patchlight/cli
patchlight login

Needs Node.js 22 or newer.

patchlight login opens a browser and shows a short code to confirm. The token is stored in ~/.patchlight/credentials.json (mode 0600), so no secret passes through your shell history. The machine then appears in the dashboard under API Keys, where you can revoke it. Over SSH or on a headless box, the URL and code are printed so you can open them anywhere you are signed in.

Run a scan

cd your-repo
patchlight scan --diff

Run patchlight scan with no flags and it asks which mode you want, then prints the flag that skips the question next time.

--diff also reads the other files in each changed directory, so a vulnerability that spans two files is still visible. Add --no-neighbours to read only the changed files, or --base main to pick the base branch yourself. It takes seconds and costs cents.

What happens during a scan

1. Walk. The tree is walked locally, skipping node_modules, build output, lockfiles and binaries.
2. Preflight. Your balance and the size limits are checked before any code is uploaded. A scan you cannot pay for sends nothing.
3. Upload. Only the text files that survived the walk are sent.
4. Triage pass. The model decides what is worth a close read.
5. Findings. Each finding streams in as soon as it is written, so you can start reading while the rest are still coming.

The scan runs fullscreen. When you quit, your terminal is left as it was, with a short summary under your prompt.

Triage the findings

When the scan ends you are already in triage. Each finding shows the flagged lines, read from your disk and syntax highlighted, with the suggested fix underneath.

Triage writes to the same place the dashboard reads, so a dismissal here is a dismissal everywhere.

Report a finding upstream

Found something in a dependency or in someone else's repository?

patchlight report <finding-id> | pbcopy

This prints the finding as private-disclosure markdown, ready for a project's security policy form or a GitHub advisory. The advisory URL goes to stderr, so the pipe stays clean.

Use it in scripts

When output is piped or redirected, the picker, the fullscreen UI and the triage keys turn off. The scan still runs and prints one plain report.

patchlight scan --diff > scan.log

What leaves your machine

• Sent: the text files of your working tree, after the skip rules and size limits.
• Never sent: binaries, lockfiles, dependency folders, or anything outside the repository root.

Scans are billed per token, so --diff and --path are also the cheap options.

CLI or SDK?

Both packages install a patchlight command. Pick by where it runs.

The CI commands (review, status, findings, --fail-on and the rest) behave identically in both, because the CLI runs the SDK's own implementation. Installing the CLI never changes what a pipeline does.