CLI Reference

DeployReady has two command surfaces. Shell commands are what you type in your terminal (deployready analyze, deployready init, …) — ideal for scripts and CI. The interactive prompt (the deployready › prompt you get when you launch a session) has its own short commands for stepping through a scan and fixing issues one at a time.

Global usage & options

Running deployready with no command launches the interactive session. Otherwise the shape is deployready <command> [options]. Most commands take an optional project path that defaults to the current directory (.).

# Launch the interactive session on the current directory
npx deployready@latest

# Or point it at a project, with or without a command
npx deployready@latest ./my-app
npx deployready@latest analyze ./my-app

These options work across the whole CLI:

Shell commands

deployready [path] ·  interactive (default)

The default command (alias: shell). Starts a guided, interactive session that stays open so you can scan, review findings, and apply fixes one at a time. New users get a numbered menu first — no command knowledge required.

npx deployready@latest                 # current directory
npx deployready@latest ./my-app        # a specific project
npx deployready@latest interactive .   # the explicit form

deployready analyze [path]

Run a single, non-interactive scan and print the results, then exit. This is the command for scripts and CI. Combine it with the flags below to control AI, dynamic testing, report output, and build-gating. See analyze flags for the full list.

# Full scan of the current project
npx deployready@latest analyze .

# CI-friendly: no AI, write a report, fail the build on critical findings
npx deployready@latest analyze ./my-app --no-ai --export --fail-on critical

# Machine-readable output for tooling
npx deployready@latest analyze . --json > report.json

deployready init

Run the first-time setup wizard. It asks which AI model should power deeper analysis (Claude, OpenAI, or local Ollama) and stores your choice — and, for Claude/OpenAI, your API key — in ~/.deployready/config.json. Re-run it any time to switch providers or change a key. See Managing AI providers & config.

npx deployready@latest init

deployready report [path]

Re-run a scan and save a Markdown report (deployready-report.md) to the project root. This is a fast, AI-free shortcut equivalent to analyze --no-ai --export when all you want is the file.

npx deployready@latest report ./my-app

deployready config

Print the active configuration — the selected model, Ollama settings, scan ports, and whether each API key is set. Secret values are never printed; a configured key shows as «set».

$ npx deployready@latest config
{
  "model": "claude",
  "claudeApiKey": "«set»",
  "openaiApiKey": null,
  "ollamaPort": 11434,
  "ollamaModel": "llama3",
  "warnBeforeExternalSend": true,
  "defaultPorts": [3000, 5000, 8000, 8080, 4000]
}

analyze flags

All flags below apply to deployready analyze.

Active (authenticated) scan

With your app running locally, --activelets DeployReady act as a logged-in user and try to break access control — the manual checks you'd otherwise do in Burp or Postman. It finds broken object-level authorization (IDOR/BOLA), broken tenant isolation, privilege escalation (a forged role: admin claim), and unverified JWTs (the server accepting an alg:none token).

# Act as one user, and add a second to test isolation
npx deployready@latest analyze . --active --token "<your-JWT>" --token-b "<second-user-JWT>"

Exit codes

analyze uses distinct exit codes so CI can tell a policy failure apart from a tool crash. Pair them with --fail-on to gate deploys.

- name: Production-readiness gate
  run: npx deployready@latest analyze . --no-ai --export --fail-on critical

Interactive prompt commands

Launch a session with deployready. You'll see a numbered menu — pick 1 to scan right away, 2 to set up or change the AI model, or 4 to drop to the command prompt. At the deployready › prompt you can type any of the commands below. Commands that act on a finding take its number from the issues list.

Running a scan

Reviewing findings

Fixing issues

Output & guidance

Session

deployready › scan          # run the full pipeline
deployready › issues crit   # list only critical findings
deployready › show 1        # inspect the first finding
deployready › fix 1         # fix it (auto-fix or AI diff you approve)
deployready › verify 1      # confirm it’s resolved
deployready › export all    # save Markdown + HTML report
deployready › exit

Managing AI providers & config

DeployReady stores its settings in ~/.deployready/config.json, written with owner-only permissions (0600). AI is optional — the static and dynamic checks run fully without it. For an overview of providers and the privacy model, see Configure AI.

Switch provider, change your key, or change the model

There are four ways to change which model DeployReady uses:

• Re-run the wizard: deployready init walks you through picking a provider and entering a new key.
• From inside a session: open the menu and choose 2 — Set up or change the AI model. You can switch provider, paste a new key, or select an Ollama model without leaving the prompt.
• Environment variable: set ANTHROPIC_API_KEY or OPENAI_API_KEY. Env vars always take precedence over the config file and are never written to disk.
• Edit the file: change values directly in ~/.deployready/config.json.

# Re-run setup to switch provider, model, or key
npx deployready@latest init

# Or provide a key via environment variable (overrides config, never stored)
export ANTHROPIC_API_KEY=sk-ant-...      # macOS / Linux
$env:ANTHROPIC_API_KEY = "sk-ant-..."    # Windows PowerShell

# Confirm what's active (keys are masked)
npx deployready@latest config

Configuration fields