Install the CLI

The Ironhide CLI takes you from nothing to your agent's first security results, and then to a check on every pull request. One command installs it:

curl -fsSL https://app.ironhideai.com/install.sh | bash

What the installer does#

The installer is a small POSIX shell script. It needs no root and installs no packages. Step by step, it:

1. Checks that python3 (3.9 or newer) is on your PATH. Python is the CLI's only requirement.
2. Downloads the CLI, a single Python file, to ~/.ironhide/ironhide.py.
3. Writes a two-line wrapper script to ~/.local/bin/ironhide so you can type ironhide anywhere.
4. Points the CLI at the server that served the script, merging into any existing config so saved credentials are never clobbered.

If ~/.local/bin is not already on your PATH, the installer tells you and prints the exact line to add to your shell profile:

export PATH="$HOME/.local/bin:$PATH"

The results come from the Ironhide API, not the CLI: every number it renders is served, so the CLI and the web UI always agree.

Requirements#

No Docker, no Node, no compiler, no root.

Where configuration lives#

Everything the CLI remembers sits in one file:

{
  "url": "https://app.ironhideai.com",
  "email": "you@acme.dev",
  "account_id": "acct_...",
  "owner_key": "wk_owner_...",
  "agents": [
    { "agent_id": "agt_...", "name": "my-agent", "mode": "ci", "api_key": "wk_live_..." }
  ],
  "active_agent_id": "agt_..."
}

That file is ~/.ironhide/config.json. Because it holds your keys, the CLI keeps it at owner-only permissions (chmod 600) every time it writes it. The account fields appear after ironhide login and each agent entry after ironhide connect; a fresh install has just the server URL. (The CLI also keeps flat agent_id / api_key / agent_name copies of the active agent so older readers of the file keep working.)

You can also override the server per-invocation with the IRONHIDE_URL environment variable, which takes precedence over the config file, and move the whole config directory with IRONHIDE_HOME (an absolute path; the baselines ironhide test keeps live under the working directory, not here).

Pointing the CLI at a server#

The installer points the CLI at https://app.ironhideai.com automatically. If you ever need to switch servers, for example to a dedicated Ironhide deployment:

ironhide use <url>

This rewrites the url field in your config and leaves everything else alone. The URL must start with http:// or https://.

Checking your setup#

ironhide status

status shows your configuration and the server's health at a glance:

ironhide 0.1.1
server ................................. https://app.ironhideai.com
config ................................. /home/you/.ironhide/config.json
health ................................. ok  (ci agent, N episodes)
account ................................ you@acme.dev  (acct_...)
plan ................................... Pro
subscription ........................... active
runs ................................... 12 / 3,000 this month, resets 2026-11-01
agents ................................. 1 / 10
agent .................................. my-agent  (agt_..., ci mode, 4 runs)  verified

• server is where every command sends its requests.
• health pings the server; a failure here means the CLI cannot reach it.
• account appears once you have logged in, followed by your plan, subscription status, runs this month against the quota (with the reset date) and agents against the plan's cap.
• agent shows your connected agent, its mode, how many runs it has recorded, and whether it is verified. Before you connect one, this line says so and points you at ironhide connect.

If the health check fails, confirm the URL with ironhide use and check your network. Every error the CLI prints comes with a hint line telling you the most likely fix.

Logging out#

ironhide logout

Logout removes the saved account credential and every saved agent from ~/.ironhide/config.json, and ends the terminal's session on the server when it signed in with ironhide login. Your account, your agents, and their run history remain intact, and ironhide login plus ironhide connect reconnect you. If you think an agent's API key may have leaked, run ironhide agents rotate-key <agent_id>: the old key stops working.

The server URL survives logout, so the CLI stays pointed where you left it.

Every command, one screen#

Run ironhide with no arguments for the full command list. The short version:

Every command takes --help. The full flag-by-flag reference lives on the CLI reference page.

Next steps#

• Quickstart: sign up on the website, ironhide login (your browser opens, approve, done), then ironhide setup for your first results.
• Link your repository: ironhide link puts the tests on every pull request, on GitHub or GitLab.