CLI

Install

npm i -g @index365/cli

This puts the index365 command on your PATH. Every command below uses it directly.

To update to the latest version later:

npm i -g @index365/cli@latest

The CLI also prints a notice when a newer version is available, so you do not have to check by hand.

Authenticate

index365 login            # asks how you want to sign in, then saves a key (0600)
index365 whoami           # which account/org this machine is signed in as
index365 doctor           # diagnose auth, version, and config (--fix applies safe fixes)
index365 --status         # auth, org, plan, and credits at a glance

index365 login asks how you want to sign in. Browser (the default) runs a loopback + PKCE flow: it opens the dashboard consent screen, and once you approve it mints a scoped key and saves it locally. The secret never travels through a URL, and nothing is pasted. API key lets you paste a key from the dashboard API Keys page (available on every plan, including Free). To skip the menu, run index365 login --web for the browser flow directly.

For CI or headless machines, pass index365 login --key <key> or set INDEX365_API_KEY to use a key with no prompt. The CLI never prints your secret.

Scan a site end to end

index365 projects list --status active
index365 projects create --domain yoursite.com --name "Yoursite"   # add a project (idempotent by domain)
index365 scan https://yoursite.com                    # waits, then prints the score (AI-Readiness default)
index365 scan https://yoursite.com --no-wait          # queue it and print the runId for async work
index365 runs list --project "$PROJECT_ID"            # scan history for a project
index365 runs get "$RUN_ID"                           # one run's status and score
index365 findings list --run "$RUN_ID" --severity critical --json
index365 findings get --run "$RUN_ID" "$FINDING_ID"   # one finding, with its fix prompt block
index365 report "$RUN_ID"                             # compact JSON context for your agent
index365 report "$RUN_ID" --save report.json          # full JSON report
index365 projects archive "$PROJECT_ID" --confirm yoursite.com   # reversible removal (echo its domain)
index365 projects restore "$PROJECT_ID"               # reactivate the same project and history

scanresolves the project from the URL's domain automatically, because projects are domain-anchored. If the domain has no project yet, the command errors and prints the exact projects create command to run; it never creates one for you and never prompts in a non-interactive shell. Pass --project to override the resolution. The command waits by default and prints the score when the scan finishes; --no-wait queues the scan and prints the runId instead.

findings list filters by --severity, --category, and --stage. findings getincludes a fix prompt block: a ready-to-paste prompt for your coding agent, the same text as the dashboard's copy-fix-prompt button. report has three forms: report "$RUN_ID"prints compact JSON context sized for an agent's first read, --save writes the full JSON report to a file, and report --project "$PROJECT_ID" returns the latest completed report for a project (add --product to pick one).

Archive removes a project from active lists and blocks new scans, but preserves its scan history and API keys so it can be restored. index365 projects delete is a hidden compatibility alias for archive and reports the result as archived. Use --status archived to find projects you can restore, or --status all to include every lifecycle state.

A project's domain covers its apex and every subdomain, so scan can score staging.yoursite.com or pr-42.preview.yoursite.com under the same project without creating a new one.

Scan a local page before you deploy

scan local scores a page running on your own machine, so you can check a fix before you deploy. The CLI fetches the local URL and uploads the HTML response; index365 never fetches your machine, and cookie values never leave it. It scores the on-page AI-Readiness checks read from that HTML (content, structure, schema, and answerability). DNS, TLS, redirects, robots/sitemap/llms.txt, email auth, and response-header security are not evaluated and are listed in coverage.notEvaluated; run a live scan for those. scan local supports --product ai-readiness only today.

# Iterate locally: scan the dev server, fix, re-scan, repeat before pushing
index365 scan local http://localhost:3000/pricing \
  --project "$PROJECT_ID" --fail-under 80

scan local resolves the project the same way scan does and waits by default; pass --projectto pin it explicitly when the local URL's host does not match your project's domain. --fail-under exits non-zero when the score lands below your gate, so it slots straight into CI.

Marketing Signal scans

index365 scan https://yoursite.com --product marketing-signal        # five-stage marketing scan
index365 report --project "$PROJECT_ID" --product marketing-signal   # latest completed report (stage scores)
index365 findings list --run "$RUN_ID" --stage measure --json
index365 integrations list --project "$PROJECT_ID"                   # connected-signal providers
index365 integrations status --project "$PROJECT_ID"                 # provider connection health

--product security is part of the same scan grammar, but Website Security is not yet available from the CLI: the command returns a friendly error that lists what is available. Until it ships, Website Security scans run through the REST API (POST /runs with scanMode=paid_website_security); see the REST API page.

CI example

# Fail the pipeline when a deploy degrades AI-Readiness
index365 scan "https://yoursite.com" --json > run.json
score=$(jq -r .score run.json)
test "$score" -ge 70 || { echo "AI-Readiness score $score below 70"; exit 1; }

scan waits for the result by default, so the JSON on stdout already carries the final score. To gate before deploy instead, use scan local with --fail-under as shown above.

Conventions

• --json on every command prints the raw API payload for scripts and agents.
• Stable exit codes: 0 ok, 1 error, 2 usage, 3 auth, 4 not found, 5 quota/conflict/rate.
• --status prints a one-glance card: auth and key source, organization, plan, and credits remaining.
• index365 mcp config prints ready-to-paste MCP host configuration.
• -h prints help for any command, with examples; -V prints the CLI version.

Migrating from 0.x

CLI 1.0.0 renames the scan grammar: scan is the verb, and products are values of --product, never command prefixes. Every old spelling keeps working as a hidden compatibility alias for at least 90 days: it runs the new command and prints a one-line rename note. Aliases no longer appear in help.

Drive the CLI from your agent

The index365 agent skills wrap these commands so your coding agent can run a scan and apply fixes in one instruction. Install and authenticate the CLI first, then see Agent skills for the one-command install.