@0cloud/cli

0cloud CLI

The service client for 0cloud. Use the same workspace from your terminal, scripts or coding agent. Requires Node.js 24 or later. The separate 0 engine is not required or installed.

npm install -g @0cloud/cli
0cloud auth login
0cloud codebases list
0cloud capabilities

For a local deployment, use 0cloud auth login --dashboard http://localhost:3001. Login opens the dashboard and saves the selected workspace's scoped token in ~/.0cloud/credentials.json with owner-only permissions. It never changes 0 credentials. ZERO_CLOUD_TOKEN, ZERO_CLOUD_ORG and ZERO_CLOUD_ENDPOINT support CI. --endpoint and --org override the saved service and workspace.

Choose the work

Security tests is the dashboard workflow name. tests is the corresponding CLI command. Existing pentests start commands remain compatible. scan is source-only analysis, with results that do not establish reproduction or verified repairs. Opening configuration or checking readiness does not start work.

Source analysis

0cloud scan https://github.com/owner/repository
0cloud scan ./src --whitebox --focus "Authorization and tenant isolation"

Ordinary scan accepts an HTTPS repository URL. Local files require an explicit --whitebox source-analysis request; the CLI rejects them before reading source or requesting a price. It never switches workflows automatically.

Uploads exclude symlinks, .env files, dependency/build directories, invalid UTF-8 and common binary formats. Limits: 300 files, 400 KB per file and 8 MB total. Excluded paths are reported on stderr; exceeding total limits fails rather than silently returning a partial submission. Review the files you select before upload.

--whitebox uses /api/whitebox-scan; --focus requires it. Repository URL support depends on deployment configuration. The /api/scan route is repository-only, while fixed-credit or funded source configuration can reject URL acquisition. Those deployments may require explicit --whitebox file uploads or the connected source-scans workflow below. A rejected URL is reported as an error without a fallback.

For deployments with queued source operations enabled:

0cloud source-scans start <repository-uuid> --commit <full-40-character-sha> \
  --operation whitebox-scan --idempotency-key <uuid>
0cloud source-scans list --repository <repository-uuid>
0cloud source-scans show <job-id>
0cloud source-scans wait <job-id>
0cloud source-scans cancel <job-id>

Queued source jobs use their own IDs and source-scans commands. Managed executions use runs. A recovery_required result is a failure requiring usage reconciliation, never a reason to resubmit automatically. Deployment feature flags, authority and operation limits remain server-controlled.

Codebases and security tests

0cloud codebases show owner/repository
0cloud codebases configure owner/repository --file plan.json
0cloud tests readiness owner/repository
0cloud tests start owner/repository --idempotency-key <uuid>
0cloud runs wait <run-id>
0cloud runs report <run-id>

configure reads JSON containing plan and optional enableSchedule. It saves against the server's current revision and source revision. Inspect codebases show and the proposed plan before saving. It never starts a test. Changing a schedule or publication policy requires your explicit decision.

codebases enroll <repository-uuid> enrolls a repository already available through the workspace's GitHub connection; inspect its saved trigger policy first. GitHub connection and new-install consent remain browser flows.

Start uses the saved scope, budget and publication policy. The CLI prints an attempt key to stderr before submission. Save it. If a response is lost, inspect the recorded runs and reuse the same key for the same attempt. Do not generate a new key or replay automatically when execution or usage is uncertain. A start response is admission evidence, not proof of a completed test.

History and review

0cloud runs list --status failed --limit 20 --offset 20
0cloud runs events <run-id> --limit 100 --offset 100
0cloud findings list --scan-id <run-id> --status pending --limit 20 --offset 20
0cloud findings triage <finding-id> --status unsure --reason "Needs reproduction evidence"
0cloud reviews list --days 0 --repository <repository-uuid>

PR history defaults to all time; --days accepts 0, 7, 30 or 90. Use --cursor with the JSON cursor returned by the API, or --page for its existing page API. Runs, findings and events support --limit and --offset. Review decisions do not establish reproduction or a verified repair. PR execution follows saved repository triggers; manual review dispatch and GitHub delivery are not added by this CLI release.

Memory and usage

0cloud memory list
0cloud memory list --repository <repository-uuid>
0cloud memory add "Check tenant ownership before reading records" --revision <revision>
0cloud memory remove <workspace-memory-id> --revision <revision>
0cloud usage status
0cloud usage models

Memory writes manage explicit workspace rules. Use the exact revision and rule ID returned by the API. Conflicts are reported without automatic overwrite. The repository filter scopes reads; it does not change the scope of new rules. Observed facts and feedback remain distinct from approved rules. Generated Knowledge documents do not yet have a dedicated public CLI API.

Usage commands only read account admission and the model catalog. They cannot purchase usage, change caps, consent to paid usage or waive unresolved charges. Required token scopes and workspace roles are enforced by the server.

Other commands

• dependencies list, dependencies scan: read or refresh dependency checks.
• dependencies fix <dependency-id> <finding-id>: explicitly open an upgrade PR; never merge it.
• auth status, auth logout: inspect or remove this CLI's saved credentials.
• api get/post/patch/delete <relative-path> [--file body.json]: call an existing workspace API with the same credentials and permissions. It does not expose internal dashboard RPCs or bypass authorization.
• capabilities: inspect the installed commands and known API gaps.

Website/app target creation, authorization and test start need a public API matching the dashboard flow. They are not disguised as codebase tests. Team, integration and payment administration remain dashboard workflows.

Output and errors

Results are JSON on stdout. Diagnostics and attempt keys go to stderr. Exit codes: 0 success, 1 invalid input/configuration or wait timeout, 2 API/network failure or an unsuccessful terminal run. Source allow/review/block verdicts are data, not transport failures. A wait timeout does not cancel the job. The client never retries writes automatically. Unavailable routes fail visibly.

Development

pnpm --filter @0cloud/cli build
pnpm --filter @0cloud/cli test
node packages/0cloud-cli/dist/public/public-cli.js --help

The npm allowlist includes only dist/public and this README. Operator commands in src/cli.ts and OPERATOR.md are excluded from the public entry point.

Coding agents and /security-loop

Install the portable workflow in your project:

0cloud skills install --agent codex --project /absolute/path/to/repository
# --agent claude or --agent cursor selects their project skill directory.
0cloud skills print

Invoke /security-loop in a compatible agent. It reads recorded review evidence, checks the source, makes supported fixes, runs tests and requests a review of the updated commit. Your coding agent performs the edits. Existing skills are never overwritten.

0cloud findings context <finding-id>
0cloud reviews context <review-id>
0cloud reviews session <review-id> --file review-session.json
0cloud reviews rerun <review-id> --head <full-commit-sha> --session review-session.json
0cloud reviews wait <returned-run-id> --head <full-commit-sha> --timeout 600

A session permits at most three requests and three credits. Reuse the same journal for the invocation. An unknown outcome stops further requests. Re-review checks the live PR head and uses the existing fixed-price admission; it does not start a full security test or merge the PR.

For MCP clients, configure a stdio server with command 0cloud and arguments ["mcp"]. It uses the same workspace login. Read tools expose reviews, bounded fix context and run state. request_review requires explicit confirmation and the expected full commit SHA; each request is capped at one credit and the server permits at most three requests per process. Restarting it does not create an account-level spending limit.

The npm package also includes a thin Claude Code plugin at @0cloud/cli/plugin beneath npm root -g. Load that directory with claude --plugin-dir /absolute/plugin/path and invoke /0cloud:security-loop. No private repository checkout or embedded token is required.