Run AI release assurance from your terminal.

Usage: prooflane-inspector [options] [command]

Prooflane thin local Runner for MCP inspection and Hosted Intelligence

Options:
  -V, --version                 output the version number
  -h, --help                    display help for command

Commands:
  model                         inspect local AI model artifacts without
                                loading or executing them
  connect [options] [config]
  list                          list MCP capabilities
  call [options] <tool>
  snapshot [options]
  show [options] <baseline>
  diff [options] <baseline>
  record [options]
  stop
  sessions
  automate [options] <session>
  benchmark [options] <suite>   compare complete AI deployment candidates with
                                paired evidence and benchmark-health checks
  security-scan [options]       run a signed Hosted Intelligence Security scan
  redteam                       run signed hosted Security campaigns through
                                generic local MCP/LLM primitives
  gate [options] [config]       resolve and execute an approved governed Gate
                                or Suite
  suites                        inspect governed Suite artifacts
  runner                        register and operate a private Remote Runner
  debug
  auth
  project                       manage deterministic Prooflane project
                                resolution
  help [command]                display help for command

Usage: prooflane-inspector model [options] [command]

inspect local AI model artifacts without loading or executing them

Options:
  -h, --help                   display help for command

Commands:
  scan [options] <path>        static model supply-chain scan: formats, pickle,
                               archives, code, secrets, provenance, hashes,
                               licenses and reports
  security [options] <source>  model & supply chain security: artifact,
                               provenance, AI package and template/config packs
                               — static, no model execution
  help [command]               display help for command

Usage: prooflane-inspector model scan [options] <path>

static model supply-chain scan: formats, pickle, archives, code, secrets,
provenance, hashes, licenses and reports

Arguments:
  path                  model file or repository directory

Options:
  --no-recursive        scan only direct files in a directory
  --follow-symlinks     follow links only when they remain inside the artifact
                        root
  --max-files <n>       maximum inventory entries (default: 20000)
  --max-text-mb <n>     per-file text/config analysis limit in MiB (default: 2)
  --max-archive-mb <n>  bounded deep archive-analysis budget in MiB (default:
                        512)
  --threat-db <file>    local JSON SHA-256 threat database ({ hashes: { sha256:
                        {...} } })
  --json [file]         print JSON, or write it to an optional file
  --report <file>       write a self-contained HTML audit report
  --sarif <file>        write SARIF 2.1.0 for CI/code-scanning systems
  --fail-on <severity>  set exit code 1 for findings at/above:
                        critical|high|medium|low (default: "high")
  --quiet               suppress progress and human summary
  -h, --help            display help for command

Usage: prooflane-inspector model security [options] <source>

model & supply chain security: artifact, provenance, AI package and
template/config packs — static, no model execution

Arguments:
  source                    local path, https URL, or Hugging Face repository
                            id (owner/model)

Options:
  --source-type <type>      file | directory | url | huggingface (inferred when
                            omitted)
  --revision <ref>          repository revision; a commit SHA pins immutably, a
                            branch or tag does not
  --expect-sha256 <digest>  expected artifact digest, to detect hash drift
  --packs <ids>             comma-separated packs
                            (model-artifact,model-provenance,ai-package-integrity,template-config-integrity)
  --follow-symlinks         follow links only when they remain inside the
                            artifact root
  --max-files <n>           maximum inventory entries (default: 20000)
  --max-text-mb <n>         per-file text/config analysis limit in MiB
                            (default: 2)
  --max-archive-mb <n>      bounded deep archive-analysis budget in MiB
                            (default: 512)
  --json [file]             print JSON, or write it to an optional file
  --report <file>           write a self-contained HTML audit report
  --sarif <file>            write SARIF 2.1.0 for CI/code-scanning systems
  --fail-on <severity>      set exit code 1 for findings at/above:
                            critical|high|medium|low (default: "high")
  --quiet                   suppress progress and human summary
  -h, --help                display help for command

Usage: prooflane-inspector connect [options] [config]

Arguments:
  config               MCP config JSON or remote URL

Options:
  --url <url>
  -e, --env <pair...>
  --cwd <dir>
  --baseline <file>
  --oauth              OAuth 2.1 + PKCE for a remote MCP server
  -h, --help           display help for command

Usage: prooflane-inspector list [options]

list MCP capabilities

Options:
  -h, --help  display help for command

Usage: prooflane-inspector call [options] <tool>

Options:
  --input <file>
  --args <json>
  --expect <file>
  -h, --help       display help for command

Usage: prooflane-inspector snapshot [options]

Options:
  --tool <name>
  --input <file>
  --out <file>    contract path (default: "baseline.kawach.json")
  -h, --help      display help for command

Usage: prooflane-inspector show [options] <baseline>

Options:
  --tool <name>
  -h, --help     display help for command

Usage: prooflane-inspector diff [options] <baseline>

Options:
  --tool <name>
  -h, --help     display help for command

Usage: prooflane-inspector record [options]

Options:
  --label <label>
  -h, --help       display help for command

Usage: prooflane-inspector stop [options]

Options:
  -h, --help  display help for command

Usage: prooflane-inspector sessions [options]

Options:
  -h, --help  display help for command

Usage: prooflane-inspector automate [options] <session>

Options:
  --format <format>
  --out <file>
  -h, --help         display help for command

Usage: prooflane-inspector benchmark [options] <suite>

compare complete AI deployment candidates with paired evidence and
benchmark-health checks

Arguments:
  suite              benchmark JSON containing candidates[] and cases[]

Options:
  --trials <n>       measured repetitions
  --warmup <n>       discarded warmups
  --concurrency <n>  concurrency per candidate
  --api-key <key>    shared provider key; candidate route.keyEnv takes
                     precedence
  --out <file>       write the complete benchmark JSON report
  --json             print the complete report
  -h, --help         display help for command

Usage: prooflane-inspector security-scan [options]

run a signed Hosted Intelligence Security scan

Options:
  --target <name>            model/agent display name (default: "CLI agent")
  --control <id...>
  --prooflane-token <token>
  --prooflane-url <url>
  --prooflane-app-url <url>
  --llm-provider <provider>
  --llm-model <model>
  --llm-api-key <key>
  --llm-base-url <url>
  --json
  -h, --help                 display help for command

Usage: prooflane-inspector redteam [options] [command]

run signed hosted Security campaigns through generic local MCP/LLM primitives

Options:
  -h, --help                        display help for command

Commands:
  campaigns [options]               list entitled hosted campaign metadata
  campaign [options] <id> [config]  run one hosted campaign end to end and
                                    optionally write its HTML graph
  scan [options] [config]           run the entitled hosted Security control
                                    set against one MCP target
  help [command]                    display help for command

Usage: prooflane-inspector redteam campaigns [options]

list entitled hosted campaign metadata

Options:
  --prooflane-token <token>
  --prooflane-url <url>
  --json
  -h, --help                 display help for command

Usage: prooflane-inspector redteam campaign [options] <id> [config]

run one hosted campaign end to end and optionally write its HTML graph

Arguments:
  id                         hosted campaign id, for example sandbox-breakout
  config                     MCP config JSON or remote URL

Options:
  --url <url>                remote MCP server URL
  --bearer <token>           MCP bearer token (kept only on the local Runner)
  --oauth                    OAuth 2.1 + PKCE for the remote MCP server
  -e, --env <pair...>        local MCP environment override
  --cwd <dir>                local MCP working directory
  --model <provider:model>   local target LLM; compatibility alias
  --llm-provider <provider>
  --llm-model <model>
  --llm-api-key <key>
  --llm-base-url <url>
  --prooflane-token <token>
  --prooflane-url <url>
  --report <file>            write a standalone privacy-safe HTML graph
  --json
  -h, --help                 display help for command

Example:
  prooflane-inspector redteam campaign sandbox-breakout --url https://huggingface.co/mcp --report graph.html

Usage: prooflane-inspector redteam scan [options] [config]

run the entitled hosted Security control set against one MCP target

Arguments:
  config                     MCP config JSON or remote URL

Options:
  --url <url>                remote MCP server URL
  --bearer <token>           MCP bearer token (kept only on the local Runner)
  --oauth                    OAuth 2.1 + PKCE for the remote MCP server
  -e, --env <pair...>        local MCP environment override
  --cwd <dir>                local MCP working directory
  --model <provider:model>   local target LLM; compatibility alias
  --llm-provider <provider>
  --llm-model <model>
  --llm-api-key <key>
  --llm-base-url <url>
  --prooflane-token <token>
  --prooflane-url <url>
  --report <file>            write a standalone privacy-safe HTML graph
  --json
  -h, --help                 display help for command

Usage: prooflane-inspector gate [options] [config]

resolve and execute an approved governed Gate or Suite

Arguments:
  config                     local MCP config JSON or remote URL

Options:
  --target <name>            model/agent display name (default: "CLI agent")
  --control <id...>
  --prooflane-token <token>
  --prooflane-url <url>
  --prooflane-app-url <url>
  --llm-provider <provider>
  --llm-model <model>
  --llm-api-key <key>
  --llm-base-url <url>
  --json
  --gate <slug>              approved Gate slug or exact slug@version
  --suite <slug-or-version>  approved Suite slug or exact slug@version
  --suite-file <path>        explicit migrated legacy local Suite source;
                             resolves its matching approved Cloud Suite
  --project <id>             Prooflane project id
  --tags-file <path>         local tagged-test file (default:
                             ".prooflane/tags.json")
  --cache-dir <path>         owner-only immutable verified-artifact cache
  --offline                  execute an exact cached Gate or Suite version
                             without Control Plane access
  --project-root <dir>       repository root for project identity and local
                             tagged tests
  --url <url>                local remote MCP URL
  -e, --env <pair...>        local MCP environment override
  --cwd <dir>                local MCP working directory
  --github                   write a sanitized GitHub Step Summary and
                             annotations
  -h, --help                 display help for command

Usage: prooflane-inspector suites [options] [command]

inspect governed Suite artifacts

Options:
  -h, --help        display help for command

Commands:
  cache [options]   inspect the local immutable Gate, Suite, and Policy cache
                    without network access
  status [options]  compare legacy local Suites with Cloud without changing
                    either side
  diff [options]    show fingerprint and DRAFT-creation changes for legacy
                    local Suites
  sync [options]    create reviewed migration results as Cloud DRAFT versions
                    only
  help [command]    display help for command

Usage: prooflane-inspector suites cache [options]

inspect the local immutable Gate, Suite, and Policy cache without network
access

Options:
  --cache-dir <path>  owner-only immutable verified-artifact cache
  --project <id>      show one Prooflane project
  --json              print sanitized JSON
  -h, --help          display help for command

Usage: prooflane-inspector suites status [options]

compare legacy local Suites with Cloud without changing either side

Options:
  --project <id>             Prooflane project id
  --project-root <dir>       repository root containing .prooflane/suites
  --suites-dir <dir>         explicit local Suite directory
  --prooflane-token <token>
  --prooflane-url <url>
  --json                     print sanitized JSON
  -h, --help                 display help for command

Usage: prooflane-inspector suites diff [options]

show fingerprint and DRAFT-creation changes for legacy local Suites

Options:
  --project <id>             Prooflane project id
  --project-root <dir>       repository root containing .prooflane/suites
  --suites-dir <dir>         explicit local Suite directory
  --prooflane-token <token>
  --prooflane-url <url>
  --json                     print sanitized JSON
  -h, --help                 display help for command

Usage: prooflane-inspector suites sync [options]

create reviewed migration results as Cloud DRAFT versions only

Options:
  --yes                      confirm the displayed DRAFT-only migration plan
  --select <slug...>         synchronize only selected reviewed Suite slugs
  --project <id>             Prooflane project id
  --project-root <dir>       repository root containing .prooflane/suites
  --suites-dir <dir>         explicit local Suite directory
  --prooflane-token <token>
  --prooflane-url <url>
  --json                     print sanitized JSON
  -h, --help                 display help for command

Usage: prooflane-inspector runner [options] [command]

register and operate a private Remote Runner

Options:
  -h, --help                   display help for command

Commands:
  register [options] <config>
  start [options] <config>
  help [command]               display help for command

Usage: prooflane-inspector runner register [options] <config>

Arguments:
  config                     MCP config JSON or remote URL

Options:
  --project <id>             authorized Prooflane project
  --name <name>              human-readable private Runner name
  --label <label...>         bounded routing labels
  --pool <pool>              optional private Runner pool
  --credential-file <path>   owner-only output file (default:
                             "/Users/anishohri/.prooflane/remote-runner.json")
  --prooflane-token <token>
  --prooflane-url <url>
  --url <url>
  -e, --env <pair...>
  --cwd <dir>
  -h, --help                 display help for command

Usage: prooflane-inspector runner start [options] <config>

Arguments:
  config                    MCP config JSON or remote URL

Options:
  --credential-file <path>  owner-only Runner credential (default:
                            "/Users/anishohri/.prooflane/remote-runner.json")
  --once                    claim at most one job and then exit
  --poll-ms <milliseconds>  idle polling interval (default: 3000)
  --tags-file <path>        local tagged-test registry
  --suite-file <path>       explicit migrated legacy Suite source
  --project-root <dir>      local project root
  --url <url>
  -e, --env <pair...>
  --cwd <dir>
  --json
  -h, --help                display help for command

Usage: prooflane-inspector debug [options]

Options:
  -h, --help  display help for command

Usage: prooflane-inspector auth [options] [command]

Options:
  -h, --help        display help for command

Commands:
  login [options]
  whoami [options]
  logout
  help [command]    display help for command

Usage: prooflane-inspector auth login [options]

Options:
  --token <token>
  --prooflane-url <url>
  -h, --help             display help for command

Usage: prooflane-inspector auth whoami [options]

Options:
  --prooflane-token <token>
  --prooflane-url <url>
  -h, --help                 display help for command

Usage: prooflane-inspector auth logout [options]

Options:
  -h, --help  display help for command

Usage: prooflane-inspector project [options] [command]

manage deterministic Prooflane project resolution

Options:
  -h, --help      display help for command

Commands:
  bind [options]  bind the current Git remote fingerprint to an authorized
                  Prooflane project
  help [command]  display help for command

Usage: prooflane-inspector project bind [options]

bind the current Git remote fingerprint to an authorized Prooflane project

Options:
  --project <id>
  --prooflane-token <token>
  --prooflane-url <url>
  --project-root <dir>
  -h, --help                 display help for command