The ValiqAI CLI starts a scan, waits for it, and exits with a code your pipeline can act on: 0 when nothing serious turned up, 1 when it found problems at or above the severity you choose. It's built for CI, and works the same in your terminal.

What it's for

Scanning on every deploy. A CI step scans the address you just deployed and fails the build on what you chose, with a summary, annotations or a test report where your team looks.
Scanning from your terminal. Before a release, after a fix, or to see what changed.
Everything around a scan. Look up past scans and their problems, verify domains, check credits, and find out what's wrong when something is.
Scanning from your AI coding tool. valiqai mcp lets Claude Code, Cursor or VS Code start a scan and fix what it finds. See AI coding tools.

First run on a laptop

About two minutes, with a domain you've verified:

Terminal

$ npx @valiqai/cli login$ valiqai link$ valiqai scan

login signs you in from the browser, link ties this folder to your site in valiqai.json, and scan scans its staging address. See Install and sign in and Link a project.

Adding it to CI

About five minutes. valiqai init writes the job (or copy it from a CI guide or the app's Integrations › CI), you add VALIQAI_API_KEY to your CI's secrets, and push. In GitHub Actions the run gets a summary table and an annotation for each blocker, and fails only on what you chose. See CI output.

Day to day

Terminal

$ valiqai scans                      # recent scans$ valiqai scans view cmh2x8k1p0      # a scan's problems, or --web to open it$ valiqai problems cmh2x8k1p0 --severity high$ valiqai domains verify staging.northstar.app --wait$ valiqai credits$ valiqai doctor                     # something's wrong: what, and how to fix it

Before you begin

A ValiqAI account on a plan with API access.
A verified domain for the site you'll scan. See Verify your domain.
Credits for the scan, in the workspace you use.
Node 20.19 or later.
For CI only: an API key. Create one under Settings › API keys, or Team settings › API keys for a team key.

Versions

The CLI is @valiqai/cli on npm. valiqai --version prints yours, and once a day, outside CI, it mentions a newer one. What changed in each version is in the changelog. Exit codes 0 to 3 never change meaning.

In this section

Install and sign in: package managers, npx, browser sign-in, keys for CI, workspaces.
Link a project: valiqai.json, environments, and verifying domains from the terminal.
Scanning: scan types and costs, what fails the build, timeouts, retries, exit codes.
CI output: GitHub summaries and annotations, JUnit, SARIF, Markdown and JSON.
AI coding tools (MCP): scans and problems from Claude Code, Cursor or VS Code.
Commands: every command and flag, as --help shows them.
Configuration: settings, environment variables, doctor, shell completion.
Troubleshooting: every error, by code.