Getting Started

Install

Aevrin is distributed on PyPI and npm. Both installation paths run the same CLI and require Python 3.10 or newer. The npm package requires Node.js 18 or newer and creates a private Python environment inside its own package directory, so it does not modify global Python packages.

python3 -m pip install --user pipx
pipx ensurepath
pipx install aevrin

Confirm it installed correctly:

aevrin --version

Log in

aevrin login

This opens your browser for a device-code approval flow — no password is ever typed into the terminal. Once approved, a long-lived API key is stored at ~/.aevrin/credentials.

Run your first scan

aevrin scan https://github.com/owner/mcp-server

TARGET can be a GitHub URL, a local directory path, or a live MCP server URL — see CLI Reference → scan for the full breakdown of what each target type actually checks. The scan runs entirely on your machine with each tool in its own version-pinned Docker container and, once logged in, the result is uploaded to your dashboard automatically.

You'll see a stage-by-stage progress trace, then a score, a findings table, and any coverage notes:

Target: https://github.com/owner/mcp-server

Score:  46/100  High risk — several findings need attention

┌──────────┬────────────────────────────────┬─────────────────────────────┬─────────┐
│ Severity │ Title                          │ OWASP category                │ Tool    │
├──────────┼────────────────────────────────┼─────────────────────────────┼─────────┤
│ HIGH     │ ...                            │ Token Mismanagement & ...     │ gitleaks│
└──────────┴────────────────────────────────┴─────────────────────────────┴─────────┘

See it on the dashboard

Every scan you run (as long as you're logged in and didn't pass --no-upload) shows up at mcp.aevrin.net/dashboard — same findings, same stage breakdown, same score, in the same format whether it came from the CLI, the hook, or the dashboard's own "scan a repo" form. See Dashboard.

Next steps