Skip to Content
Scan your AI agents for free·npx -y @inkog-io/cli scan .·Get Started →
Getting StartedQuickstart

Quickstart

Get Inkog scanning your AI agent codebase in under 60 seconds.

The fastest way to try Inkog — no install required. Just run npx -y @inkog-io/cli scan . in your project directory.

Scan with npx (No Install)

Run a scan instantly with Node.js:

npx -y @inkog-io/cli scan .

This downloads the Inkog CLI on first run and caches it for future use. No global install needed.

Or Install Permanently

curl -fsSL https://inkog.io/install.sh | sh

See Installation for Homebrew, Go, and other methods.

Get Your API Key

  1. Sign up at app.inkog.io  (free, 30 seconds)
  2. Generate an API key from your dashboard
  3. Set it in your environment:
export INKOG_API_KEY=sk_live_your_key_here

Without an API key, Inkog runs a free preview scan on a single file so you can see it in action.

One-Command Scan

Terminal
$inkog -path ./demo_agent
✓ Found 4 local secrets in 27 files ✓ Redacted secrets from 27 files ✓ Server found 16 logic issues 🔍 Detected: Smolagents framework 🔴 EXPLOITABLE VULNERABILITIES (7) └─ [VULN] Unvalidated Code Execution in Agent Tool [agent.py:25] - CRITICAL [moderate fix] Agent tool executes code (eval/exec/shell) where the input can be influenced by LLM output or prompt injection. Ref: CWE-94, CWE-95, CWE-78 | LLM10:2026 Taint source: function_parameter (user input) └─ [VULN] SQL Injection via LLM-Generated Query [agent.py:67] - HIGH [moderate fix] Agent constructs a SQL query using string interpolation where the interpolated value is influenced by LLM output. Ref: CWE-89, CWE-564 | LLM10:2026 🟠 RISK PATTERNS (13) └─ System Prompt Leakage (OWASP LLM08:2026) [operations_agent.py:122] - HIGH [moderate fix] Ref: CWE-209, CWE-532 | LLM08:2026 EU AI Act: Article 15.4 └─ Excessive Tool Permissions [customer_service_agent.py:67] - MEDIUM [moderate fix] Ref: CWE-250, CWE-269 | LLM03:2026 EU AI Act: Article 15.3 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Inkog Core: 20 findings (policy: balanced) ● 7 Exploitable Vulnerabilities (require immediate fix) ● 13 Risk Patterns (structural issues) ● 1 Governance Gaps (compliance issues) 🔍 Agent Capability Surface Agents: 26 │ Tools: 218 │ Gaps: 30 (1 critical, 8 high) Governance Score: 91/100

Output above is trimmed from a real scan of the demo agent . Secrets are redacted locally before upload; the server never sees them.

What Just Happened?

  1. Code Scanned: Inkog reads your local directory
  2. Secrets Redacted: Any credentials are redacted locally before upload (privacy first!)
  3. IR Generation: Inkog converts your code into our Universal IR (Intermediate Representation)
  4. Pattern Matching: Security rules are applied against the normalized IR
  5. Taint Analysis: Data flow is traced from sources (user input) to sinks (LLM calls)
  6. Report Generated: Findings are reported with file locations and remediation hints

Output Formats

SARIF (for CI/CD integration)

Terminal
$inkog scan . -output sarif > results.sarif

JSON (for programmatic processing)

Terminal
$inkog scan . -output json > results.json

Filter by Severity

Only show critical and high severity issues:

Terminal
$inkog scan . -severity critical,high

Security Policies

Filter findings by security policy:

# Low noise - only high-confidence findings
inkog scan . -policy low-noise
 
# Governance-focused (Article 14 controls)
inkog scan . -policy governance
 
# EU AI Act compliance
inkog scan . -policy eu-ai-act

Next Steps

Installation Options

Install Inkog via Homebrew, Go, or download binaries directly.

Learn more

Configuration

Customize Inkog with configuration files, rule exclusions, and CI integration.

Learn more
Last updated on
PlatformInstallation