> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafter.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick Reference

> Go-to CLI commands for Rafter security.

## Remote Code Analysis

For more detailed guides, see the [basic](/guides/basics) and [advanced](/guides/advanced) guides.

### Scan a Repo

```bash theme={null}
rafter run --format md

# `scan` is an alias for `run`
rafter scan --format md
```

### Scan Modes

```bash theme={null}
# Fast scan (default)
rafter run --format md --mode fast

# Plus scan (agentic deep-dive — audits code like a professional cybersecurity analyst)
rafter run --format md --mode plus
rafter run --format md -m plus
```

### Scan a Private Repo

```bash theme={null}
# Pass a GitHub PAT directly
rafter run --github-token ghp_... --format md

# Or use an environment variable
export RAFTER_GITHUB_TOKEN=ghp_...
rafter run --format md
```

### Scan a Specific Repo and Branch

```bash theme={null}
rafter run --repo myorg/myrepo --branch main --format md
```

### Scan in the Background

```bash theme={null}
rafter run --skip-interactive
```

### Save Report to File

```bash theme={null}
rafter run --format md > security-report-$(date +%Y-%m-%d-%H-%M-%S).md
```

### Count Vulnerabilities

```bash theme={null}
rafter run | jq -r '.vulnerabilities | length // 0'

# Count critical vulnerabilities
rafter run | jq '[.vulnerabilities[] | select(.level == "error")] | length'
```

### Check Quota

```bash theme={null}
rafter usage
```

***

## Local Security Toolkit

Local security features. No API key required.

### Initialize

```bash theme={null}
rafter agent init                          # config only, detect agents
rafter agent init --risk-level aggressive  # set risk level
rafter agent init --with-claude-code       # install Claude Code integration
rafter agent init --all                    # install all detected integrations
rafter agent init --interactive            # guided setup with prompts
```

### Project Setup

```bash theme={null}
rafter agent init-project                  # generate instruction files for all platforms
rafter agent init-project --only claude-code,cursor  # specific platforms only
rafter agent init-project --list           # preview without writing
```

### Secret Scanning

```bash theme={null}
rafter secrets .              # scan current directory (respects .gitignore by default)
rafter secrets --staged       # scan git staged files only
rafter secrets --json         # output as JSON
rafter secrets --engine betterleaks  # force Betterleaks binary (default: auto-pick if installed)
rafter secrets --watch        # watch for changes and re-scan
rafter secrets --no-gitignore # scan everything, even files matched by .gitignore
```

### Command Execution

```bash theme={null}
rafter agent exec "git push"         # execute with risk assessment
rafter agent exec "rm -rf /" --force # bypass approval (not recommended)
```

### Skill Auditing

```bash theme={null}
rafter agent audit-skill path/to/skill.md
```

### Pre-Commit Hook

```bash theme={null}
rafter agent install-hook           # current repo only
rafter agent install-hook --global  # all repos
```

### Audit Logs

```bash theme={null}
rafter agent audit                       # view recent events
rafter agent audit --last 50             # last 50 events
rafter agent audit --event secret_detected  # filter by event type
rafter agent audit --agent claude-code   # filter by agent
rafter agent audit --since 2026-02-01    # filter by date
```

### Security Briefings

```bash theme={null}
rafter brief                     # list available topics
rafter brief security            # local security briefing
rafter brief setup/claude-code   # platform-specific setup guide
rafter brief commands            # condensed command reference
rafter brief all                 # everything
```

### Configuration

```bash theme={null}
rafter agent config show                              # view all config
rafter agent config get agent.riskLevel               # get a value
rafter agent config set agent.riskLevel aggressive    # set a value
```

***

## Exit Codes

### Rafter Code Analysis (`rafter run`, `rafter get`, `rafter usage`)

| Code | Meaning                                           |
| ---- | ------------------------------------------------- |
| 0    | Success                                           |
| 1    | General error                                     |
| 2    | Scan not found (HTTP 404)                         |
| 3    | Quota exhausted (HTTP 429 or 403 scan-mode limit) |
| 4    | Insufficient scope / forbidden (HTTP 403)         |

### Local Security (`rafter secrets`)

| Code | Meaning                                                     |
| ---- | ----------------------------------------------------------- |
| 0    | No secrets found                                            |
| 1    | Secrets detected                                            |
| 2    | Runtime error (path not found, not a git repo, invalid ref) |