Adversary
Sign In

Getting started

Install the CLI, sign in, pull a free catalog adversary, and run your first review in a few minutes.

An adversary is a portable executable reviewer. You install the open-source CLI, pull packages from the free public catalog (or run a local project), and review a repository on your machine.

This guide is the shortest path to a successful adversary run. Platform install details, full flags, and publishing live in the linked docs.

1. Install the CLI

On macOS or Linux with Homebrew:

bash
brew install adversarylabs/tap/adversary
adversary --version

Linux and macOS can also use GitHub release archives; Windows builds from source until a packaged release ships. See CLI install for those paths. Prefer a stamped release binary so catalog official signatures verify with the production key.

2. Sign in

Catalog search and pull need authentication so we can track usage. The catalog is free — login is not a paywall.

$adversary login

Headless and CI options: --device, --ci, or service-account --token-stdin. Details: Registry authentication.

3. Pull and run a catalog adversary

Catalog ids use domain/name form (for example go/security). --path is the repository to review (default .).

bash
adversary login
adversary whoami

adversary pull go/security
adversary run go/security --path .

Browse more packages at /adversaries, or from the CLI with adversary search and adversary list.

What just happened

  • Pull installed the package into your local store and fetched its official signature when present.
  • Run resolved a review scope (git changes when possible), verified the signature for host execution, and launched the adversary against --path.
  • Output — structured findings on stdout; progress and trust messages on stderr. Use --format json for a machine-readable envelope.

Many catalog packages set permissions.model: true. Configure a provider key (OPENAI_API_KEY, ANTHROPIC_API_KEY, or FIREWORKS_API_KEY) so the CLI can run the model broker. See Permissions.

4. Optional: auto-select adversaries

With no package names, the CLI can pull packages you can access and run those that match the current change set:

bash
adversary run --path .
# or preview selection without running:
adversary run --dry-run --explain --path .

5. Optional: author a local adversary

Scaffold a TypeScript project (Node.js 22+), build it, and run it as a path — local source is trusted for host execution without a signature:

bash
adversary init my-adversary --sdk typescript
cd my-adversary
npm ci && npm test && npm run build
adversary run . --path ../some-repo

Next: TypeScript SDK, then pack and push to any OCI registry for private distribution.

Next steps