Docs

The CLI — audits that never leave your VPC

The primary way to run erabot. The full stack — four-layer detection, the agentic audit engine, and verification gates — executes inside your own environment with your own model keys. Your source code never reaches erabot servers; the platform receives only the metadata you opt to sync.

# Install and authenticate (requires an active plan — Pro or above)
# The CLI is provisioned after a demo: you receive a versioned wheel + Docker image.
pip install ./erabot-<version>-py3-none-any.whl   # or: docker pull <your-registry>/erabot
erabot login

# Run the full enterprise audit on the current repo, in your VPC
erabot audit .

# Outputs (written locally, yours to keep):
#   erabot-audit/report.md              human-readable cost report
#   erabot-audit/agent-instructions.md  Claude Code applies the fixes
#   erabot-audit/patches/*.patch        verified, git-apply-clean diffs
#   erabot-audit/results.json           machine-readable summary

# Optional: publish metadata (never code, never diffs) to your Fleet dashboard
erabot audit . --sync

Quickstart: audit in your own environment

erabot runs entirely on your machine — your source code never leaves your environment (it goes only to your own model provider, under your key). Install the wheel we provision for your team, then audit any repo in place:

# Install the wheel provisioned to your org (requires an active plan)
pip install ./erabot-<version>-py3-none-any.whl   # or: docker pull <your-registry>/erabot

# Audit a repo in place — code stays local
export ANTHROPIC_API_KEY=...   # your own key
erabot audit .

# Outputs: report.md, agent-instructions.md, and apply-ready patches/
# Apply the fixes with a coding agent:
claude "Apply the fixes in erabot-audit/agent-instructions.md"

Full API reference

The canonical, always-in-sync API reference is generated from our OpenAPI spec. Every endpoint, every field, every response code.

Runtime scan (Helicone)

Paste a Helicone API key and erabot projects savings from your real production traffic — no code upload, no tree-sitter, no round-trip through the scan queue. Returns a completed scan synchronously (~5–10s depending on your log volume).

curl -X POST https://api.erabot.ai/api/scans/helicone \
  -H "Authorization: Bearer {your_api_key}" \
  -F "helicone_api_key=sk-helicone-xxxxxxxx" \
  -F "window_days=30"

Response is the same ScanResultResponse shape as a code scan, with input_source="helicone". Findings come pre-populated; no polling required.

Runtime scan (Langfuse)

Same pattern for Langfuse. Accepts a public/secret key pair (HTTP Basic) and an optional host for self-hosted deployments.

curl -X POST https://api.erabot.ai/api/scans/langfuse \
  -H "Authorization: Bearer {your_api_key}" \
  -F "langfuse_public_key=pk-lf-xxxxxxxx" \
  -F "langfuse_secret_key=sk-lf-xxxxxxxx" \
  -F "langfuse_host=https://cloud.langfuse.com" \
  -F "window_days=30"

SDK

Python SDK is in the repo under sdk/erabot.py. Decorator, context-manager, and manual-log patterns are all supported.

from erabot import track, log

@track(model="gpt-4")
def summarize(text: str) -> str:
    response = openai.chat.completions.create(...)
    return response.choices[0].message.content

# Or manually:
log(model="gpt-4", prompt_tokens=120, completion_tokens=80)

Trust & data handling

We redact secrets + PII before any LLM call. We do not train on your code. See /security for the full data-handling policy, encryption details, and SOC 2 roadmap.