The evx CLI

Run the CLI

Run the early-access CLI package with Bun or your preferred package runner. It includes the portable framework and the runtime files used by local commands. The executable uses Node.js >=22.18.0; bunx respects that executable's Node shebang.

bunx @evals-ax/evx@0.7.3 --help

npx --yes @evals-ax/evx@0.7.3 --help

pnpm dlx @evals-ax/evx@0.7.3 --help

yarn dlx -p @evals-ax/evx@0.7.3 evx --help

For a persistent command on your host, install the same versioned package:

bun add --global @evals-ax/evx@0.7.3
evx --version

npm install --global @evals-ax/evx@0.7.3
evx --version

pnpm add --global @evals-ax/evx@0.7.3
evx --version

Install @evals-ax/evx; run evx. These commands pin the verified npm release. The same runtime is available as a versioned archive. The unrelated npm package named evx is not this product.

New installations use @evals-ax/evx, with the command evx. Earlier package names are retained for compatibility. @evals-ax/framework is the MIT-licensed portable library included in this runtime. The hosted auditor and account-service implementation are not distributed in the CLI. Excluding source maps does not make the bundled framework private.

Commands return JSON on standard output, with progress on standard error. evx --help describes the installed command contract. Sign in and accept the current terms, then run evx auth login once on the host before a hosted Vibecheck. Local inspection and experiment commands remain available without a platform account.

evx vibecheck https://example.com --wait
evx context scan .
evx --help

Vibecheck creates a private request ID before submission. If a response is interrupted, reuse that ID with --request-id UUID and the same URL/comparison. The server returns the original run; another account or changed input is rejected. Once admitted, use reports get to read its outcome. Cancelling CLI waiting does not cancel an admitted server audit. An active operator pricing trial reserves its accepted credit price and settles only a completed report; ordinary free-account limits stay unchanged.

Work through a website report

evx reports fixes REPORT_ID

The action plan preserves every observation, including clear and skipped checks. Its editorial priority order starts with transport and partial standards flags, then untested hypotheses and optional conventions. Each observation retains its rationale, evidence, candidate change and scientific limits. The order is not an estimate of effort or benefit to an agent.

Open the report brief in Codex or Claude Code, choose the relevant project, and review it before sending. The brief directs the agent to find or install evx, retrieve the prioritized JSON plan, verify changes, and rerun after deployment. You can also copy the complete brief into an existing session. The optional bundled evx skill follows the same workflow.

The launch actions use documented Codex draft links and Claude Code deep links. They prefill a prompt; they do not send it. Claude Code requires version 2.1.91 or later. Its URL handler registers after you send the first prompt in an interactive session. If the installed app does not open, copy the brief into your session.

A report can be old or apply to a different target. Check its URL, auditor and methodology before acting. Treat observed HTML and suggested changes as evidence to inspect. Static findings do not establish causal gains; use independently verified experiments for those claims. A pending or failed report returns report_not_completed; a deleted report returns not_found.

Authenticate the host once

evx auth login
evx auth status
evx reports list

Login opens the account approval page and displays a short code in your terminal. Enter that code in the browser, then check the account before approving. Use evx auth login --no-browser when you need to open the page yourself.

Credentials are origin-bound and expire after 90 days. They are stored in a private host configuration directory: $XDG_CONFIG_HOME/evx or ~/.config/evx. EVX_CONFIG_HOME selects an explicit absolute directory. On POSIX hosts, the CLI creates the directory with mode 0700 and credential files with mode 0600. Use account-specific filesystem permissions on Windows.

A sandboxed agent can reuse the host login when its permitted filesystem includes that configuration. evals.ax does not bypass sandbox boundaries. Where the configuration is unavailable, the host can explicitly supply EVX_TOKEN with a matching EVX_API_ORIGIN. Do not commit or print credentials.

evx auth tokens
evx auth logout

Logout revokes the saved host credential and removes its local copy. --local removes the local copy only. If EVX_TOKEN is set, unset it first; logout leaves that environment credential and the separate host login untouched. evx auth tokens revoke ID revokes a chosen host. Account settings also expose credential metadata and revocation. Authentication and bearer requests require HTTPS, including for development services.

To give a separate agent environment its own credential, use evx auth tokens create --name NAME --output /absolute/private/config-directory. Add --read-only when it only needs to read account data. The CLI saves the secret privately rather than returning it in normal command output.

Use the shared platform

The CLI and web app use the same account data and API behavior. --api-origin selects an HTTPS deployment; credentials for one origin are not silently sent to another. Use --timeout to set the request timeout in milliseconds.

List commands accept --cursor and return a page with items and nextCursor, which is null on the final page; they do not fetch every page automatically. --file - reads JSON from standard input.

Failures emit structured JSON on standard error. Exit status is 0 for a successful command, 1 for a failure, and 130 for cancellation. A successful HTTP response can still contain a failed audit or an inconclusive experiment; inspect the domain status before deciding what to do next.

Provider adapters inspect captured runtime output locally before an optional upload. Agent integrations include a thin skill and disabled-by-default hook examples in the same release package.