[{"data":1,"prerenderedAt":888},["ShallowReactive",2],{"docs-nav":3,"docs-\u002Fdocs\u002Fquickstart":78},[4,9,13,16,21,26,30,34,38,42,46,50,53,58,62,66,69,74],{"path":5,"title":6,"navTitle":6,"group":7,"order":8},"\u002Fdocs\u002Fcommands","Other commands","Guide",999,{"path":10,"title":11,"navTitle":12,"group":7,"order":8},"\u002Fdocs\u002Fcompaction","Context and compaction","Context & compaction",{"path":14,"title":15,"navTitle":15,"group":7,"order":8},"\u002Fdocs\u002Fconfiguration","Configuration",{"path":17,"title":18,"navTitle":18,"group":19,"order":20},"\u002Fdocs\u002Fenvironment","Environment variables","Reference",11,{"path":22,"title":23,"navTitle":23,"group":24,"order":25},"\u002Fdocs\u002Fflags","Flag reference","CLI",8,{"path":27,"title":28,"navTitle":28,"group":7,"order":29},"\u002Fdocs","Introduction",1,{"path":31,"title":32,"navTitle":32,"group":7,"order":33},"\u002Fdocs\u002Finstallation","Installation",2,{"path":35,"title":36,"navTitle":36,"group":19,"order":37},"\u002Fdocs\u002Fproviders","Providers",10,{"path":39,"title":40,"navTitle":40,"group":7,"order":41},"\u002Fdocs\u002Fquickstart","Quickstart",3,{"path":43,"title":44,"navTitle":45,"group":7,"order":8},"\u002Fdocs\u002Freleases","Releases and upgrading","Releases",{"path":47,"title":48,"navTitle":49,"group":7,"order":8},"\u002Fdocs\u002Frun","The run command","Running an audit",{"path":51,"title":52,"navTitle":52,"group":7,"order":8},"\u002Fdocs\u002Fsecurity","Security model",{"path":54,"title":55,"navTitle":56,"group":24,"order":57},"\u002Fdocs\u002Fsessions","Sessions and forking","Sessions",6,{"path":59,"title":60,"navTitle":61,"group":7,"order":8},"\u002Fdocs\u002Fskills-roles","Skills and roles","Skills & roles",{"path":63,"title":64,"navTitle":64,"group":19,"order":65},"\u002Fdocs\u002Ftools","Tool reference",12,{"path":67,"title":68,"navTitle":68,"group":7,"order":8},"\u002Fdocs\u002Ftroubleshooting","Troubleshooting",{"path":70,"title":71,"navTitle":72,"group":24,"order":73},"\u002Fdocs\u002Ftui","The interactive TUI","Interactive TUI",9,{"path":75,"title":76,"navTitle":77,"group":7,"order":8},"\u002Fdocs\u002Fweb-eval","Dashboard and evaluation","Dashboard & evaluation",{"id":79,"title":40,"body":80,"description":881,"extension":882,"group":7,"meta":883,"navTitle":40,"navigation":884,"order":41,"path":39,"seo":885,"stem":886,"__hash__":887},"docs\u002Fdocs\u002Fquickstart.md",{"type":81,"value":82,"toc":871},"minimark",[83,87,104,109,132,143,241,248,262,277,281,284,309,331,334,402,413,416,430,445,449,452,502,508,515,519,557,560,592,602,605,635,642,646,652,676,690,737,741,755,758,802,805,817,824,828,844,848,867],[84,85,40],"h1",{"id":86},"quickstart",[88,89,90,91,95,96,99,100,103],"p",{},"This walks from a fresh install to a first finding. It assumes ",[92,93,94],"code",{},"locac"," is on your ",[92,97,98],{},"PATH","; see\n",[101,102,32],"a",{"href":31}," if it is not.",[105,106,108],"h2",{"id":107},"_1-create-the-config-file","1. Create the config file",[110,111,116],"pre",{"className":112,"code":113,"language":114,"meta":115,"style":115},"language-bash shiki shiki-themes vitesse-dark","locac config init\n","bash","",[92,117,118],{"__ignoreMap":115},[119,120,122,125,129],"span",{"class":121,"line":29},"line",[119,123,94],{"class":124},"sCK9x",[119,126,128],{"class":127},"s7rlk"," config",[119,130,131],{"class":127}," init\n",[88,133,134,135,138,139,142],{},"This writes a template to ",[92,136,137],{},"~\u002F.locac\u002Fconfig.json"," (or ",[92,140,141],{},"$LOCAC_HOME\u002Fconfig.json",") with tightened file\npermissions, because the next thing you do is paste an API key into it:",[110,144,148],{"className":145,"code":146,"language":147,"meta":115,"style":115},"language-json shiki shiki-themes vitesse-dark","{\n  \"provider\": \"anthropic\",\n  \"model\": \"claude-opus-4-8\",\n  \"budget\": { \"maxTokens\": 500000 }\n}\n","json",[92,149,150,156,184,204,235],{"__ignoreMap":115},[119,151,152],{"class":121,"line":29},[119,153,155],{"class":154},"s_pn2","{\n",[119,157,158,162,166,169,172,176,179,181],{"class":121,"line":33},[119,159,161],{"class":160},"s6USN","  \"",[119,163,165],{"class":164},"sm68I","provider",[119,167,168],{"class":160},"\"",[119,170,171],{"class":154},":",[119,173,175],{"class":174},"sNJcY"," \"",[119,177,178],{"class":127},"anthropic",[119,180,168],{"class":174},[119,182,183],{"class":154},",\n",[119,185,186,188,191,193,195,197,200,202],{"class":121,"line":41},[119,187,161],{"class":160},[119,189,190],{"class":164},"model",[119,192,168],{"class":160},[119,194,171],{"class":154},[119,196,175],{"class":174},[119,198,199],{"class":127},"claude-opus-4-8",[119,201,168],{"class":174},[119,203,183],{"class":154},[119,205,207,209,212,214,216,219,221,224,226,228,232],{"class":121,"line":206},4,[119,208,161],{"class":160},[119,210,211],{"class":164},"budget",[119,213,168],{"class":160},[119,215,171],{"class":154},[119,217,218],{"class":154}," {",[119,220,175],{"class":160},[119,222,223],{"class":164},"maxTokens",[119,225,168],{"class":160},[119,227,171],{"class":154},[119,229,231],{"class":230},"sxA9i"," 500000",[119,233,234],{"class":154}," }\n",[119,236,238],{"class":121,"line":237},5,[119,239,240],{"class":154},"}\n",[88,242,243,244,247],{},"If the file already exists, ",[92,245,246],{},"config init"," leaves it alone and tells you so. To find it later:",[110,249,251],{"className":112,"code":250,"language":114,"meta":115,"style":115},"locac config path\n",[92,252,253],{"__ignoreMap":115},[119,254,255,257,259],{"class":121,"line":29},[119,256,94],{"class":124},[119,258,128],{"class":127},[119,260,261],{"class":127}," path\n",[263,264,265],"blockquote",{},[88,266,267,268,271,272,276],{},"The config file always lives under ",[92,269,270],{},"LOCAC_HOME",", ",[273,274,275],"strong",{},"never"," inside the repository you are auditing.\nThat repository is untrusted input; a config read from it would let the target choose your provider,\nyour base URL, and your API key.",[105,278,280],{"id":279},"_2-point-it-at-a-provider","2. Point it at a provider",[88,282,283],{},"The simplest path is to leave the key out of the config file entirely and let locac read it from the\nprovider's environment variable:",[110,285,287],{"className":112,"code":286,"language":114,"meta":115,"style":115},"export ANTHROPIC_API_KEY=sk-ant-...\n",[92,288,289],{"__ignoreMap":115},[119,290,291,295,299,302,305],{"class":121,"line":29},[119,292,294],{"class":293},"s_wWq","export",[119,296,298],{"class":297},"st-jp"," ANTHROPIC_API_KEY",[119,300,301],{"class":154},"=",[119,303,304],{"class":297},"sk-ant-",[119,306,308],{"class":307},"sNpkn","...\n",[88,310,311,312,271,315,271,318,183,321,271,324,327,328,330],{},"Every built-in provider has one: ",[92,313,314],{},"OPENAI_API_KEY",[92,316,317],{},"GROQ_API_KEY",[92,319,320],{},"OPENROUTER_API_KEY",[92,322,323],{},"DEEPSEEK_API_KEY",[92,325,326],{},"ZAI_API_KEY",", and so on. The ",[101,329,36],{"href":35}," page has the full\nlist.",[88,332,333],{},"If you prefer the config file, you can reference the variable rather than inlining the secret:",[110,335,337],{"className":145,"code":336,"language":147,"meta":115,"style":115},"{\n  \"provider\": \"anthropic\",\n  \"model\": \"claude-opus-4-8\",\n  \"apiKey\": \"$ANTHROPIC_API_KEY\"\n}\n",[92,338,339,343,361,379,398],{"__ignoreMap":115},[119,340,341],{"class":121,"line":29},[119,342,155],{"class":154},[119,344,345,347,349,351,353,355,357,359],{"class":121,"line":33},[119,346,161],{"class":160},[119,348,165],{"class":164},[119,350,168],{"class":160},[119,352,171],{"class":154},[119,354,175],{"class":174},[119,356,178],{"class":127},[119,358,168],{"class":174},[119,360,183],{"class":154},[119,362,363,365,367,369,371,373,375,377],{"class":121,"line":41},[119,364,161],{"class":160},[119,366,190],{"class":164},[119,368,168],{"class":160},[119,370,171],{"class":154},[119,372,175],{"class":174},[119,374,199],{"class":127},[119,376,168],{"class":174},[119,378,183],{"class":154},[119,380,381,383,386,388,390,392,395],{"class":121,"line":206},[119,382,161],{"class":160},[119,384,385],{"class":164},"apiKey",[119,387,168],{"class":160},[119,389,171],{"class":154},[119,391,175],{"class":174},[119,393,394],{"class":127},"$ANTHROPIC_API_KEY",[119,396,397],{"class":174},"\"\n",[119,399,400],{"class":121,"line":237},[119,401,240],{"class":154},[88,403,404,405,408,409,412],{},"Both ",[92,406,407],{},"\"$VAR\""," and ",[92,410,411],{},"\"${VAR}\""," are expanded at run time. An unset variable fails loudly rather than\nsending an empty key.",[88,414,415],{},"Check what locac resolved:",[110,417,419],{"className":112,"code":418,"language":114,"meta":115,"style":115},"locac config show\n",[92,420,421],{"__ignoreMap":115},[119,422,423,425,427],{"class":121,"line":29},[119,424,94],{"class":124},[119,426,128],{"class":127},[119,428,429],{"class":127}," show\n",[263,431,432],{},[88,433,434,437,438,441,442,444],{},[92,435,436],{},"config show"," prints the ",[273,439,440],{},"effective"," settings, and that includes any literal ",[92,443,385],{}," you put in\nthe file. Do not paste its output into a bug report.",[105,446,448],{"id":447},"_3-a-read-only-recon-pass","3. A read-only recon pass",[88,450,451],{},"Before letting an agent run commands in an unfamiliar repository, do a pass with an explicit tool\nallow-list. Nothing here can write, execute, or reach the network:",[110,453,455],{"className":112,"code":454,"language":114,"meta":115,"style":115},"cd \u002Fpath\u002Fto\u002Ftarget\nlocac run \"map the attack surface: entry points, routes, parsers, auth boundaries\" \\\n  --tools \"read,search,find,ls,outline,code_search,glob\" \\\n  --print\n",[92,456,457,465,483,497],{"__ignoreMap":115},[119,458,459,462],{"class":121,"line":29},[119,460,461],{"class":164},"cd",[119,463,464],{"class":127}," \u002Fpath\u002Fto\u002Ftarget\n",[119,466,467,469,472,474,477,479],{"class":121,"line":33},[119,468,94],{"class":124},[119,470,471],{"class":127}," run",[119,473,175],{"class":174},[119,475,476],{"class":127},"map the attack surface: entry points, routes, parsers, auth boundaries",[119,478,168],{"class":174},[119,480,482],{"class":481},"sXjYR"," \\\n",[119,484,485,488,490,493,495],{"class":121,"line":41},[119,486,487],{"class":481},"  --tools",[119,489,175],{"class":174},[119,491,492],{"class":127},"read,search,find,ls,outline,code_search,glob",[119,494,168],{"class":174},[119,496,482],{"class":481},[119,498,499],{"class":121,"line":206},[119,500,501],{"class":481},"  --print\n",[88,503,504,507],{},[92,505,506],{},"--print"," gives plain streaming output instead of the TUI, which is what you want when you are\npiping or reading a log. Drop it for the interactive interface.",[88,509,510,511,514],{},"The allow-list applies to subagents too. ",[92,512,513],{},"submit_report"," is never removable, because a subagent has to be\nable to answer its parent.",[105,516,518],{"id":517},"_4-a-full-audit","4. A full audit",[110,520,522],{"className":112,"code":521,"language":114,"meta":115,"style":115},"cd \u002Fpath\u002Fto\u002Ftarget\nlocac run \"audit the HTTP request handling path for injection and deserialization bugs\" \\\n  --require-sandbox \\\n  --auto\n",[92,523,524,530,545,552],{"__ignoreMap":115},[119,525,526,528],{"class":121,"line":29},[119,527,461],{"class":164},[119,529,464],{"class":127},[119,531,532,534,536,538,541,543],{"class":121,"line":33},[119,533,94],{"class":124},[119,535,471],{"class":127},[119,537,175],{"class":174},[119,539,540],{"class":127},"audit the HTTP request handling path for injection and deserialization bugs",[119,542,168],{"class":174},[119,544,482],{"class":481},[119,546,547,550],{"class":121,"line":41},[119,548,549],{"class":481},"  --require-sandbox",[119,551,482],{"class":481},[119,553,554],{"class":121,"line":206},[119,555,556],{"class":481},"  --auto\n",[88,558,559],{},"Two flags are doing the real work here:",[561,562,563,576],"ul",{},[564,565,566,571,572,575],"li",{},[273,567,568],{},[92,569,570],{},"--require-sandbox"," refuses to start unless the OS sandbox is actually available. Without it, a\nhost missing its sandbox dependencies runs ",[273,573,574],{},"unconfined"," and only says so in the header.",[564,577,578,583,584,587,588,591],{},[273,579,580],{},[92,581,582],{},"--auto"," is guardian mode: read-only shell commands are auto-approved, everything else\nfail-closed. The alternatives are no flag at all (an interactive prompt in the TUI, blocked\neverywhere else) and ",[92,585,586],{},"--yes"," (aliased as ",[92,589,590],{},"--allow-all","), which approves dangerous tools\noutright.",[88,593,594,595,598,599,601],{},"On a real terminal this opens the fullscreen TUI. Use ",[92,596,597],{},"--inline"," for the scrollback renderer, or\n",[92,600,506],{}," for no TUI at all.",[88,603,604],{},"Bound the run while you are still calibrating:",[110,606,608],{"className":112,"code":607,"language":114,"meta":115,"style":115},"locac run \"...\" --max-tool-calls 200 --max-wall-clock-ms 900000\n",[92,609,610],{"__ignoreMap":115},[119,611,612,614,616,618,621,623,626,629,632],{"class":121,"line":29},[119,613,94],{"class":124},[119,615,471],{"class":127},[119,617,175],{"class":174},[119,619,620],{"class":127},"...",[119,622,168],{"class":174},[119,624,625],{"class":481}," --max-tool-calls",[119,627,628],{"class":230}," 200",[119,630,631],{"class":481}," --max-wall-clock-ms",[119,633,634],{"class":230}," 900000\n",[88,636,637,638,641],{},"Exit code ",[92,639,640],{},"2"," means a budget cap stopped the run. Resume it with a bigger budget rather than\nstarting over.",[105,643,645],{"id":644},"_5-let-it-drive-itself","5. Let it drive itself",[88,647,648,651],{},[92,649,650],{},"--goal"," turns the run into an autopilot that keeps working toward an objective until it is done or a\ncap fires:",[110,653,655],{"className":112,"code":654,"language":114,"meta":115,"style":115},"locac run --goal \"find and prove one High-or-better RCE in the upload handler\" --auto\n",[92,656,657],{"__ignoreMap":115},[119,658,659,661,663,666,668,671,673],{"class":121,"line":29},[119,660,94],{"class":124},[119,662,471],{"class":127},[119,664,665],{"class":481}," --goal",[119,667,175],{"class":174},[119,669,670],{"class":127},"find and prove one High-or-better RCE in the upload handler",[119,672,168],{"class":174},[119,674,675],{"class":481}," --auto\n",[88,677,678,679,682,683,686,687,689],{},"Or explore first and commit later. ",[92,680,681],{},"--plan"," runs a read-only exploration phase that ends with a\nproposed plan; resuming the session ",[273,684,685],{},"without"," ",[92,688,681],{}," executes it:",[110,691,693],{"className":112,"code":692,"language":114,"meta":115,"style":115},"locac run \"audit the auth module\" --plan\nlocac resume \u003Csession-id> \"go ahead\"\n",[92,694,695,711],{"__ignoreMap":115},[119,696,697,699,701,703,706,708],{"class":121,"line":29},[119,698,94],{"class":124},[119,700,471],{"class":127},[119,702,175],{"class":174},[119,704,705],{"class":127},"audit the auth module",[119,707,168],{"class":174},[119,709,710],{"class":481}," --plan\n",[119,712,713,715,718,721,724,727,730,732,735],{"class":121,"line":33},[119,714,94],{"class":124},[119,716,717],{"class":127}," resume",[119,719,720],{"class":293}," \u003C",[119,722,723],{"class":127},"session-i",[119,725,726],{"class":307},"d",[119,728,729],{"class":293},">",[119,731,175],{"class":174},[119,733,734],{"class":127},"go ahead",[119,736,397],{"class":174},[105,738,740],{"id":739},"_6-read-the-findings","6. Read the findings",[88,742,743,744,747,748,271,751,754],{},"The agent calls ",[92,745,746],{},"report_findings"," before it finishes, so the report is in the transcript. Everything\nis also persisted to a per-project SQLite database at\n",[92,749,750],{},"~\u002F.locac\u002Fprojects\u002F\u003Cname>-\u003Chash>\u002Fsessions.db",[273,752,753],{},"outside"," the target repository.",[88,756,757],{},"List what you have:",[110,759,761],{"className":112,"code":760,"language":114,"meta":115,"style":115},"locac sessions\nlocac -c                       # continue the most-recent session\nlocac resume \u003Csession-id> \"now check the sibling handlers\"\n",[92,762,763,770,781],{"__ignoreMap":115},[119,764,765,767],{"class":121,"line":29},[119,766,94],{"class":124},[119,768,769],{"class":127}," sessions\n",[119,771,772,774,777],{"class":121,"line":33},[119,773,94],{"class":124},[119,775,776],{"class":481}," -c",[119,778,780],{"class":779},"sux-A","                       # continue the most-recent session\n",[119,782,783,785,787,789,791,793,795,797,800],{"class":121,"line":41},[119,784,94],{"class":124},[119,786,717],{"class":127},[119,788,720],{"class":293},[119,790,723],{"class":127},[119,792,726],{"class":307},[119,794,729],{"class":293},[119,796,175],{"class":174},[119,798,799],{"class":127},"now check the sibling handlers",[119,801,397],{"class":174},[88,803,804],{},"Or open the dashboard, which renders sessions, transcripts, and the findings table with severity,\nCWE, CVSS and the cited evidence:",[110,806,808],{"className":112,"code":807,"language":114,"meta":115,"style":115},"locac web\n",[92,809,810],{"__ignoreMap":115},[119,811,812,814],{"class":121,"line":29},[119,813,94],{"class":124},[119,815,816],{"class":127}," web\n",[88,818,819,820,823],{},"It binds ",[92,821,822],{},"127.0.0.1:4173"," by default. Binding a non-loopback address is refused unless you have\nconfigured a dashboard password and JWT secret. The dashboard can launch bash, so it is never\nexposed unauthenticated.",[105,825,827],{"id":826},"what-to-expect","What to expect",[88,829,830,831,834,835,839,840,843],{},"A good run produces ",[273,832,833],{},"few findings",". Each High or Critical finding had to cite an execution artifact\nwhose checked assertion passed for ",[836,837,838],"em",{},"that"," location ",[836,841,842],{},"and"," survive a 2-of-3 cross-verification quorum,\nso the pipeline discards a lot of plausible-looking candidates on purpose. If you get zero findings and a clear account of what was ruled out and why,\nthat is a successful run.",[105,845,847],{"id":846},"next","Next",[88,849,850,852,853,856,857,859,860,863,864,866],{},[101,851,15],{"href":14}," covers every field of ",[92,854,855],{},"config.json",": per-project overrides,\ncustom endpoints, budgets, and the precedence rules that decide which layer wins. Then\n",[101,858,49],{"href":47}," documents ",[92,861,862],{},"locac run"," end to end, and\n",[101,865,55],{"href":54}," covers everything a finished run leaves behind.",[868,869,870],"style",{},"html pre.shiki code .sCK9x, html code.shiki .sCK9x{--shiki-default:#80A665}html pre.shiki code .s7rlk, html code.shiki .s7rlk{--shiki-default:#C98A7D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .s_pn2, html code.shiki .s_pn2{--shiki-default:#666666}html pre.shiki code .s6USN, html code.shiki .s6USN{--shiki-default:#B8A96577}html pre.shiki code .sm68I, html code.shiki .sm68I{--shiki-default:#B8A965}html pre.shiki code .sNJcY, html code.shiki .sNJcY{--shiki-default:#C98A7D77}html pre.shiki code .sxA9i, html code.shiki .sxA9i{--shiki-default:#4C9A91}html pre.shiki code .s_wWq, html code.shiki .s_wWq{--shiki-default:#CB7676}html pre.shiki code .st-jp, html code.shiki .st-jp{--shiki-default:#BD976A}html pre.shiki code .sNpkn, html code.shiki .sNpkn{--shiki-default:#DBD7CAEE}html pre.shiki code .sXjYR, html code.shiki .sXjYR{--shiki-default:#C99076}html pre.shiki code .sux-A, html code.shiki .sux-A{--shiki-default:#758575DD}",{"title":115,"searchDepth":41,"depth":41,"links":872},[873,874,875,876,877,878,879,880],{"id":107,"depth":33,"text":108},{"id":279,"depth":33,"text":280},{"id":447,"depth":33,"text":448},{"id":517,"depth":33,"text":518},{"id":644,"depth":33,"text":645},{"id":739,"depth":33,"text":740},{"id":826,"depth":33,"text":827},{"id":846,"depth":33,"text":847},"Configure a provider, run a first read-only recon pass, then a full audit, and read the findings that come out of it.","md",{},true,{"title":40,"description":881},"docs\u002Fquickstart","Ds7KXrbI86I8kqXjHNfpuEwoBBu6BrXqat13-H5EAYg",1786794387119]