Commands

threatoptic
├── version
├── whoami
├── auth
│   ├── login
│   ├── status
│   └── logout
└── check <query>

Every subcommand inherits the global flags --api-key and --json.

threatoptic version

Print the binary version. Needs no configuration or network.

threatoptic version

With --json:

{"version":"v0.1.0"}

threatoptic auth login

Verify an API key against GET /auth/me and store it. The key is taken from --api-key, then THREATOPTIC_API_KEY, and otherwise the prompt. A key already on disk never suppresses the prompt, because someone running auth login is replacing it.

threatoptic auth login

On success:

Logged in as dev@example.com
Credentials saved to /Users/you/.config/threatoptic/config.yaml

threatoptic auth status

Show the endpoint, the masked key and where it came from, and the account. Requires a configured key.

API URL:  https://api.threat-optic.com (config)
API key:  top_abc123... (config)
Account:  dev@example.com

threatoptic auth logout

Remove the stored API key from the config file. Does not revoke the key in the dashboard.

Logged out. Stored API key removed.

threatoptic whoami

Print the account id, email, and roles for the current key. Calls GET /auth/me.

dev@example.com  (user 0192f3a1-..., roles: member)

With --json:

{"email":"dev@example.com","id":"0192f3a1-...","roles":["member"]}

threatoptic check <query>

Look up live lookalikes for a domain, package, or MCP name. Requires exactly one argument. Calls GET /check?q=<query>.

threatoptic check stripe.com

Human output:

kind: domain
subject: stripe.com
present: true
mcp: false
generated: 3
<name>  <technique>  <first_seen_or_->

Global flags

Flag	Description
--api-key	API key. Prefer auth login over this flag.
--json	Emit machine-readable JSON as the only content on stdout.

A 401 from the API appends run 'threatoptic auth login' to re-authenticate.