Navigation
VigilbaseDocs

    Type at least two letters.

    Open Vigilbase One

    Install and sign in

    Install the Vigilbase CLI with npm, run public tools without an account, and sign in to Vigilbase One for the other commands.

    View as Markdown
    On this page
    1. Install
    2. What needs a sign-in
    3. Sign in
    4. Where credentials are stored
    5. Configuration

    The Vigilbase CLI, @vigilbase/cli, runs the public security tools, the Cloudflare Checkup and Vigilbase One commands from a terminal.

    Install

    Node.js 20 or newer is required. The Cloudflare Checkup needs Node.js 22.18 or newer, because it runs Cloudflare's cf CLI under the same Node.

    npm install -g @vigilbase/cli
vigilbase help

    Check which version answers with vigilbase --version.

    What needs a sign-in

    Works without signing inNeeds vigilbase login
    list, headers, email, run security-headers, run email-security, describe, skill, badge, doctor, cloudflare-checkuprun website-security, run react2shell, run fortibleed-check, any run … --via one, and the Vigilbase One commands such as account, runs, cf and security

    Public scans never read your saved sign-in, so a broken or expired sign-in cannot make them fail.

    Sign in

    Terminal
    vigilbase login

    The CLI opens your browser and waits while you approve a device code at https://auth.vigilbase.com/device and choose the organization the sign-in is for. On a remote terminal, run vigilbase login --no-open and open the printed URL in a browser where you are signed in.

    Check the sign-in with vigilbase whoami, and sign out with vigilbase logout, which revokes the sign-in before deleting it.

    To save an existing One session token instead, pipe it from your secret manager:

    Bash
    my-secret-tool read vigilbase-token | vigilbase login --token-stdin

    --token <bearer> and VIGILBASE_ONE_TOKEN also work, but arguments can show up in process lists and shell history.

    Where credentials are stored

    Credentials are saved in the config directory: VIGILBASE_CONFIG_DIR if set, otherwise $XDG_CONFIG_HOME/vigilbase, otherwise ~/.config/vigilbase. Files are written with mode 0600 in a directory with mode 0700, and the CLI refuses a path that contains a symbolic link or that other users can write to. See Troubleshooting if you get one of these errors.

    Configuration

    OptionEnvironment variableDefault
    --base-url <origin>VIGILBASE_BASE_URLhttps://vigilbase.com
    --one-url <origin>VIGILBASE_ONE_URLhttps://one.vigilbase.com
    --auth-url <origin>VIGILBASE_AUTH_URLhttps://auth.vigilbase.com
    --timeout <ms>—60000 per request
    Environment variableEffect
    VIGILBASE_CLI_NO_OPEN=1Never open a browser
    VIGILBASE_CLI_NO_BANNER=1Hide the banner
    VIGILBASE_CLI_NO_PROGRESS=1Turn off progress animations

    Next, see Commands.