Daily Workflow

# Inspect a single server by command before adding it to your config
aspex scan inspect "npx -y @some-vendor/mcp-server"

# Or inspect an HTTP server
aspex scan inspect https://api.example.com/mcp

# Check for tool name collisions with your existing servers
aspex scan shadow

# See the full risk narrative before you commit
aspex scan explain "npx -y @some-vendor/mcp-server"

# Block risky config changes going forward with the pre-commit hook
aspex scan install-hook

# Quick stats across all clients since yesterday
aspex trace stats --since 24h

# If anything looks off, pull the kill chains from that window
aspex trace killchain --since 24h

# Live tail while you work
aspex trace live

aspex trace stats --since 24h --suppress-noise

# 1. List recent sessions across all clients
aspex trace stats --since 48h

# 2. Drill into the session that looks suspicious
aspex trace session <session-id>

# 3. Reconstruct the full kill chain with MITRE references
aspex trace killchain --since 48h

# 4. Trace a finding back to what the agent ingested (file read, URL fetch)
aspex trace provenance --since 48h

# 5. Export the session for your SIEM or incident record
aspex trace export --since 48h --format jsonl --output incident-$(date +%F).jsonl

# Phantom detection - compares tool lists across successive calls
aspex scan phantom

# Check cross-server attack paths
aspex scan attack-paths

# Requires explicit consent - only run against servers you operate
aspex attack --target "npx -y @your-org/your-server" --consent

# 1. Rug-pull detection - compare current tool definitions against your baseline
aspex scan diff --baseline ~/aspex-baseline.json

# Save a fresh baseline after review
aspex scan inventory --json > ~/aspex-baseline.json

# 2. Full scan with explanations on any new findings
aspex scan --explain

# 3. Check for hardcoded credentials in MCP config env blocks
aspex doctor

# 4. Migrate any flagged tokens to macOS Keychain
aspex scan fix env

# 5. Review the commands your agent runs on its own (lifecycle hooks)
aspex scan hooks

# 6. Generate a shareable summary (privacy-safe, no tool output values)
aspex scan --share                 # Markdown, for an issue or commit message
aspex scan --html report.html      # self-contained page: attack paths + blast radius

# 7. Compliance export if your team needs it
aspex scan --report soc2

aspex scan cron --interval 6h