> ## Documentation Index
> Fetch the complete documentation index at: https://aspex.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Daily Workflow

> Practical security habits for AI agent users

## Before installing a new MCP server

Run a targeted scan before adding anything to your config.

```bash theme={"dark"}
# Inspect a single server by command before adding it to your config
aspex scan inspect "npx -y @some-vendor/mcp-server"

# Or inspect an HTTP server
aspex scan inspect https://api.example.com/mcp

# Check for tool name collisions with your existing servers
aspex scan shadow

# See the full risk narrative before you commit
aspex scan explain "npx -y @some-vendor/mcp-server"
```

If the score is below 70 or the `--explain` output surfaces credential access or shell execution findings, pause and review before proceeding.

```bash theme={"dark"}
# Block risky config changes going forward with the pre-commit hook
aspex scan install-hook
```

***

## Morning check

Review what your agents did overnight in under 30 seconds.

```bash theme={"dark"}
# Quick stats across all clients since yesterday
aspex trace stats --since 24h

# If anything looks off, pull the kill chains from that window
aspex trace killchain --since 24h

# Live tail while you work
aspex trace live
```

For coding agent sessions with high tool-call volume, suppress routine noise:

```bash theme={"dark"}
aspex trace stats --since 24h --suppress-noise
```

***

## Something looks wrong - investigate

Use this flow when a kill chain hit surfaces or an agent behaved unexpectedly.

```bash theme={"dark"}
# 1. List recent sessions across all clients
aspex trace stats --since 48h

# 2. Drill into the session that looks suspicious
aspex trace session <session-id>

# 3. Reconstruct the full kill chain with MITRE references
aspex trace killchain --since 48h

# 4. Trace a finding back to what the agent ingested (file read, URL fetch)
aspex trace provenance --since 48h

# 5. Export the session for your SIEM or incident record
aspex trace export --since 48h --format jsonl --output incident-$(date +%F).jsonl
```

If you suspect a server is actively serving different tools than it advertised:

```bash theme={"dark"}
# Phantom detection - compares tool lists across successive calls
aspex scan phantom

# Check cross-server attack paths
aspex scan attack-paths
```

To actively probe a server you own and control:

```bash theme={"dark"}
# Requires explicit consent - only run against servers you operate
aspex attack --target "npx -y @your-org/your-server" --consent
```

***

## Weekly hygiene

Run these once a week to catch drift and credential sprawl.

```bash theme={"dark"}
# 1. Rug-pull detection - compare current tool definitions against your baseline
aspex scan diff --baseline ~/aspex-baseline.json

# Save a fresh baseline after review
aspex scan inventory --json > ~/aspex-baseline.json

# 2. Full scan with explanations on any new findings
aspex scan --explain

# 3. Check for hardcoded credentials in MCP config env blocks
aspex doctor

# 4. Migrate any flagged tokens to macOS Keychain
aspex scan fix env

# 5. Review the commands your agent runs on its own (lifecycle hooks)
aspex scan hooks

# 6. Generate a shareable summary (privacy-safe, no tool output values)
aspex scan --share                 # Markdown, for an issue or commit message
aspex scan --html report.html      # self-contained page: attack paths + blast radius

# 7. Compliance export if your team needs it
aspex scan --report soc2
```

Hooks are commands the agent runs automatically on tool-use, stop, or prompt-submit. They are standing executable state most people forget, and the target a persistence path would write, so they are worth a periodic look even when nothing is wrong.

Schedule the full scan as a cron job so you get a weekly baseline automatically:

```bash theme={"dark"}
aspex scan cron --interval 6h
```