> ## Documentation Index
> Fetch the complete documentation index at: https://aspex.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# aspex (front door)

> Run aspex with no arguments: see what your agents did this month, then pick a tool.

`aspex` with no arguments answers the question before you ask it. It reads your MCP configs and your AI clients' own logs, joins them, and shows one screen. On the machine this was written on:

```sh theme={"dark"}
aspex            # or, without installing anything: npx aspex
```

```
  ◆  Your AI agents, last 30 days  aspex v0.9.0

  ▸ In the last 30 days your agents made 320 tool calls to 12 MCP servers.
  ▸ 316 of those calls went to 11 servers no security scan had ever checked.
  ▸ 2 calls tripped a detection rule. Most common: cross-server data chain (2).
  ▸ 7 configured servers, overall security score 54/100. Riskiest: github (39), not used in this period.

    github                39  CRITICAL  not used
    brave-search          39  CRITICAL  not used
    playwright            90  MEDIUM    not used
    slack                 95  clean     4 calls
    +3 more

  ? In use, never scanned:
    Claude_Browser                         196 calls
    claude-in-chrome                        72 calls
    +9 more

  aspex scan for findings and fixes  ·  aspex trace for the full audit trail  ·  aspex share to post this
```

It took 1.9 seconds. Then the tool menu opens underneath. Arrow keys to move, `Enter` to run, `→` for each tool's options, `q` to quit.

Everything on that screen comes from files already on your machine. Nothing is sent anywhere.

## Every command, by what it is for

You will spend most of your time in five commands. The rest support them.

**Start here (the five questions)**

|                                         |                                                                            |
| --------------------------------------- | -------------------------------------------------------------------------- |
| [`aspex scan`](/tools/scan)             | what CAN happen: servers, tools, hooks, skills, attack paths, blast radius |
| [`aspex trace`](/tools/trace)           | what DID happen, from your clients' own logs                               |
| [`aspex diff`](/tools/change-detection) | what CHANGED between two states or git revisions                           |
| [`aspex explain`](/tools/explain)       | why a path exists, what breaks it, where data could flow                   |
| [`aspex simulate`](/tools/simulate)     | what a change would do, without touching your config                       |

**Harden**

|                                            |                                                 |
| ------------------------------------------ | ----------------------------------------------- |
| [`aspex tighten`](/tools/tighten)          | least-privilege recommendations, each simulated |
| [`aspex inspect`](/tools/scan-subcommands) | a server's impact before you install it         |

**Change control**

|                                                                                     |                                            |
| ----------------------------------------------------------------------------------- | ------------------------------------------ |
| [`aspex lock`](/tools/change-detection) · [`aspex verify`](/tools/change-detection) | fingerprint the environment; fail on drift |
| [`aspex history`](/tools/change-detection) · `aspex watch`                          | posture over time; re-scan on change       |

**Investigate and integrate**

|                                                                   |                                               |
| ----------------------------------------------------------------- | --------------------------------------------- |
| [`aspex explore`](/tools/explore)                                 | the local session explorer                    |
| [`aspex mcp`](/tools/mcp)                                         | expose Aspex to your coding agent (read-only) |
| [`aspex bom`](/tools/bom)                                         | a portable inventory of the environment       |
| [`aspex doctor`](/tools/doctor) · [`aspex attack`](/tools/attack) | pre-flight check; adversarial probing         |

New here? Follow [Common workflows](/guides/common-workflows).

## Share it

```sh theme={"dark"}
aspex share
```

Prints a Markdown card with the same headlines but **no server names, paths, or commands** - counts and score only. Paste it in Slack, a PR, or a post. If the numbers surprised you, they will surprise your team.

## Just the snapshot

```sh theme={"dark"}
aspex snapshot      # no menu; good for a shell prompt, a cron job, or CI logs
```

## Direct commands

| Command              | Runs                                                     |
| -------------------- | -------------------------------------------------------- |
| `aspex scan [...]`   | `aspex scan` - audit every configured server, 140+ rules |
| `aspex trace [...]`  | `aspex trace` - full audit trail from client logs        |
| `aspex doctor`       | `aspex scan doctor` - 2-second pre-flight                |
| `aspex attack [...]` | `aspex-attack` - red-team a server you own (advanced)    |

## What "never scanned" means

Connectors added through claude.ai are configured in the cloud and have no local file, so no static scanner can score them. Aspex is honest about that: they appear as **in use, never scanned**, with their call counts, so you know exactly how much of your agents' activity runs through servers nobody has looked at. `aspex scan inspect <url>` can scan one directly.

## Every command through `aspex`

`aspex` is the front door; you never need to know which binary owns a command.

|                                               |                                                         |
| --------------------------------------------- | ------------------------------------------------------- |
| `aspex scan`                                  | every server, hook, skill, attack path, blast radius    |
| `aspex trace`                                 | what your agents actually did, from their clients' logs |
| `aspex explain "…"`                           | deterministic yes/no security questions                 |
| `aspex lock` / `aspex verify`                 | the security lockfile and drift against it              |
| `aspex diff main..HEAD`                       | security impact of a config change                      |
| `aspex tighten`                               | least-privilege recommendations                         |
| `aspex bom`                                   | Agent Security BOM                                      |
| `aspex explore`                               | local session explorer                                  |
| `aspex mcp`                                   | read-only MCP server for your agent                     |
| `aspex history`                               | posture over time                                       |
| `aspex hooks`, `aspex doctor`, `aspex attack` | hooks, pre-flight, red team                             |