Zavik

See it work

Real run against a demo service: zavik detect → zavik audit (flags a git dependency as MEDIUM, non-registry + unpinned) → zavik audit --sarif for inline PR annotations.

Install

Quick install (linux x64/arm64, macOS arm64):

curl -fsSL https://raw.githubusercontent.com/Jhongamers/zavik/main/install.sh | sh

Detects your OS/arch, downloads the release tarball, verifies its sha256 (no skip flag), installs to ~/.local/bin. Prefer downloading the script, reading it, then running it — Zavik's own audit classifies curl | sh as a risk. Windows: grab the .zip from Releases.

From source (always works):

git clone https://github.com/Jhongamers/zavik && cd zavik
cargo build --release
cp target/release/zavik ~/.local/bin/   # anywhere on your PATH

Requires Rust stable. Every v* tag publishes binaries + .sha256 checksums.

One call, whole picture

cd some-project
zavik                    # detect the stack
zavik context --json     # one-call briefing: runbook + entrypoints + trust
zavik audit              # supply-chain audit
zavik up                 # audit → prepare → run, with intact gates

Works with any agent

Claude Code, Codex, OpenCode, Cursor, Antigravity, aider, Copilot — or with no agent at all. Zavik is a plain CLI: stable --json output and exit codes are the interface; there is no vendor plugin to install. (Compatibility, not affiliation.)

For AI agents, zavik context --json is the fastest way to learn an unfamiliar repo in a single call.

Pricing (honest)

The CLI is free forever — the paid add-on is fresh data, not features held back.

• Zavik CLI — free, open core (MIT): everything on this page — detect, context, audit, up, the GitHub Action, unlimited repos.
• Fresh risk dataset — paid add-on: zavik data update pulls a daily, Ed25519-signed risk dataset (GHSA-based) that adds dataset_findings to audits. Without it the CLI still audits everything else, offline.

The price is researched instead of guessed — it lands right after launch, together with checkout. No fake buy button until you can actually buy. Tell us what you'd pay.

Honest limitations

Nothing here claims more than the tool does.

• Zavik only proposes fixes — automatic fix execution is out of scope by design.
• Supply-chain checks are an anti-dishonesty gate, not an anti-attacker one.
• Human CLI messages ship in pt-BR + English (English default); the machine contract (JSON, SARIF, exit codes) is always English.
• Online enrichment (npm install hooks, download counts) needs the network; offline the score is more conservative.
• Package-manager one-liners (brew/npx/winget/choco) are on the roadmap.