Start here

Quickstart

From nothing to a first proven finding.

The fastest path is a local stack and one engagement against a target you own. Everything below runs on a single machine.

#1. Bring the stack up

bashcd infra
cp .env.example .env
docker compose up -d

This is the local form

The base file ships development credentials so a local stack needs no setup. It is not safe on a reachable host — for anything exposed, add the production overlay and set the four required variables. See /docs/self-hosting.

migrate applies the schema and exits before the API and worker start, so the first boot is ordered for you. Caddy publishes on 127.0.0.1:8080 by default.

#2. Confirm it is ready

bashcurl -s localhost:8080/api/health

The public endpoint reports status and readiness only. The detailed probes are internal and the edge answers 404 for them on purpose.

#3. Run an engagement

bashrokkhe --target ./your-service --non-interactive --max-budget-usd 5

Point it at a repository, a URL, a directory, or a host you are authorized to test. The scope is exactly what you name — nothing outside it is reached. Set a budget: cost scales with how much surface the engagement finds.

Large repositories

A local directory is copied into the sandbox file by file, which stalls on very large trees. Use --mount to attach it read-only instead.

#4. Scope it to a change

bashrokkhe \
  --target . \
  --diff-base origin/main \
  --non-interactive \
  --max-budget-usd 5

This is the pipeline form. Scoping to the diff keeps a per-pull-request run proportional to the change rather than re-testing everything each time.

#5. Read what came back

You get	Where
A ranked queue of what is exploitable	The console, or rokkhe findings list --output json
A proof-of-concept per finding	Attached to the finding, with its request trace
A remediation diff	Opened against the branch you nominate
The run record	Findings, proofs, and decisions, retained together

Nothing in the queue is a pattern match awaiting triage. If it is listed, it reproduced.

#Next

/docs/cli — every flag, and the CI form.
/docs/collectors — send your existing telemetry in.
/docs/self-hosting — the production deployment.
/docs/security — what is isolated from what.