AevrinGetting Started
Install the CLI, log in, and run your first scan.
Install
Aevrin is distributed on PyPI and npm. Both installation paths run the same CLI and require Python 3.10 or newer. The npm package requires Node.js 18 or newer and creates a private Python environment inside its own package directory, so it does not modify global Python packages.
python3 -m pip install --user pipx
pipx ensurepath
pipx install aevrinRestart your shell if aevrin isn't found immediately. pipx ensurepath needs a fresh
shell to take effect.
python3 -m pip install --upgrade aevrinIf you see an externally-managed-environment error (common on recent Debian/Ubuntu and
Homebrew Python), that's your system telling you to use pipx or a virtualenv instead of
installing into the system interpreter directly.
npm install --global aevrinnpm installs the matching Python release into an isolated environment owned by the npm
package. Set AEVRIN_PYTHON if it should use a specific Python 3.10+ executable.
Confirm it installed correctly:
aevrin --versionLog in
aevrin loginThis opens your browser for a device-code
approval flow, so no password is ever typed into the terminal. Once approved, a long-lived API key
is stored at ~/.aevrin/credentials.
Free plan
Every account starts on Free with 1,500 credits a month, refilled on a rolling window from your signup date. A scan costs 50 credits, a capability run 10, a posture upload 5 and a capability read 1, so the pool is yours to spend however your month goes. Pro raises the pool to 50,000 credits and adds AI code review (50 credits a review), up to 10 monitored devices and report export, and a one-time top-up adds 5,000 credits that never expire. Searching capabilities is free on both plans and is never counted. See Concepts → Credits and Aevrin MCP limits.
Run your first scan
aevrin scan https://github.com/owner/mcp-serverTARGET can be a GitHub URL, a local directory path, or a live MCP server URL. See
CLI Reference → scan for the full breakdown of what each target type actually
checks. The scan runs entirely on your machine with each tool in its own version-pinned Docker
container and, once logged in, the result is
uploaded to your dashboard automatically.
You'll see a stage-by-stage progress trace, then a score, a findings table, and any coverage notes:
Target: https://github.com/owner/mcp-server
Score: 46/100 Significant risk - do not deploy as-is
┌──────────┬────────────────────────────────┬───────────────────────────┬──────────┐
│ Severity │ Title │ OWASP category │ Tool │
├──────────┼────────────────────────────────┼───────────────────────────┼──────────┤
│ HIGH │ ... │ Token Mismanagement & ... │ gitleaks │
└──────────┴────────────────────────────────┴───────────────────────────┴──────────┘See it on the dashboard
Every scan you run (as long as you're logged in and didn't pass --no-upload) shows up at
varq.aevrin.ai/dashboard with the same findings, the same stage
breakdown, and the same score, in the same format whether it came from the CLI or the
dashboard's own "scan a repo" form. See Dashboard.