Wrkr代码审计工具

Install

Go install (Pinned/reproducible)

WRKR_VERSION="v1.5.0"
go install github.com/Clyra-AI/wrkr/cmd/wrkr@"${WRKR_VERSION}"

Go install (Secondary convenience latest path)

go install github.com/Clyra-AI/wrkr/cmd/wrkr@latest

Verify the installed CLI

wrkr version --json

Canonical pinned install and release-parity guidance lives in docs/install/minimal-dependencies.md.

Personal AI setup hygiene

wrkr scan --my-setup --json
wrkr mcp-list --state ./.wrkr/last-scan.json --json
cp ./.wrkr/last-scan.json ./.wrkr/inventory-baseline.json
wrkr inventory --diff --baseline ./.wrkr/inventory-baseline.json --state ./.wrkr/last-scan.json --json

Evaluators (Fallback and demo path)

Use the curated scenario bundle when you want a clean evaluator-safe pass through discovery, evidence, verify, and regress without the repo-root fixture noise that shows up if you scan the Wrkr repository root directly. This bundle is intentionally risky by design. A low posture score or low first-run framework coverage is expected here and demonstrates that Wrkr is surfacing real control and evidence gaps, not that the product is failing.

wrkr scan --path ./scenarios/wrkr/scan-mixed-org/repos --json
wrkr evidence --frameworks eu-ai-act,soc2,pci-dss --state ./.wrkr/last-scan.json --output ./.tmp/wrkr-scenario-evidence --json
wrkr verify --chain --state ./.wrkr/last-scan.json --json
wrkr regress init --baseline ./.wrkr/last-scan.json --output ./.tmp/wrkr-regress-baseline.json --json
wrkr regress run --baseline ./.tmp/wrkr-regress-baseline.json --state ./.wrkr/last-scan.json --json

This curated path is the recommended fallback and demo workflow when hosted prerequisites are not ready yet or when you want to show the shipped wedge without repo-root fixture noise from Wrkr's own scenario, docs, and test fixtures. --path is explicit now: point it at a repo root when the selected directory itself carries a strong repo-root signal such as .git; point it at ./scenarios/wrkr/scan-mixed-org/repos, another immediate-child bundle root, or a bounded nested owner/repo clone when you want Wrkr to scan a deterministic repo-set. Low or zero first-run framework_coverage in this evaluator path is still an evidence-gap signal. It means the current state lacks documented controls or approvals, not that the framework mapping is unsupported.

If hosted prerequisites are still not ready yet after the evaluator-safe scenario, start with one of these deterministic local fallback paths:

wrkr scan --path ./your-repo --json
wrkr scan --my-setup --json

Use ./your-repo when the selected directory itself is the repo root. Use a bundle root like ./scenarios/wrkr/scan-mixed-org/repos when the selected directory is intentionally a set of immediate child repos.

Typical Workflows