From the CLI¶

prodpeek drives a local or remote instance over /api/v1. Everything the console does, except opening a drop link — which is a browser step on purpose.

Install¶

The CLI ships in the same image:

alias prodpeek='docker exec -i prodpeek prodpeek'

Or, from a checkout: uv run prodpeek.

Log in¶

prodpeek login https://prodpeek.example.dk --key ppa_your_admin_key

Saved to ~/.config/prodpeek/cli.json, mode 0600. In CI, skip the file entirely:

export PRODPEEK_URL=https://prodpeek.example.dk
export PRODPEEK_ADMIN_KEY=ppa_...

The environment wins over the file, so a build agent never writes a key to disk.

The whole onboarding, without a browser¶

# 1. A project per customer
prodpeek project create "EJD"

# 2. Connect a service — deliberately WITHOUT a credential
prodpeek service add coolify/read-only https://coolify.ejd.dk/mcp \
  --name ejd-coolify --project ejd

Output

created service ejd-coolify (coolify/read-only)

  It has no credential yet. Open this ONCE, in a browser, and paste it:
      https://prodpeek.example.dk/drop/3MF5uUq0O_TQbSgXI-1f5VOIemeJEyaMYkoBu70eGHM
  The link dies on use and expires at 2026-09-24T15:09:34+00:00.
  Nothing you or an agent runs here ever sees the secret.

# 3. A human opens that link and pastes the token. Then:
prodpeek service test ejd-coolify

# 4. A key for a developer, with a short life
prodpeek token create anders --services ejd-coolify --ttl 8h

Day to day¶

prodpeek service list                # what is connected, and what is missing a credential
prodpeek token list                  # who holds a key, and when it expires
prodpeek token revoke <id>
prodpeek profile list                # every policy, with provenance and counts
prodpeek profile show coolify/read-only
prodpeek incidents                   # what went down, with its evidence timeline
prodpeek monitor add "EJD site" https://ejd.dk/health

The two that answer "is this thing honest"¶

prodpeek prove

Output

0 of 47 denied tools reachable, credential scope confirmed read-only,
toolset matches verified digest, audit chain verifies

  ok ejd-coolify          0/32 denied tools reachable, read_only
  ok ejd-prom             0/6 denied tools reachable, not_introspectable

Exit code 0 when the wall held, 1 when it did not — so it works in CI.

prodpeek egress

Prints every host this configuration can reach, derived from the live config rather than from a paragraph somebody wrote once. See What leaves your network.

In CI¶

.github/workflows/prodpeek.yml

- name: Prodpeek still refuses what it should
  env:
    PRODPEEK_URL: ${{ secrets.PRODPEEK_URL }}
    PRODPEEK_ADMIN_KEY: ${{ secrets.PRODPEEK_ADMIN_KEY }}
  run: prodpeek prove

A failing prove means a denied tool became reachable, a credential gained write access, or the audit chain broke. All three are worth a red build.