Installation

Install Assay

Assay is one self-contained binary — the React UI is embedded into the Go executable, so there's nothing to deploy separately.

Build from source works today

Requires Go 1.25.5+, Node 22+, and pnpm 10 (corepack enable):

git clone https://github.com/chawdamrunal/assay.git
cd assay
make build              # builds the SPA, embeds it, compiles bin/assay
make install            # copies it to ~/.local/bin (override: PREFIX=/usr/local)
assay version
For default-mode scans you also need the Claude Code CLI (claude) on your PATH. That's what does the reasoning on your subscription.

Prebuilt release channels

These are wired via install.sh, install.ps1, and .goreleaser.yaml and go live once the first v*.*.* release is published:

# macOS / Linux / WSL  (checksum-verified)
curl -fsSL https://raw.githubusercontent.com/chawdamrunal/assay/main/install.sh | sh

# Windows PowerShell  (checksum-verified)
irm https://raw.githubusercontent.com/chawdamrunal/assay/main/install.ps1 | iex

# Windows (WinGet)
winget install chawdamrunal.Assay

# Homebrew
brew install chawdamrunal/tap/assay

# Docker
docker run --rm -v ~/.claude:/scan ghcr.io/chawdamrunal/assay:latest scan /scan

# inside Claude Code
/plugin install chawdamrunal/assay

Until the first release is tagged, build from source above — or build the Docker image locally with docker build -t assay:local .

Authentication

For MCP-mode scans (the default), your Claude Code login is used — no separate auth. For the --scan-mode legacy path, Assay resolves credentials in priority order:

  1. ANTHROPIC_API_KEY environment variable
  2. assay config set api-key sk-ant-... (stored in the OS keychain)
  3. Your existing Claude Code OAuth credentials (auto-detected), with built-in 429 retry + backoff

Run assay auth status to see which method is active. Config lives in ~/.config/assay/; data in ~/.assay/ (both 0750, files 0600; the API key is keychain-only).

← Docs homeQuickstart →