Reference

TRVChek CLI Reference

TRVChek runs entirely on your machine. Install it once, then check any project from your own terminal — deterministic checks and fixes never upload your code.

Python is fully covered, with JavaScript/TypeScript support for the cross-language rules tagged NEW (eval, secrets, hashes, redirects).

Install

TRVChek downloads are temporarily unavailable while the current release is being validated.

Requires Python 3.9+. This command also finishes activation — it reuses a valid license on the machine, or asks for your key in the terminal. Run trvchek activate <your-license-key> only as recovery if that did not complete.

Commands

activatetrvchek activate <license-key>

Activate your license on this machine. The installer normally does this for you, so this is the recovery path. Needs the internet for the licence check, then stores the result locally.

checktrvchek check <file-or-dir>

Scan a file or directory and print a human-readable report. Runs all 528 AI-specific rules and prints an Immunity Score with a severity-ranked finding list.

check --jsontrvchek check <file-or-dir> --json

Machine-readable JSON output (for CI) — the same 528-rule check, emitted as JSON for pipelines and pre-commit hooks.

statustrvchek status

Show license status and rule-engine version, including the active rule count (528 rules).

backuptrvchek backup

Back up current config and custom settings, so every change is reversible.

deactivatetrvchek deactivate

Deactivate the license on this machine so it can be activated on another workstation.

Flags

Flag	Description	Example
--json	Emit machine-readable JSON instead of the human terminal report. Ideal for CI pipelines and pre-commit hooks.	trvchek check ./src --json
--threshold	Fail with a non-zero exit code when the Immunity Score falls below the given percentage.	trvchek check ./src --threshold 85
-r	Recurse into subdirectories (recursive check of the whole tree).	trvchek check . -r
-v	Verbose output — show every rule evaluated, matched line and excerpt.	trvchek check ./src -v

Example output

~/projects/acme — zsh

$ trvchek check ./src

TRVChek — Premium AI Code Immunity

🏆 File Immunity Score: 70.5% (B — Vulnerable)

⚠️ Found 18 AI-specific issues:

● CRITICAL: Early return before full auth check — TRV-001

● CRITICAL: Potential authentication bypass — TRV-002

● CRITICAL: Dangerous eval/exec — TRV-003

● CRITICAL: Command injection risk — TRV-004

● HIGH: Hardcoded credentials or secrets — TRV-006

● HIGH: Potential SQL injection — TRV-007

● HIGH: Potential path traversal — TRV-008

● HIGH: Weak cryptographic hash (MD5) — TRV-009

● HIGH: Potential null reference — TRV-010

● HIGH: Missing input validation — TRV-011

● MEDIUM: Silent exception handling — TRV-014

● MEDIUM: Race condition in async code — TRV-015

● MEDIUM: Mutable default argument — TRV-016

● MEDIUM: Potential off-by-one error — TRV-017

● MEDIUM: Unclosed file handle / resource leak — TRV-019

● LOW: Insecure random usage — TRV-022

● LOW: Potentially hallucinated / insecure import — TRV-023

● LOW: Sensitive value written to debug log — TRV-024

🎯 Summary: 18 issue(s) detected → 4 CRITICAL • 6 HIGH • 5 MEDIUM • 3 LOW

⏱️ Estimated developer time saved: ~70+ min

Exit code is 0 when the score meets your --threshold, 1 otherwise — drop it straight into CI.

Need a license key?

Keys are issued per machine and activated from your terminal.

Activate TRVChek →