Metadata-Version: 2.4
Name: vorlox
Version: 0.1.1
Summary: Vorlox — MCP security scanning for your hosted organisation
Project-URL: Homepage, https://vorlox.io
Project-URL: Documentation, https://vorlox.io/docs
Project-URL: Issues, https://vorlox.io/support
License: Vorlox CLI — Proprietary Licence
        
        Copyright (c) 2026 Fahad Ali, trading as Vorlox. All rights reserved.
        
        
        THIS IS A WORKING DRAFT, NOT LEGAL ADVICE.
        
        It is pending review by a qualified solicitor and may change. It states the
        licensor's current intent in good faith. If anything here conflicts with a
        signed agreement you have with the licensor, that agreement governs.
        
        
        1. DEFINITIONS
        
           "Licensor" means Fahad Ali, an individual trading as Vorlox. No company is
           registered at the date of this licence. Where this licence is later assigned
           to a company formed by the Licensor, that company becomes the Licensor and
           this licence continues unchanged in all other respects.
        
           "Software" means the Vorlox CLI distributed under the package name `vorlox`,
           including its source code, object code and accompanying files.
        
           "Vorlox Service" means the hosted Vorlox service operated by the Licensor.
        
           "Your Organisation" means an organisation account on the Vorlox Service that
           you own, or are authorised by its owner to act for.
        
           "You" means the individual or entity exercising the permission granted in
           section 2.
        
        
        2. GRANT OF PERMISSION
        
           The Licensor grants you a personal, non-exclusive, non-transferable,
           revocable permission to install and run the Software for the sole purpose of
           interacting with Your Organisation on the Vorlox Service.
        
           That is the entire grant. Installing the Software on machines you control —
           including build agents and continuous-integration runners — and running it
           against Your Organisation is permitted. Any other use is not.
        
        
        3. RESTRICTIONS
        
           Except to the extent that applicable law expressly overrides a restriction
           below, and only to that extent, you may not:
        
           (a) redistribute, publish, sell, rent, lease, sublicense, or otherwise make
               the Software available to any third party;
        
           (b) modify, adapt, translate, or create derivative works of the Software;
        
           (c) reverse engineer, decompile, or disassemble the Software, or otherwise
               attempt to derive its source code, algorithms, or underlying ideas;
        
           (d) remove, obscure, or alter any copyright, trademark, or other proprietary
               notice in or on the Software;
        
           (e) use the Software to interact with any Vorlox organisation that is not
               Your Organisation;
        
           (f) use the Software to build, train, or improve a competing product or
               service.
        
        
        4. RESERVATION OF RIGHTS
        
           The Software is licensed, not sold. The Licensor retains all right, title and
           interest in and to the Software, including all intellectual property rights.
           No rights are granted except those expressly stated in section 2. No right is
           granted by implication, estoppel, or otherwise.
        
        
        5. THIRD-PARTY COMPONENTS
        
           The Software depends on separately licensed open-source components, which
           remain governed by their own licences. Nothing in this licence limits your
           rights under those licences with respect to those components.
        
        
        6. TERMINATION
        
           This permission terminates automatically if you breach any term of this
           licence, and may be revoked by the Licensor at any time. On termination you
           must stop using the Software and remove all copies in your possession or
           control. Sections 3, 4, 7 and 8 survive termination.
        
        
        7. NO WARRANTY
        
           THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
           IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
           FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
        
           The Software reports the results of automated security analysis. It does not
           guarantee that any system is secure, and its output is not a substitute for
           your own security judgement.
        
        
        8. LIMITATION OF LIABILITY
        
           TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE
           LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN
           ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN
           CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
        
           Nothing in this licence excludes or limits liability for death or personal
           injury caused by negligence, for fraud or fraudulent misrepresentation, or
           for any other liability that cannot lawfully be excluded or limited.
        
        
        9. GOVERNING LAW
        
           This licence is governed by the laws of England and Wales, and the courts of
           England and Wales have exclusive jurisdiction over any dispute arising from
           it.
        
        
        Questions about this licence: contact@vorlox.io
License-File: LICENSE
Keywords: ci,mcp,model-context-protocol,scanner,security
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: Other/Proprietary License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Typing :: Typed
Requires-Python: >=3.12
Requires-Dist: httpx>=0.27.0
Requires-Dist: typer-slim<0.22,>=0.12.0
Description-Content-Type: text/markdown

# Vorlox CLI

Scan the MCP servers in your hosted [Vorlox](https://vorlox.io) organisation
from a terminal or a CI pipeline.

```bash
uv tool install vorlox     # or: pipx install vorlox
vorlox login
vorlox scan --hosted <server-id>
```

## Commands

| Command | What it does |
| --- | --- |
| `vorlox login` | Store an API key (prompted, never echoed, never an argv flag) |
| `vorlox logout` | Remove the stored key |
| `vorlox auth status` | Show which credential is active, without printing it |
| `vorlox scan --hosted <id>` | Scan a server in your organisation |
| `vorlox findings` | List findings, newest first |

## CI

Set `VORLOX_API_KEY` instead of running `vorlox login`. It takes precedence over
a stored credential, so a pipeline is never affected by whoever last logged in
on the runner.

```bash
export VORLOX_API_KEY=vlx_live_...
vorlox scan --hosted <server-id> --fail-on high
```

Exit codes: `0` passed, `1` a finding met or exceeded `--fail-on`, `2` the scan
could not run.

## Before the CLI can scan a server

A **person** must add the server in the Vorlox dashboard and confirm they are
authorised to scan it. An API key cannot do this for itself — a pipeline must
not be able to manufacture the authorisation for the target it then scans. The
server's page shows its ID once it is confirmed.

Your key needs the `scans:write` scope to scan, and `findings:read` to read
findings. Create keys in **Settings → API keys**.

## Scope

This package talks to the hosted Vorlox API over HTTPS. Scanning a local MCP
server from your own machine is not part of it.
