rasoat CLI — check your own project, site or Linux machine

The same data as this site, run inside your project: one file of about 8 MB, no dependency, no account and no token. An MCP mode lets your agent read the result and make the change.

Install

Download the file for your platform from the latest release, make it executable and put it on your PATH. Each file is built and attested on GitHub's runners, so you can check where it came from before you run it: github.com/rasoat/rasoat/releases/latest

gh attestation verify rasoat-darwin-arm64 --repo rasoat/rasoat
shasum -a 256 -c SHA256SUMS --ignore-missing

Open source under Apache-2.0, using only Go's standard library. Built for Linux, macOS, Windows and FreeBSD.

Three commands

rasoat scan .: every project under the current directory
rasoat scan example.com: one site; it reads only what any browser downloads
rasoat host: a Linux machine: distro release, kernel, installed packages

Use it from an AI agent

rasoat mcp is an MCP server over stdio, read-only: scan, fix_plan and host. Your agent reads the upgrade plan, you approve, then it makes the change and scans again. No account, no token.

On Claude Code, install the skill that teaches that loop:

claude plugin marketplace add rasoat/rasoat
claude plugin install rasoat@rasoat

Any other MCP client:

{ "mcpServers": { "rasoat": { "command": "rasoat", "args": ["mcp"] } } }

What leaves your machine

One GET a day to https://rasoat.com/data/snapshot-v1.json, carrying a rasoat-cli/<version> user agent and nothing about your project. --offline removes it.

rasoat host sends two or three GETs to this repository's release files, each naming only your distro release (debian-12.tsv.gz), never a package.

No account, no token, no telemetry. Your files, paths and versions are not sent anywhere. The download is protected by TLS only: it is not separately signed yet.

Limits

It does not check WordPress plugins and themes, other npm or Composer packages, or other frameworks. A clean result covers only the versions it lists. For the whole dependency tree, use npm audit or OSV-Scanner.

Source

The code and the full guide live in the public repository; this page is a summary.