CLI and CI

Use Fortifie from your terminal.

The Fortifie CLI is the same product as the website and the editor MCP, through one more door. Sign in, then assess or harden a build you own. Self-serve protection today is JavaScript. Mac apps are supported but may take longer. Other platforms are coming soon. The build is uploaded, never launched, and deleted after the run.

Install

The CLI is not on PyPI yet. Install the published 0.2.1 wheel. Python 3.9 or newer, no other packages required.

python3 -m pip install https://fortifie.xyz/cli/fortifie-0.2.1-py3-none-any.whl
fortifie --version

To verify the file first:

curl -fsSL -o fortifie-0.2.1-py3-none-any.whl \
  https://fortifie.xyz/cli/fortifie-0.2.1-py3-none-any.whl
echo "43532dca42b0451b2d2636d3381d181f20b52f9c1786d24921f95a6a1d86b560  fortifie-0.2.1-py3-none-any.whl" | sha256sum -c -
python3 -m pip install ./fortifie-0.2.1-py3-none-any.whl

SHA-256 of the 0.2.1 wheel: 43532dca42b0451b2d2636d3381d181f20b52f9c1786d24921f95a6a1d86b560. Files: wheel, SHA256SUMS. The previous 0.2.0 wheel remains available.

Connect your account

CLI and MCP calls need a Solo or Studio API key. Free accounts cannot issue keys. The CLI never prints the key.

fortifie login
fortifie whoami

fortifie login opens https://fortifie.xyz/account/connect. You enter a short code, and the CLI stores a key at ~/.config/fortifie/credentials. Or create a key on the API keys page and set FORTIFIE_API_KEY.

Commands

fortifie assess fixture://owned-js-sample
fortifie harden ./app.js --authorized "Acme Inc, 2026-11-13" --out app.js.hardened
fortifie ci-release ./app.js --authorized "Acme Inc, 2026-11-13"
fortifie status <run_id>
fortifie audit <run_id>

Default server: https://fortifie-mcp.fly.dev. harden and ci-release need an authorization record in the shape Name or Org, YYYY-MM-DD. A run that needs human review never writes a hardened file (exit 3 by default).

Hosted assess can scan a fixture or a raw JavaScript file. A Mac app scan, on the website or from the CLI, runs on our Mac build machine, which is not always online, and is refused if that machine is off. fortifie harden works on JavaScript from the CLI. Mach-O and .app harden from the CLI still needs a recorded scan ref; the website job queue is the self-serve path for those, when the Mac is on.

GitHub Actions and GitLab CI

Copy-paste a release workflow that installs this same wheel, then runs fortifie ci-release. Store FORTIFIE_API_KEY as a secret or a masked CI variable. The job should refuse to publish if the hardened file was not written.

Examples also ship with the CLI package. There is no GitHub Marketplace action yet, and pip install fortifie from PyPI is not available yet.

Get a free scan All three ways in