Documentation

Console path: connect → discover → protect → scan.

Release 1 self-serve starts in the dashboard — not a license-key installer or invented CLI clean flags.

Quick Start Guide

Install from a console token

After signup, open Add Server and copy the install one-liner. The agent is ~600KB; the token is short-lived and bound to your account.

$ curl -sSL https://api-cleanshift.osg.co.in/i/TOKEN | bash

# TOKEN comes from console → Add Server (not --api-key / license-key)

Protect WordPress sites under Sites

Wait for the agent to come online — connect already inventories WordPress installs. Protect the sites you want scanned under Sites. Re-queue Discover only if inventory is empty. Unprotected sites block on-demand scans by design.

# Console: Sites → Protect (Discover re-queue only if empty)

# Then Scans → queue a quick scan (deep/targeted may need plan)

Review findings & approve remediation

Open Threats / Remediate in the dashboard and approve backup → remediate → verify. CLI clean modes are auto, manual, or report-only only — prefer dashboard approve in Release 1.

# Preferred R1 path: approve in the dashboard

$ cleanshift report --format table

$ cleanshift clean --server --mode manual

CLI Reference

Release 1 note: cleanshift guard enable/disable/status only toggles the emergency kill switch. The Guard PHP mu-plugin is deployed by ops via deploy/deploy.sh (or manual copy into wp-content/mu-plugins/) — not by zero-touch curl | bash install.

Command	Description
cleanshift scan --server	Scan WordPress sites in agent scope (R1 console path: Protect sites first, then queue from Scans)
cleanshift scan --site /path	Scan a specific WordPress site
cleanshift scan --scan-mode deep	Deep scan including database analysis (plan/entitlement gated; prefer dashboard)
cleanshift clean --server --mode manual	CLI cleanup after review (modes: auto \| manual \| report-only; prefer dashboard approve in R1)
cleanshift report --format table	Display scan results as a table
cleanshift report --format json	Export results as JSON
cleanshift guard status	Check Guard kill-switch status (does not install the mu-plugin)
cleanshift status	Check agent status and license info
cleanshift update	Update agent to the latest version

API Reference

POST/api/v1/scanTrigger a new scan on a target server or site.

GET/api/v1/scan/:idRetrieve scan results by scan ID.

POST/api/v1/cleanQueue approved remediation (backup → clean → verify).

GET/api/v1/nodesList all registered nodes and their status.

GET/api/v1/reportsList historical scan reports with filtering.

All endpoints require an Authorization: Bearer <API_KEY> header. API access is available on Server and Fleet plans.

Trust & Security

Security Architecture

How the agent works, what leaves your server, rollback safety, clean uninstall, and audit logging.

Sample Scan Report

See an anonymized deep scan report showing database threats, cross-site correlation, and remediation output.

View report

API Reference

REST API documentation for authentication, servers, scans, threats, and agent endpoints.

View API docs

Need help?

Reach our engineering team directly on WhatsApp for onboarding, integration support, or custom playbook requests.

Chat on WhatsApp