Command line

One audit, one blocking threshold, and CI provenance filled in for you.

cabfy wraps the two audit endpoints. It does nothing the API doesn't already do: it creates the audit, waits for it, prints a readable result, and knows how to fail a pipeline below a threshold.

bash

npx cabfy audit https://my-store.com

text

✔ Audit created — b3f1e2a0-... (polling…)

cabfy score: 92/100

  ✔ ucp_discovery        100  pass
  ✔ catalog_quality       95  pass

Agent readiness: Agent Ready (3/4 categories)
  discoverability          2/4
  api / auth / mcp         2/6
  content accessibility    1/2
  bot access control       1/2
    → Secure sign-in for agents (api / auth / mcp)
    → Content natively readable by an agent (content accessibility)

Report: https://api.canagentsbuyfromyou.com/audits/b3f1.../report

A check in warn or fail prints its recommendation right below its row: that's the actionable text, and the first thing to read. The Agent readiness block only appears when general_readiness came back non-null (see the API reference) — it's silently omitted otherwise, same as options.general_scan itself.

The command's own output is English

Like other developer tools (Stripe CLI, Vercel CLI), the command has no localised display: "Audit created", "score", "Report" stay in English whatever your language. The --language option doesn't govern that chrome — it governs what the engine produces: the recommendations printed under warn or fail checks, and the HTML report.

Options

Option	Default	Purpose
<url> (positional)	— (required)	URL of the store to audit.
--fail-under <score>	none	Exit non-zero if the overall score falls below this threshold. This is the flag that turns the command into a quality gate.
--api-key <key>	$CABFY_API_KEY	Without a key, the audit runs anonymously.
--api-url <url>	$CABFY_API_URL	Backend address — override for local development.
--language <fr\|en>	fr	Language of the recommendations and the report.
--no-general-scan	general scan runs by default	Skips the general agent-readiness scan (4 categories, on top of the two commerce checks) — commerce-only, faster. Silently ignored server-side (never an error) if your account or IP isn't entitled to it — see Keys, quotas and billing.
--timeout <seconds>	300	How long to wait before giving up. The audit keeps running server-side.
--json	false	Print raw JSON only, no colors or progress lines, for scripted parsing.
--commit <sha>	auto-detected	Overrides metadata.commit_sha.
--branch <name>	auto-detected	Overrides metadata.branch.
--ci-url <url>	auto-detected	Overrides metadata.ci_run_url.

Automatic provenance detection

Without the explicit flags, the command reads the pipeline environment. Nothing to configure.

	GitHub Actions	GitLab CI
Commit	GITHUB_SHA	CI_COMMIT_SHA
Branch	GITHUB_HEAD_REF (pull request) or GITHUB_REF_NAME (push)	CI_COMMIT_REF_NAME
Run URL	rebuilt from GITHUB_SERVER_URL, GITHUB_REPOSITORY and GITHUB_RUN_ID	CI_JOB_URL

Exit codes

Case	Code
No --fail-under, audit finished	0
--fail-under N, score greater than or equal to N	0
--fail-under N, score below N	1
Audit failed	1
Polling timeout	1
API error (authentication, quota, rate limit, validation…)	1

Every non-2xx response is parsed per the error contract and printed to standard error, with its error_code and whatever context is available — quota consumed, delay before retrying.

Other subcommands

Command	Purpose
cabfy login	Interactive prompt that saves an API key locally — pass --api-key to skip it.
cabfy logout	Removes the locally saved API key.
cabfy init [url]	Writes a .cabfy.yml with the store URL, so cabfy audit can run without one — the same config file the GitHub integration reads, described in CI integration.