Tools

The registry is the record. acve is the command-line tool that checks a machine or a repository against it. It is optional; the registry is usable without it.

What it does

acve lock reads the configuration files your agent harness already keeps (Claude Code, Codex CLI, Cursor, Gemini CLI, Copilot, VS Code Copilot Chat, Claude Desktop, Ollama) and writes acve.lock.json: the harness and its installed version, the model and its weights digest where one exists, every MCP server with its resolved package version, hooks and instruction files by hash, and the permission and approval settings. acve audit matches that file against the advisories here and reports each match as confirmed, possible (a version or attribute could not be determined) or nothing.

What it does not do

• It never executes a command it discovers.
• It never opens credential files, and environment variables are recorded as names only. A redaction check refuses to write a lock that contains a secret.
• It makes no network request unless --allow-network is given.
• It has no dependencies.

Commands

npx @pickbitsai/acve locate
npx @pickbitsai/acve lock --apply
npx @pickbitsai/acve audit
npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply   # GitHub code scanning
npx @pickbitsai/acve registry sync --allow-network --apply           # fetch the latest advisories

Source, issues and the full command reference: https://github.com/pickbitsai/acve.