Install and sign in
If you installed the bare0xinsider package globally, run npm uninstall --global 0xinsider before installing the scoped package. Both own the same executable name; leaving the old alias installed makes npm refuse the new install with EEXIST. Do not use --force to overwrite it.
login prints a verification URL and code. Open the URL, sign in, check the account and requested read/usage scopes, and approve the connection. The terminal waits for your decision. A headless terminal uses the same flow; it never asks for your password or developer key.
whoami reads the authenticated account and credential identity. Denied or expired codes require a new login. Ctrl-C stops polling. If you approved before interrupting, review connected applications in Developers and revoke any connection you do not need.
Agents and CI
SetOXINSIDER_API_KEY through your environment or secret manager, then run the same data commands. It overrides a stored browser session. The CLI never saves that environment key, and logout never revokes it. Do not put credentials in command arguments or URLs.
Stored browser sessions support macOS and Linux. Windows stored sessions are not supported; the environment-key path has not been verified on Windows.
Read commands
condition_id from search for snapshot or intel. reports daily defaults to the current UTC date; select another with --query date=YYYY-MM-DD. Repeated --query name=value flags supply filters or array values. api call <operation-id> exposes registered JSON GET operations, excluding administration, mutations, exports and streams.
JSON is the default, including in pipes. API envelopes, freshness, request IDs and cursors are preserved. --table selects tab-separated list output with metadata on stderr. Missing or unavailable data remains an error or the API’s explicit unavailable state.
Bound a traversal
--pages accepts 1–100 and returns a cli_pages document for multi-page reads. If more data remains, complete is false, next_cursor identifies the continuation, and the process exits 8. Resume with --cursor. A failed traversal preserves pages already fetched as incomplete; do not treat a nonzero exit as a complete result.
--timeout-ms bounds each request including retries: default 30000, maximum 300000. --retries accepts 0–3, defaults to 2, and respects Retry-After within the deadline. Ctrl-C cancels polling and requests. Results use stdout; progress and errors use stderr.
Session storage and sign-out
$XDG_CONFIG_HOME/0xinsider/cli/session.json, or ~/.config/0xinsider/cli/session.json when XDG_CONFIG_HOME is unset. OXINSIDER_CONFIG_DIR overrides the directory. The owned directory must be private (0700); the file is private (0600), flushed and atomically replaced. Refresh rotates the stored session automatically.
Concurrent session operations refuse an existing session.lock. After a crash, inspect its owner.json and remove the lock only after confirming that its process has stopped. Product commands send credentials only to the production API or an explicit loopback development origin; stored sessions are bound to that origin.
Help and exit codes
--help, --version, and completions bash|zsh|fish work offline without credentials. Load the printed completion setup using your shell’s normal configuration.
Existing MCP installations
Both0xinsider and 0xinsider-mcp remain available. No arguments and serve start stdio MCP; init configures an MCP client. MCP continues using its environment key, independently of a browser CLI session. See local MCP setup.
Node installations older than 22 can pin @0xinsider/mcp@1.3.1 for the previous MCP runtime. The bare 0xinsider npm alias and Homebrew currently install the older 1.x runtime. Use the scoped 2.0.0 package above for product commands.