CLI and configuration reference

Every dazio command, the flags you use, and the settings and environment variables it reads. dazio <command> --help lists every flag in the binary you have, including a few internal ones left out here.

Global flags

-v and -h work on every command; dazio daemon accepts -v and ignores it. --version works on dazio alone: dazio scan --version is an unknown flag.

dazio --version
dazio scan -v

See what was found

dazio scan

The guided first scan, terse after; through the daemon when one runs.

• With the daemon running, the daemon runs the scan and the CLI prints the result.
• With no daemon and no earlier scan, it runs the guided first scan. That scan registers the installation, downloads the malware feed and ends with one offer of continuous protection. Declining installs nothing.
• With no daemon after that, it runs a short scan in this process.

dazio scan
dazio scan --local
dazio scan --scope mcp

scan --local only checks against a malware feed already on disk. Without one, it reports malware: NOT CHECKED.

dazio result

Summarize the latest scan of this machine.

result and its subcommands work with the daemon stopped, reading what was last saved. All but installs fail when no scan has run yet.

dazio result

Each subcommand shows one part of the latest scan in detail.

dazio result secrets
dazio result inventory --type package --provider npm --paths
dazio result malware --json
dazio result installs --since 24h --all

dazio status

Show daemon status. With no daemon running, it prints what was last known and exits 1.

dazio status

Protect

dazio protect

Set up continuous protection: the background daemon, feed updates and alerts, and safe-pkg. It lists what it will run, watch, write and send before it asks.

dazio protect

dazio protect -- <command> [args ...] runs one command with its installs checked. It needs no safe-pkg enable and writes no files, but it needs the daemon running, the feed enabled (dazio feed enable) and safe-pkg serving: safe_pkg_mode not off, and a free port in its range. Without any of these, the command still runs, unchecked, after dazio protect: running unprotected and the reason. Either way it exits with the command’s exit code. If the command cannot start at all, dazio prints its own error and exits 1.

dazio protect -- npm install

dazio safe-pkg

safe-pkg checks package installs against the malware feed before they land. In warn mode, the default for safe-pkg enable, a known-malware package still installs and the detection is recorded (see dazio result installs). block mode refuses it, and is what dazio protect enables unless you pick warn.

dazio safe-pkg enable --mode block
dazio safe-pkg allow left-pad@1.3.0
dazio safe-pkg disable

To change the mode, run dazio safe-pkg enable again with the new --mode.

dazio feed

With the feed enabled, the malware feed on this machine stays current, and you are emailed when a package here matches it. It needs an email address, confirmed by a link. Updates and alerts start once you follow that link. The feed requires analytics to be on. Every feed command except terms needs the daemon running.

dazio feed terms
dazio feed enable --email you@example.com
dazio feed refresh
dazio feed disable

Manage

dazio service

The background daemon scans on a schedule and on file changes, so you don’t have to remember to run a scan. dazio service runs it as a login service: a LaunchAgent on macOS, a systemd user unit on Linux.

None of them take flags.

dazio service install
dazio service status
dazio service restart

dazio daemon

Run the background daemon in the foreground, logging to the terminal. For everyday use, run dazio service install instead. It always logs at info; -v has no effect here. It exits with an error if a daemon is already running.

dazio daemon

dazio email

Manage the email address the feed’s alerts go to.

dazio email unbind
dazio email erase --email you@example.com

dazio reset

Forget this installation: unregister it, then delete its identity, its email association (feed alerts stop), its pending uploads and the local malware feed store, and undo every safe-pkg edit. It cannot be undone, and it needs the daemon running.

dazio reset --yes

dazio completion

Generate the shell completion script for bash, zsh, fish or powershell. The Homebrew install already sets up completions. dazio completion <shell> --help shows how to load the script.

dazio completion zsh > "${fpath[1]}/_dazio"

Files and directories

Dazio keeps its state in one directory per user:

It holds settings.json (see below), identity.json, the daemon log daemon.log, the local malware feed store and scan results. On macOS it also holds daemon.stderr.log, the daemon’s stderr; on Linux that goes to the journal (journalctl --user -u dazio).

The daemon’s socket, daemon.sock, lives in:

dazio service install writes the login service:

settings.json

settings.json in the state directory holds your preferences. You can edit it by hand, or write it before the first run. Unset keys take their default. The daemon reads it when it starts, so after an edit run dazio service restart.

A duration that doesn’t parse reads as its default. A file that doesn’t parse, or an unknown analytics value, is unreadable: analytics and the feed read as off, every other key as its default, and writes to it are refused, so dazio feed enable and dazio safe-pkg enable fail until you fix or remove it.

{
  "analytics": "local",
  "safe_pkg_mode": "block",
  "full_interval": "2h"
}

Environment variables

The login service does not inherit your shell’s environment, so DO_NOT_TRACK exported in a shell profile affects commands you run, but not the service daemon. To turn uploads off for the daemon too, set "analytics": "off" in settings.json and run dazio service restart.