RedWatch docs

Install

RedWatch needs Node.js 18 or newer. Check with node --version; if it's missing, install the LTS version from nodejs.org.

Windows (PowerShell)

macOS / Linux

The installer puts a single file in ~/.redwatch/bin and adds it to your PATH. Open a new terminal afterwards so the redwatch command is found.

Log in

Create an account and an API key in the dashboard, then run:

redwatch login

Paste your key when asked (it's hidden as you type) and press Enter at the API URL prompt to keep the default. RedWatch checks the key and saves it to ~/.redwatch/config.json, readable only by your user account.

First session

Go to a project folder and start the agent:

cd path/to/your-project
redwatch

Type a task and press Enter. RedWatch reads and searches files on its own, then asks before it edits anything or runs a command. For a single task without the interactive screen:

redwatch "review src/ for injection bugs and list them by severity"

Sessions are saved under ~/.redwatch/sessions. Resume the last one here with -c, resume a specific one with -s <id>, and branch it with --fork.

When output is piped, RedWatch switches to a plain line mode automatically. Pass --plain to force it, or --format json for newline-delimited events.

Commands

Inside a session

Tools & approvals

The agent works through six tools. Read-only tools run automatically; anything that changes your system waits for you.

At each prompt answer y (yes), n (no) or a (always, for the rest of this session).

Good prompts

• Recon: "Enumerate subdomains and live HTTP services for example.com, note the stack on each, and save the results to recon/."
• Web testing: "Map the routes in this codebase, then test the auth and upload endpoints for injection, IDOR and path traversal. Give a PoC for each hit."
• Exploit dev: "Here's the crash and the source. Work out the bug, write a reliable PoC, and tell me the impact."
• Reverse engineering: "Analyse sample.exe: strings, imports, behaviour, config format, and any C2 endpoints. Summarise the capabilities."
• Privesc: "Given this winpeas output, rank the paths to SYSTEM and walk me through the best one."
• Blue team: "Build a timeline from auth.log and tell me whether the attacker got a shell. Then write a Sigma rule for the technique."

Be specific about scope. Only test devices and software you have the rights to; see the acceptable use policy.

Use the API with other tools

The key is not tied to the RedWatch CLI. The endpoint is OpenAI- and Anthropic-compatible, so most agent tools can use it. Base URL and model:

Base URL: https://api.redwatch.alphadev.online/v1
Model:    redwatch-1
Key:      your sk-... key

opencode

Add a provider in ~/.config/opencode/opencode.json (or the project's opencode.json), then start opencode with REDWATCH_API_KEY set:

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "redwatch": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "RedWatch",
      "options": {
        "baseURL": "https://api.redwatch.alphadev.online/v1",
        "apiKey": "{env:REDWATCH_API_KEY}"
      },
      "models": {
        "redwatch-1": { "name": "RedWatch 1" }
      }
    }
  }
}

# PowerShell
$env:REDWATCH_API_KEY="sk-your-key"; opencode -m redwatch/redwatch-1

Claude Code

Claude Code speaks the Anthropic Messages API. Point it at the host root, not /v1:

# macOS / Linux
export ANTHROPIC_BASE_URL=https://api.redwatch.alphadev.online
export ANTHROPIC_AUTH_TOKEN=sk-your-key
export ANTHROPIC_MODEL=redwatch-1
claude

# PowerShell
$env:ANTHROPIC_BASE_URL="https://api.redwatch.alphadev.online"
$env:ANTHROPIC_AUTH_TOKEN="sk-your-key"
$env:ANTHROPIC_MODEL="redwatch-1"
claude

Aider

# macOS / Linux
export OPENAI_API_BASE=https://api.redwatch.alphadev.online/v1
export OPENAI_API_KEY=sk-your-key
aider --model openai/redwatch-1

Cline, Continue and other OpenAI-compatible clients

Choose the OpenAI-compatible provider, set the base URL to https://api.redwatch.alphadev.online/v1, paste the key as the API key, and set the model id to redwatch-1.

curl

curl https://api.redwatch.alphadev.online/v1/chat/completions \
  -H "Authorization: Bearer $REDWATCH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"redwatch-1","messages":[{"role":"user","content":"hi"}]}'

Configuration

Settings live in ~/.redwatch/config.json. Environment variables override the file:

Billing & usage

Every request the agent makes uses a little of your credit balance, based on how much text it reads and writes. Long files and big command outputs cost more; /clear between unrelated tasks keeps requests small.

redwatch usage

When your balance runs out the agent stops with an "out of credits" message. Top up in the dashboard and carry on with the same key.

Troubleshooting

Still stuck? Contact support from the dashboard.