How do I audit a website from the command line?

The one-liner

curl -s "https://outrings.com/api/v1/summary?url=example.com" | jq

The scheme is optional, ?url= and ?domain= both work, and GET and POST behave identically. There is nothing to authenticate and nothing to install beyond jq, which is only there to make the JSON readable.

Getting less back

A full report is around 124 KB. Most of the time you want a fraction of that, and it is cheaper to ask for less than to filter afterwards.

Pulling out the parts that matter

Four fields carry most of the value. This shape is a good default:

curl -s "https://outrings.com/api/v1/security?url=example.com" \
  | jq '{score, verdict,
         findings: [.problems[] | {severity, title, found}],
         ranked: [.priorityActions[] | {pointsIfFixed, effort, action}],
         notCovered,
         undetermined: [.undetermined[]?.id]}'

Note the last two. notCovered is what this service never examines; undetermined is what it tried and could not determine. Dropping them gives you a tidier output that quietly implies everything else passed.

Useful recipes

Just the score, for a shell variable

score=$(curl -s "https://outrings.com/api/v1/score?url=example.com" | jq -r '.score')
echo "$score"

Only critical and high findings

curl -s "https://outrings.com/api/v1/summary?url=example.com&minSeverity=high" \
  | jq -r '.priorityActions[] | "\(.severity)\t\(.title)"'

Fail a script when the score drops below a threshold

#!/usr/bin/env bash
set -euo pipefail

threshold=80
score=$(curl -sf "https://outrings.com/api/v1/score?url=$1" | jq -r '.score')

if (( $(echo "$score < $threshold" | bc -l) )); then
  echo "FAIL: $1 scored $score, below $threshold" >&2
  exit 1
fi
echo "OK: $1 scored $score"

The whole report as Markdown, for reading or pasting into a chat

curl -s "https://outrings.com/api/v1/llm?url=example.com"

Things worth knowing before you script it

• Use curl -sf in scripts. Without -f, curl exits zero on a 502 and your script happily parses an error body.
• Results are cached for ten minutes. Repeating a URL inside that window is free and does not consume quota. Add &refresh=1 only when you genuinely need a fresh run.
• Rate limits are 40 audits an hour, 200 a day per client. Exceeding them returns 429 with Retry-After.
• Errors are JSON. Non-2xx responses return {"ok": false, "error": "…"}. Unreachable targets give 502; private or reserved addresses give 403.
• Timing. A fast audit is one to eight seconds. Set a generous client timeout — 30 seconds is comfortable.