Docs

Before you start

You need a Pharon account (sign up), Claude Code (opens in a new tab) and Node.js 18 or later. Pharon reads your stack on your machine and uploads only an inventory of names and versions; what we see lists exactly what that includes.

Install the Claude Code plugin

In Claude Code, add the Pharon marketplace and install the plugin:

/plugin marketplace add getpharon/pharon
/plugin install pharon@pharon

The plugin brings the pharon command-line tool with it. Claude runs it for you through Pharon's commands, so there is nothing else to install.

Connect a repo

Open Claude Code in the repository and run:

/pharon:setup

1. It logs you in. A browser tab opens; check that the code matches and approve. The token is stored in your OS keychain.
2. It links the repo to your organization, using the git remote as its identity.
3. It scans the stack locally and summarizes what it found.
4. It asks about what files can't show: services your code calls directly, and the cloud services you run (through your own cloud CLI, or by typing them in).
5. It shows exactly what will be uploaded and waits for your yes.

After that the inventory stays current on its own: whenever a Claude Code session starts or ends and a stack file changed, Pharon uploads the new inventory in the background.

Commands

Under the hood these run the pharon CLI, which Claude can also run directly when you ask, for example pharon gaps (what Pharon can't see yet), pharon track aws cloud_cli --profile prod (scan AWS with that profile), pharon manual add aws rds postgres 15.4 (record a version by hand) or pharon redact add '@acme/*' --hash (hash internal package names before upload).

Cloud services

AWS, Google Cloud and Azure are scanned with your own command-line login, read-only: Pharon runs only an allowlist of describe and list commands, and account ids are hashed before upload. During /pharon:setup, choose to use the AWS CLI, gcloud or az when Pharon finds that provider, or set it up later:

pharon track aws cloud_cli --profile prod
pharon sync --cloud aws

Without a cloud CLI, type versions in instead (pharon manual add). Pharon asks you to confirm them when something related changes.

Check whether you were affected

Every notice page shows its id. In Claude Code, in the affected repo, run:

/pharon:check-incident <notice-id>

The check is read-only. It looks at lockfiles and their history during the exposure window, installed packages, package caches, Docker images and indicator files. You get a verdict for each place the component lives:

• Affected: the bad version is or was installed here
• Likely: a version range allows it and the evidence isn't conclusive
• Not affected: pinned or installed at a safe version
• Unknown: Pharon couldn't tell, with what to look at by hand

It also lists the secrets that were within reach, by name only. Choose to share the verdict, and your team sees it on the incident page with a checklist for rotating those secrets.

Alerts

• Email: by default critical and high incidents arrive right away and the rest in a daily digest. Each person can change this in Settings → Notifications, and snooze one incident from its page.
• Claude Code: anything new for the repo you're in is shown when a session starts.
• Slack: add an incoming webhook in Settings → Slack. Critical and high go out right away, the rest daily.
• Webhooks: add an https endpoint in Settings → Webhooks to receive every new or changed match as JSON.

Each webhook request carries X-Pharon-Signature: t=<unix time>,v1=<hex>, an HMAC-SHA256 of <t>.<raw body> with your webhook's secret. Recompute it, compare in constant time, and reject old timestamps:

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(header, rawBody, secret) {
  const { t, v1 } = Object.fromEntries(header.split(",").map((kv) => kv.split("=")));
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;
  return fresh && v1?.length === expected.length && timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}

GitHub Actions

The Action keeps the inventory current from CI and checks pull requests: it lists the components a pull request introduces that match an open incident, comments once (updated in place), and fails at the severity you choose. Create a CI token on the project page in Pharon, store it as the repository secret PHARON_TOKEN, and add a workflow:

on: { push: { branches: [main] }, pull_request: {}, schedule: [{ cron: "17 3 * * *" }] }
jobs:
  pharon:
    runs-on: ubuntu-latest
    permissions: { contents: read, pull-requests: write }
    steps:
      - uses: actions/checkout@<sha>
      - uses: getpharon/pharon@<sha>
        with: { token: "${{ secrets.PHARON_TOKEN }}", fail-on: high }

A CI token can only upload inventories for its project. Pull requests from forks don't receive the secret, so the Action skips them instead of failing.

Privacy and trust

• Only an inventory leaves your machine: names, versions and paths of stack files. /pharon:show prints it exactly.
• Redaction rules drop or hash internal names before upload, per machine (pharon redact add) or for the whole organization (Settings).
• Every notice is signed with Ed25519; the CLI rejects unsigned or tampered notices and never runs anything from one.
• The local check never changes files, never rotates keys and never reads secret values.
• Accounts have no password to leak: you sign in with a single-use link sent to your email, and can add two-factor authentication with an authenticator app.