The CARL CLI is a thin wrapper over the CARL engine. It runs on any machine with Node 22+ and evaluates a local directory against the CARL v1.0 criteria catalog. Use it locally to iterate on your readiness score, or in CI to gate merges on a minimum level.

Install

# pnpm (available once published in M3)
pnpm add -D @wentzel/carl

# npm
npm install -D @wentzel/carl

# or run without installing
pnpm dlx @wentzel/carl assess

Common commands

# Assess the current directory, pretty-printed terminal output.
carl assess

# Assess a specific path.
carl assess ./packages/web

# Emit JSON (the same structure the hosted assessor stores).
carl assess --json > carl-report.json

# Emit Markdown (equivalent: --format markdown).
carl assess --markdown > carl-report.md

# CI gating — exit 0 if level >= 3, exit 1 otherwise.
carl assess --min-level 3

# Suppress the progress line on stderr; disable ANSI color.
carl assess --quiet --no-color

Exit codes

Exit codes are stable — CI pipelines can rely on them.

CI integration

See the CI integration guide for full YAML examples. The short version:

# .github/workflows/ci.yml
- name: CARL assessment
  run: pnpm dlx @wentzel/carl assess --min-level 3 --json > carl-report.json

- name: Upload CARL report
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: carl-report
    path: carl-report.json

Output

Pretty-printed terminal output renders:

• A header with the CARL level badge, repository, and commit.
• A per-pillar scorecard.
• The findings, grouped by pillar, each with its sanitized evidence summary and remediation text.

JSON output is the engine's Report object (camelCase fields such as levelAchieved and pillarScores) with a $schema pointer. The standard's report contract — snake_case fields per /spec/v1.0/report-format/ and reference/report-schema/ — is what the published CLI will emit; aligning the two shapes is tracked work.

When to use the CLI vs the hosted app

• Local iteration. CLI. Faster feedback, no network round-trip.
• CI gating. CLI. Deterministic, fail-fast, no external dependency.
• Private repositories at first assessment. Hosted app. Easier auth flow; ephemeral-container guarantees.
• Executive-facing reports, PDF export, shareable URLs. Hosted app.
• Air-gapped environments. CLI, or the self-hosted Docker image.

Related

• CI integration — wiring the CLI into GitHub Actions.
• Report format — the output contract the CLI adheres to.
• GitHub App — PR-time assessment without wiring a workflow.