Canonical: https://dokima.net/docs/getting-started/
Updated: 2026-11-04T23:30:51+00:00

Documentation

# Getting started

For installation, activation, runner setup and your first report, follow the [Getting Started guide](https://dokima.net/start/). This page covers workspace context and ongoing reviews.

Dokima runs from the directory containing your Git repositories and stores state locally under `.dokima/`. It supports Claude and Codex directly, and other models through OpenCode (including Gemini, open models and local models). Follow the [runner setup instructions](https://dokima.net/start/#runner) before starting a review.

## Choose where Dokima runs

We recommend a dedicated Linux VPS, VM or user account for ongoing review. Give it access to the repositories and your chosen AI runner, and keep its workspace available between reviews. macOS is also supported.

Publish reports privately to [Dokima.net](https://dokima.net/account/), or serve `dokima-report/` on a protected internal company website when running on your own infrastructure. See [sharing status and results](https://dokima.net/docs/team-reports/). Agents can follow the [setup guide](https://dokima.net/docs/agent-setup/).

## Choose your licence

Create an account and verify your email, then open Downloads. **Activate my free licence** provides continuing use for two contributors, including private code. **Start a team trial** provides a separate 21-day evaluation for 100 contributors, starting on first activation. Free keeps your one team trial available for later. At trial expiry, choose Free or a paid plan; your saved review state, findings and reports are preserved.

Run `dokima license refresh` online to renew Free access. Going over the contributor allowance shows an upgrade warning; reviews and results remain available. For public OSI-licensed projects without a contributor cap, use the [open source application](https://dokima.net/open-source/apply/). All plans support the same runners and optional private sharing.

## Open an existing workspace

Move into the directory that contains your repositories, then start Dokima:

```
cd /path/to/your/workspace
dokima
```

On first run, Dokima confirms workspace setup, detects your repositories and runners, and opens the terminal dashboard.

If you prefer not to give your model Git access, you can have a cron job update the source from Git and copy it to a restricted user account that Dokima runs in.

## Add useful project context

Dokima creates `DOKIMA.md` at the workspace root. Use it to explain the parts of the system that source alone cannot show:

* important architecture decisions;
* trust boundaries and threat-model assumptions;
* external controls or mitigations;
* intentional non-goals;
* business rules that affect security.

This context is added to review work. Keep it concise and update it when the system changes.

## Run the first review

Use the dashboard and select **Full Sweep**, or run:

```
dokima sweep --mode full
```

A full review builds repository and component context, verifies assumptions, runs focused vulnerability hunting, challenges candidate findings and prepares the report. The time and runner usage depend on the number and size of repositories, the work due and the configured rate limit.

## Open the report

When report work completes, Dokima writes a static site to:

```
./dokima-report/
```

You can regenerate it from accepted finding state with:

```
dokima report
```

The dashboard also provides a Findings view for reviewing the current status, evidence and annotations.

## Keep reviewing

Once the initial context exists, run later sweeps as the code changes:

```
dokima sweep
```

For a long-running review loop:

```
dokima continuous
```

Dokima decides which scheduled work is due. Your runner limits still apply; if a provider reports a temporary usage window, Dokima records the cooldown and retries the queued job later.