---
name: index365-run-audit
description: |
  Use when the user wants to run or re-run an index365 scan. Triggers: "run an audit",
  "scan my site", "check my score", "re-run the audit", "run a marketing signal audit",
  "audit yoursite.com again". Covers the Marketing Signal scan and async runs. A scan
  is a paid action, see below.
allowed-tools: Bash(index365 *)
---

# index365 run audit

One command. `scan` resolves the project from the domain, waits, and prints the
score card.

```bash
index365 scan https://yoursite.com --yes
```

- **There is one product, so there is nothing to choose.** Marketing Signal is the
  default and the only startable product. Do not pass a legacy `--product` value to
  start a run: the API rejects it with 400 `legacy_product_not_creatable`. Completed
  legacy runs stay readable, so `report` and `findings` can still open them.
- **Waiting is the default.** The command blocks until the score lands and renders
  the score card plus top findings. No polling, no ids to track.
- **`--yes` is for agents and CI.** A new domain normally asks one [Y/n] before
  creating the project and spending credits; `--yes` answers it. Non-interactive
  shells never prompt: without `--yes` a new domain exits 2 with the `--yes` command
  in the `next:` hint.
- **A scan spends one Page Check (10 credits).** To make a retry safe (network blip,
  agent re-entry),
  pass a stable `--idempotency-key`; a repeat with the same key returns the same run
  instead of double-spending.

## Async (CI, long queues)

```bash
index365 scan yoursite.com --yes --no-wait   # queue it
index365 check                               # is it done yet?
```

`check` with no argument checks your most recent scan; `check yoursite.com` checks
that site's. When it completes, `index365 report` and `index365 findings` read it
with no ids.

## Local pre-deploy scan is retired

`index365 scan local` is retired: submitted HTML cannot verify the registered page,
so the result could not be trusted. Run a live scan against the deployed URL
instead. Do not offer a local pre-deploy gate.

## After the scan

The score card already answers "what's my score". For findings, hand off to
**index365-read-report**; to compare against previous scans,
`index365 results yoursite.com` shows that site's score over time. A `--json` scan
response carries a `resolved` block naming the run it created, but downstream
commands do not need it: they default to the latest run.