CLI Command Reference
Run the CLI with npx @getstackrun/cli. Interactive use signs in through OAuth. Fleet workers set STACK_AGENT_ID and use their local agent key. STACK_API_KEY remains an operator credential for account administration.
npx @getstackrun/cli auth login
npx @getstackrun/cli quickstart
npx @getstackrun/cli --helpAccount and operation
auth login | auth status | auth logout | me
usage [--period today|yesterday|7d|30d|month|last-month|billing]
usage [--since <ISO> --until <ISO>]
quickstart | register
monitor [--follow|--sandbox|--challenge|--demo] [--loop] [--agent <id>|--jti <jti>]
proxy serve --agent <name|id> [--port 8788] [--provider anthropic|openai|openrouter] [--host 127.0.0.1]Agents, Passports, and Missions
agent list | show | register | update | enroll | rotate | sign-claim
agent suspend | unsuspend | unblock | delete
passport list | issue | delegate | verify | refresh | report
passport revoke | revoke-agent | revoke-session | revoke-all
missions open | complete | revoke | get | list | replay | dossiers | dossierfleet list [--page <number>] [--limit <number>]
fleet get <id> Read one fleet policy and its shared usage
fleet membership <agent> Read the fleet policy an agent belongs to
fleet activate --file <path> --idempotency-key <key>
Request approval for a fleet policy
fleet revise <id> --file <path> --expected-revision <number> --idempotency-key <key>
Request approval for a policy change
fleet revoke <id> Revoke a fleet policy
fleet members <id> [--page <number>] [--limit <number>]
fleet revoke-member <id> <agent> Revoke one agent's fleet membership
fleet enrollment-challenge <id> Request an enrollment challenge
fleet enroll <id> --file <path> Enroll with a public key and signed challenge
fleet enroll-local <id> --name <name> --idempotency-key <key>
Create and store an agent key on this machine, then enroll it
fleet enroll-workload-local <id> --name <name> --idempotency-key <key>
Enroll using a trusted workload token from STACK_WORKLOAD_TOKEN
fleet session [--fleet-policy-id <id>]
Create a short-lived MCP session
mission start --file <path> Start a Mission under a fleet policy
mission start --agent <agt_id> --intent-summary "..." [--services a,b] [--expires-in N] [--ttl N]
Open a Mission for an agent and issue its Passport
mission open --intent-summary "..." --agent <agt_id> [--services a,b]
Open a Mission before issuing its Passport
mission open --file <path> Open a Mission from a JSON request
mission renew <id> Renew the Passport for an existing Mission
passport issue --agent <name|id> --mission <ms_id> --intent "..." [--services a,b] [--ttl N]
Issue a Passport for one live Mission
Every Passport is issued for exactly one live Mission, so passport issue requires --mission. Completing or revoking a Mission revokes every Passport bound to it.
passport delegate accepts --scopes-file for exact connection scopes, or --services to select services from the parent Passport. The parent token is read from stdin or a hidden prompt.
Intents, detectors, and PII
intents simulate | submit | submit-and-wait | pending | get | approve | reject
detector list | show | enable | disable | configure | reset
pii show | set | reset
event list | show | resolveIntent approve and reject are human governance commands. Do not run them from an agent process. Some Bearer governance changes require approval in the Console before retry.
Services, Drop-offs, and Skills
service catalog | connections | show | verify | disconnect | credential
service templates | connect-custom | grant | revoke-agent | permissions
dropoff list | show | create | deposit | collect | expire
skill list | mine | show | publish | invoke | suspend | activate
skill requests | post-request | favorites | invocations | check-invocation | complete
skill check-trust | matches | suggest | allow | disallow
skill pending-reviews | approve | rejectskill pending-reviews, skill approve, and skill reject require platform-staff access.
Audit and evidence
audit list | export | chain-head | verify-chain
evidence-pack export | list | get
identity settings | update-settings | providers | claims | revoke-claim
team list | invite | update | revokeidentity send-code is retired and returns an error. Use notifications methods send-code for notification destination verification. Start identity-claim verification in the Console.
LLM, inbound, and notifications
llm usage list | llm usage summary
llm anthropic messages | llm openai chat-completions | llm openrouter chat-completions
inbound-webhook create | list | get | revoke
notifications methods list | add | test | send-code | verify | delete
notifications rules list | create | update | delete
scan <content> | scan usagePartner tenants
partner tenant create | list | get | revoke
partner tenant webhook | issue-passportPartner commands require a partner operator. They manage isolated tenant operators. They do not manage the partner's own service connections.
Global behavior
- --json emits the raw API response where the command supports it.
- STACK_OAUTH_SCOPE sets the exact scope requested by auth login. The default covers routine runtime and inspection work; sensitive management scopes are opt-in, and an existing refresh-token family cannot be widened.
- STACK_API_URL points the CLI at a non-production API.
- Never put STACK_API_KEY directly on the command line. Shell history can retain it.