CLI Command Reference
Run the published CLI with npx @getstackrun/cli. Interactive use signs in through OAuth. Set STACK_API_KEY only for CI or another headless environment. This page lists the canonical command names. Some handlers also accept short aliases.
npx @getstackrun/cli auth login
npx @getstackrun/cli quickstart
npx @getstackrun/cli --helpAccount and operation
auth login | auth status | auth logout | me
usage [--period today|yesterday|7d|30d|month|last-month|billing]
usage [--since <ISO> --until <ISO>]
quickstart | register
monitor [--follow|--sandbox|--challenge|--demo] [--loop] [--agent <id>|--jti <jti>]
proxy serve --agent <name|id> [--port 8788] [--provider anthropic|openai|openrouter] [--host 127.0.0.1]Agents, Passports, and Missions
agent list | show | register | update | enroll | rotate | sign-claim
agent suspend | unsuspend | unblock | delete
passport list | issue | delegate | verify | refresh | report
passport revoke | revoke-agent | revoke-session | revoke-all
missions open | complete | revoke | get | list | replay | dossiers | dossierIntents, detectors, and PII
intents simulate | submit | submit-and-wait | pending | get | approve | reject
detector list | show | enable | disable | configure | reset
pii show | set | reset
event list | show | resolveIntent approve and reject are human governance commands. Do not run them from an agent process. Some Bearer governance changes require approval in the Console before retry.
Services, Drop-offs, and Skills
service catalog | connections | show | verify | disconnect | credential
service templates | connect-custom | grant | revoke-agent | permissions
dropoff list | show | create | deposit | collect | expire
skill list | mine | show | publish | invoke | suspend | activate
skill requests | post-request | favorites | invocations | check-invocation | complete
skill check-trust | matches | suggest | allow | disallow
skill pending-reviews | approve | rejectskill pending-reviews, skill approve, and skill reject require platform-staff access.
Audit and evidence
audit list | export | chain-head | verify-chain
evidence-pack export | list | get
identity settings | update-settings | providers | claims | revoke-claim
team list | invite | update | revokeidentity send-code is retired and returns an error. Use notifications methods send-code for notification destination verification. Start identity-claim verification in the Console.
LLM, inbound, and notifications
llm usage list | llm usage summary
llm anthropic messages | llm openai chat-completions | llm openrouter chat-completions
inbound-webhook create | list | get | revoke
notifications methods list | add | test | send-code | verify | delete
notifications rules list | create | update | delete
scan <content> | scan usagePartner tenants
partner tenant create | list | get | revoke
partner tenant webhook | issue-passportPartner commands require a partner operator. They manage isolated tenant operators. They do not manage the partner's own service connections.
Global behavior
- --json emits the raw API response where the command supports it.
- STACK_OAUTH_SCOPE sets the exact scope requested by auth login. The default covers routine runtime and inspection work; sensitive management scopes are opt-in, and an existing refresh-token family cannot be widened.
- STACK_API_URL points the CLI at a non-production API.
- Never put STACK_API_KEY directly on the command line. Shell history can retain it.