CLI reference
View as Markdowninsecur is experimental and prelaunch. There is no public sign-up yet, and the hosted service is not approved for valuable production secrets. Local Mode runs the development loop with no account.
CLI overview
insecur CLI — metadata-only output, sealed local session auth
Install with curl -fsSL https://insecur.cloud/install.sh | sh (see Installation).
Product commands support --json for metadata-only machine-readable output and exit with a
stable exit code. Failures carry stable
error codes with remediation commands in --json output. Secret
values are never accepted as command-line arguments and never appear in any output. insecur guide
is the intentional exception to JSON output: it emits offline Markdown playbooks.
Commands
| Command | Description |
|---|---|
insecur agent |
Agent harness attribution and child sessions |
insecur approvals |
Metadata-only approval request status |
insecur audit |
Audit event feed and export verification |
insecur config |
Local CLI configuration |
insecur connections |
Manage org-scoped App Connections (metadata only) |
insecur describe |
Describe the CLI command contract as metadata |
insecur envs |
Environment navigation and creation |
insecur guide |
Offline CLI guides (markdown playbooks, no auth required) |
insecur import |
Import secrets from a local dotenv file into a development environment (create-only; all-or-nothing preflight) |
insecur init |
Provision guided organization defaults and write .insecur.json |
insecur local-files |
Local plaintext secret file utilities (metadata-only; no secure erasure) |
insecur login |
Authenticate with WorkOS AuthKit PKCE and mint a short-lived CLI credential |
insecur logout |
End the CLI session locally and revoke the server session |
insecur operations |
Poll, wait on, and cancel long-running operations |
insecur orgs |
Organization navigation |
insecur projects |
Project navigation and creation |
insecur run |
Run a command with runtime injection from a CLI profile policy or one exact variable key |
insecur run-policies |
Manage Runtime Injection Policies (metadata only) |
insecur scan |
Offline project-scoped secret exposure report (metadata only) |
insecur secrets |
Blind secret writes and metadata-only management |
insecur shell |
Start a subshell with INSECUR_SESSION_TOKEN in the environment |
insecur whoami |
Report acting human, session validity, resolved context, and attribution tier |
Global flags
These flags are accepted globally. --json does not change insecur guide, which always emits offline Markdown.
| Option | Description |
|---|---|
--host <url> |
insecur API host |
--org-id <id> |
organization opaque id |
--project-id <id> |
project opaque id |
--env-id <id> |
environment opaque id |
--profile <slug> |
CLI profile slug |
--profile-id <id> |
CLI profile opaque id |
--config-dir <path> |
directory containing .insecur.json |
--agent <name> |
agent attribution tag (Tier 3) |
--json |
metadata-only JSON output |
--quiet |
suppress non-essential human output |
--verbose |
verbose logging |
--color |
force colored human output |
--no-color |
disable colored human output |
--full |
show full opaque ids in tables instead of truncating |
--no-crash-reports |
disable default-on sanitized CLI crash reporting for this command |
-V, --version |
output the version number |