CLI: Setup
Generated from deedglass help --json (CLI 0.1.0-dev). Global flags and exit codes are on the CLI reference page.
deedglass init
Section titled “deedglass init”Set up Deedglass in this directory.
deedglass init [--yes] [--dir .] [--client claude-code|claude-desktop|cursor|vscode|windsurf|sdk-python|sdk-typescript|none] [--listen 127.0.0.1:8080] [--pg-port 55432] [--no-open] [--no-smoke] [--stop] [--json]| Flag | Type | Default | What it does |
|---|---|---|---|
--client |
string | the agent client to connect: claude-code, claude-desktop, cursor, vscode, windsurf, sdk-python, sdk-typescript, none (claude-code, claude-desktop, cursor, vscode, windsurf, sdk-python, sdk-typescript, none) |
|
--dir |
string | . |
the directory to set up (.deedglass/ goes here) |
--listen |
string | 127.0.0.1:8080 |
where deedglass serve listens |
--no-open |
bool | don’t open the Console | |
--no-smoke |
bool | skip the three smoke actions | |
--owner-email |
string | you@localhost.test |
the local org’s owner |
--pg-port |
int | 55432 |
the local Postgres port (127.0.0.1) |
--postgres |
string | docker |
where Postgres runs: docker (docker) |
--project |
string | the Docker name prefix (default: from the directory) | |
--reset-secrets |
bool | replace the vault key and pepper (asks you to type reset; every API key stops working) | |
--smoke |
bool | run the smoke actions even when nothing changed | |
--stop |
bool | stop the local stack this directory runs (the data is kept) | |
--yes |
bool | don’t ask; run every step |
Add --json for machine-readable output.
deedglass doctor
Section titled “deedglass doctor”Check config, database and keys.
deedglass doctor [--only <ids>] [--json]| Flag | Type | Default | What it does |
|---|---|---|---|
--only |
string | run only these checks: ids or prefixes, like db.* or seal.key,clock.skew |
Add --json for machine-readable output.
deedglass scan
Section titled “deedglass scan”Show what your agent setup can change.
deedglass scan [--dir .] [--postgres-dsn-env VAR] [--format md,html,json,sarif] [--score] [--badge] [--share] [--ci] [--fail-under A|B|C|D] [--full [--no-seal]] [--json]| Flag | Type | Default | What it does |
|---|---|---|---|
--badge |
bool | write .deedglass/score.json (a shields.io endpoint) and print the README line | |
--ci |
bool | for CI: no user configs, no colour, no mark, never a prompt | |
--dir |
string | . |
the directory to scan |
--fail-under |
string | exit 1 when the grade is below this one: A, B, C or D (A, B, C, D) |
|
--format |
string | md,html |
report files to write: md, html, json, sarif (comma-separated) (md, html, json, sarif) |
--full |
bool | also write deedglass-full-report.html, the full scan report (Pro or the $29 report; checks the licence) | |
--max-files |
int | 20000 |
stop the file walk after this many files |
--no-seal |
bool | with –full: don’t seal the report on your Deedglass server | |
--no-write |
bool | print only; write no report files | |
--out-dir |
string | . |
where the report files go |
--postgres-dsn-env |
string | the environment variable holding a Postgres URL to check read-only (never a URL itself) | |
--score |
bool | print the score line, the small print and the deductions only | |
--share |
bool | print a share link that holds the grade, counts and finding ids only | |
--user-configs |
bool | true |
also read your user-level MCP client configs (Claude Desktop, Cursor, Windsurf) |
Add --json for machine-readable output.
deedglass serve
Section titled “deedglass serve”Run the API, the rules and the Console.
deedglass serve [--migrate]| Flag | Type | Default | What it does |
|---|---|---|---|
--migrate |
bool | dev only: apply pending migrations first (DEEDGLASS_MIGRATE_DATABASE_URL) |
Add --json for machine-readable output.
deedglass migrate up
Section titled “deedglass migrate up”Apply database migrations.
deedglass migrate up [--database-url <url>] [--dry-run] [--json]| Flag | Type | Default | What it does |
|---|---|---|---|
--database-url |
string | the migrator role’s Postgres URL (default DEEDGLASS_MIGRATE_DATABASE_URL) | |
--dry-run |
bool | show what would be applied, and apply nothing |
Add --json for machine-readable output.
deedglass migrate status
Section titled “deedglass migrate status”Show applied and pending migrations.
deedglass migrate status [--database-url <url>] [--json]| Flag | Type | Default | What it does |
|---|---|---|---|
--database-url |
string | the migrator role’s Postgres URL (default DEEDGLASS_MIGRATE_DATABASE_URL) |
Add --json for machine-readable output.
deedglass migrate verify
Section titled “deedglass migrate verify”Check applied migrations against this build.
deedglass migrate verify [--database-url <url>] [--json]| Flag | Type | Default | What it does |
|---|---|---|---|
--database-url |
string | the migrator role’s Postgres URL (default DEEDGLASS_MIGRATE_DATABASE_URL) |
Add --json for machine-readable output.
deedglass config print
Section titled “deedglass config print”Show the effective config, secrets hidden.
deedglass config print [--json]Add --json for machine-readable output.
deedglass version
Section titled “deedglass version”Show the client and server versions.
deedglass version [--json] [--check [--pre]]| Flag | Type | Default | What it does |
|---|---|---|---|
--check |
bool | ask GitHub’s releases API whether a newer version exists (opt-in; sends only a User-Agent) | |
--pre |
bool | with –check, count prereleases too | |
--q |
bool | no banner | |
--quiet |
bool | no banner |
Add --json for machine-readable output.
deedglass keys gen
Section titled “deedglass keys gen”Generate a seal key.
deedglass keys gen [--dir <dir>] [--purpose seal|licence] [--json]| Flag | Type | Default | What it does |
|---|---|---|---|
--dir |
string | directory for the key file (default .deedglass/keys) | |
--purpose |
string | seal |
seal (a deed seal key), licence (an lk_ key that signs licence tokens, never deeds) or packs (the key that signs the policy-packs index) |
Add --json for machine-readable output.
deedglass keys rotate
Section titled “deedglass keys rotate”Rotate the active seal key.
deedglass keys rotate [--overlap 5m] [--dir <dir>] [--json]| Flag | Type | Default | What it does |
|---|---|---|---|
--dir |
string | directory for the new key file (default: next to DEEDGLASS_SEAL_KEY_FILE, else .deedglass/keys) | |
--overlap |
duration | 5m0s |
how long the old key keeps sealing (1s to 168h) |
Add --json for machine-readable output.
deedglass keys list
Section titled “deedglass keys list”List seal keys.
deedglass keys list [--server <url>] [--json]Add --json for machine-readable output.
deedglass licence activate
Section titled “deedglass licence activate”Turn on Pro with the key from Dodo.
deedglass licence activate <key> [--json]Add --json for machine-readable output.
deedglass licence show
Section titled “deedglass licence show”Show this machine’s licence, offline.
deedglass licence show [--json]Add --json for machine-readable output.
deedglass licence refresh
Section titled “deedglass licence refresh”Check the licence with Dodo now.
deedglass licence refresh [--json]Add --json for machine-readable output.
deedglass licence deactivate
Section titled “deedglass licence deactivate”Remove the licence from this machine.
deedglass licence deactivate [--json]Add --json for machine-readable output.
deedglass vault status
Section titled “deedglass vault status”Show the credential vault’s keys.
deedglass vault status [--json]Add --json for machine-readable output.
deedglass vault rotate
Section titled “deedglass vault rotate”Re-encrypt credentials with a new key.
deedglass vault rotate [--json]Add --json for machine-readable output.
deedglass completion zsh
Section titled “deedglass completion zsh”Print zsh completion.
deedglass completion zshAdd --json for machine-readable output.
deedglass completion bash
Section titled “deedglass completion bash”Print bash completion.
deedglass completion bashAdd --json for machine-readable output.
deedglass completion fish
Section titled “deedglass completion fish”Print fish completion.
deedglass completion fishAdd --json for machine-readable output.