@agentlattice/cli

Command-line interface for AgentLattice agent governance. Wraps every agent API endpoint into shell commands, so any language, any deploy script, any CI pipeline can enforce governance without writing SDK code.

al gate deploy.production && kubectl apply -f deploy.yaml

If the action is denied, the pipeline stops. That's it.

Install

npm install -g @agentlattice/cli

Requires Node.js 18+.

Authentication

All credentials are environment variables. No flags, no config files, nothing in shell history.

# Agent API key (most commands)
export AL_API_KEY=al_key_...

# Service key (register command only)
export AL_SERVICE_KEY=al_svc_...

# API base URL (optional, defaults to https://www.agentlattice.io)
export AL_BASE_URL=https://www.agentlattice.io

Commands

al execute <action>

Submit an action for governance evaluation. Returns immediately.

al execute deploy.production
al execute data.export --metadata '{"env":"staging"}'
al execute deploy.production --dry-run

| Flag | Description | |------|-------------| | --metadata <json> | Action metadata (JSON object) | | --data-accessed <json> | Data accessed (JSON array) | | --event-id <uuid> | Idempotency event ID | | --dry-run | Check policy without executing |

Exit codes: 0 = executed/submitted, 1 = denied/error.

al gate <action>

Submit an action and block until approval is resolved. Use this in CI/CD pipelines.

al gate deploy.production --timeout 5m && kubectl apply -f deploy.yaml
al gate data.export --timeout 1h

| Flag | Description | |------|-------------| | --timeout <duration> | Timeout (e.g., 5m, 1h, 300s). Default: 30m | | --metadata <json> | Action metadata (JSON object) | | --data-accessed <json> | Data accessed (JSON array) | | --event-id <uuid> | Idempotency event ID | | --dry-run | Check policy without executing |

Exit codes: 0 = approved, 1 = denied, 2 = timeout, 130 = interrupted (Ctrl+C).

al whoami

Show agent identity, policies, and circuit breaker state.

al whoami
al whoami --json

al status

Show circuit breaker state, calibration progress, and 24h anomaly count.

al status

al policies

List governance policies.

al policies
al policies --scope org

| Flag | Description | |------|-------------| | --scope <scope> | own (default) or org |

al test <action>

Dry-run policy check. No audit trail created. Use to validate policies during development.

al test deploy.production
al test data.export --json

Exit codes: 0 = allowed, 1 = denied/no policy.

al audit

View audit trail.

al audit
al audit --limit 10 --action-type deploy.production
al audit --cursor abc123

| Flag | Description | |------|-------------| | --limit <n> | Number of events (default: 50) | | --cursor <id> | Pagination cursor | | --action-type <type> | Filter by action type |

al verify

Verify audit hash chain integrity.

al verify

Exit codes: 0 = chain valid, 1 = chain broken.

al posture

Show governance posture score (0-100) with component breakdown.

al posture

al report

Report action outcome back to AgentLattice.

al report --audit-event-id abc-123 --status success --message "Deployed v2.1"
al report --audit-event-id abc-123 --status failure --message "Rollback triggered"

| Flag | Description | |------|-------------| | --audit-event-id <uuid> | Audit event ID (required) | | --status <status> | success, failure, or partial (required) | | --message <text> | Outcome message |

al delegate

Create an ephemeral sub-agent delegation.

al delegate --name "deploy-bot" --scope "deploy.staging,deploy.canary" --ttl 1h

| Flag | Description | |------|-------------| | --name <name> | Sub-agent name (required) | | --scope <capabilities> | Comma-separated capabilities (required) | | --ttl <duration> | Time to live (default: 1h) |

al delegations

List delegations.

al delegations
al delegations --role parent --active

| Flag | Description | |------|-------------| | --role <role> | Filter: parent or child | | --active | Show only active delegations |

al revoke <delegation-id>

Revoke a delegation.

al revoke abc-123-def

al export

Export all active policies for your workspace as a YAML manifest. Use this to promote policies across environments. Requires AL_SERVICE_KEY.

al export --file policies/dev.yaml
al export --format json --file policies.json

| Flag | Description | |------|-------------| | --file <path> | Write manifest to file (default: stdout) | | --format <format> | yaml (default) or json |

al import

Import a policy manifest into your workspace. Policies in the manifest are created or updated. By default, policies not in the manifest are left unchanged. Requires AL_SERVICE_KEY.

al import --file policies/dev.yaml
al import --file policies/dev.yaml --dry-run
al import --file policies/dev.yaml --replace
al export | al import  # pipe directly

| Flag | Description | |------|-------------| | --file <path> | Read manifest from file (default: stdin) | | --dry-run | Preview changes without writing | | --replace | Full sync mode: deactivate policies absent from the manifest |

Exit codes: 0 = success, 1 = error (invalid manifest, auth failure, compile error).

al register

Register a new agent. Requires AL_SERVICE_KEY (not AL_API_KEY).

al register --name "deploy-agent" --description "Handles production deployments"

| Flag | Description | |------|-------------| | --name <name> | Agent name (required) | | --description <text> | Agent description |

al version

Show CLI version.

al version

al install-skill [skill]

Install an AgentLattice Claude Code skill into your AI coding assistant.

al install-skill              # install the instrument skill (default)
al install-skill instrument   # same, explicit
al install-skill --list       # list available skills

The /instrument skill instruments AI agents with AgentLattice governance from inside Claude Code. It works with CrewAI, AutoGen, LangChain JS, LlamaIndex, and raw SDK patterns that al-instrument and al-instrument-ts do not cover.

| Flag | Description | |------|-------------| | --env <env> | Target environment: claude (default: auto-detect) | | --list | List available skills | | --dest <dir> | Custom install directory |

After installing, open Claude Code in any agent project and run /instrument.

Global Flags

| Flag | Description | |------|-------------| | --json | Machine-readable JSON output | | --no-color | Disable colored output | | --verbose | Print request URL, method, status, timing |

Exit Codes

| Code | Meaning | |------|---------| | 0 | Success / action allowed / action submitted | | 1 | Action denied / error / auth failure | | 2 | Timeout (gate only) | | 130 | Interrupted (SIGINT/Ctrl+C during gate) |

CI/CD Example

# GitHub Actions
- name: Gate deployment
  env:
    AL_API_KEY: ${{ secrets.AL_API_KEY }}
  run: |
    npx @agentlattice/cli gate deploy.production --timeout 5m
    kubectl apply -f deploy.yaml

License

MIT