Flip CLI

Incident root-cause analysis for SREs and on-call engineers. You point it at your observability stack, you ask a question in plain English, it digs through your logs, metrics and traces and tells you what is actually going on.

Why this exists

Most on-call work is the same five minutes repeated until something clicks: tail the logs, eyeball a dashboard, jump to a trace, scroll back, try another query. Flip CLI runs that loop for you. You stay in the terminal, you describe the symptom, and the agent goes and looks. When it needs you (an ambiguous service name, a confirmation before a wide query) it asks. When it is done, it lays out what it found and the evidence behind it.

Install

The CLI runs on Node.js (>=22) or Bun (>=1.2). Install with whichever package manager you already use:

npm install -g @flip-ai/cli
# or
bun add -g @flip-ai/cli
# or
pnpm add -g @flip-ai/cli

Verify:

flip-cli --version

The runtime is selected automatically based on how you installed the CLI — there's nothing to configure. There's also no install-time script, so nothing is blocked by Bun's untrusted-package policy or --ignore-scripts.

Platforms: macOS, Linux, Windows (Windows needs Node ≥22 or Bun on PATH).

First run

flip-cli auth <your-api-key>   # grab a key from https://cli.flip.ai
flip-cli                       # launches the TUI

From the TUI, run /connect to wire up a backend (Datadog or Splunk), pick which data types you want enabled (logs, metrics, traces), and paste your credentials. They are stored in an encrypted vault on your machine — the master key sits in your OS keychain.

Once a connection is live, Flip will spend a moment auto-discovering your services, metrics and log fields. After that you can ask questions.

> something is wrong with checkout-service in prod, latency spiked 20 minutes ago

What you can ask it

It is fine to be vague. Some real-world prompts that work well:

• "5xx rate just doubled on api-gateway, what changed?"
• "trace one slow request through the order pipeline"
• "compare error logs on payment-service between now and an hour ago"
• "any anomaly in the redis-prod metric set in the last 30 min?"
• "correlate cpu on web-1, web-2, web-3 with the error spike on auth"

You can interrupt it at any point with Esc, queue follow-ups while it is still working, and it will ask you back when it needs a decision.

Useful keys (inside the TUI)

| Key | Does | |---|---| | Enter | Send | | Esc | Cancel the running step / clear input | | ↑ ↓ | Walk through your input history | | Ctrl+R | Search history | | / | Slash-command menu | | Tab | Accept completion | | Ctrl+C | Quit |

Multi-line paste works (bracketed paste). Logs, stack traces, config blobs — paste them in.

Slash commands

| Command | What it does | |---|---| | /connect | Add a Datadog or Splunk connection | | /disconnect | Remove a connection | | /discovery | Re-scan the connected backend for services, metrics, log fields | | /status | Connection health at a glance | | /edit-knowledge | Write down what the model should know about your stack (per connection) | | /memory | Long-lived notes the model carries across sessions | | /resume | Reopen a past conversation | | /clear | Start a new conversation | | /export | Export the current conversation | | /theme | Switch the color scheme | | /settings | Auto-update toggle, release channel, "check now" | | /about | Version, runtime, platform | | /help | List all commands | | /exit | Quit |

Auto-update

The CLI checks npm for a newer version once a day and updates itself in the background. You will see a one-line notice (flip-cli updated 0.2.3 -> 0.2.4. Restart to pick up the new build.) on the next launch when it has done so.

To turn it off, run /settings → "Disable auto-update". You can also flip between the latest and next (prerelease) channels there, or force an immediate check.

If you would rather drive updates yourself: npm install -g @flip-ai/cli@latest.

Knowing what version you have

flip-cli --version          # one-line, prints version + git hash + build time
flip-cli -v                 # same

Inside the TUI: /about.

Configuration

Most users never need to touch this. If you do, config lives at ~/.flip-ai/config.json. Examples:

{
  "ui":      { "theme": "dark" },
  "logging": { "level": "info" },
  "update":  { "autoUpdate": true, "channel": "latest", "checkIntervalHours": 24 }
}

Secrets (API keys, vendor creds) never live here — they sit in an AES-256-GCM vault under ~/.flip-ai/secrets/, with the master key in your OS keychain.

Troubleshooting

No API key found — run flip-cli auth <key>. Grab one at https://cli.flip.ai.

API key invalid — your key is wrong or expired. Re-run flip-cli auth <key> with a fresh one.

Connection looks stale / discovery is missing services — run /discovery to re-scan, or /status to inspect health.

Auto-update didn't fire / restart didn't pick it up — open /settings and "Check for update now". The updater uses the same package manager you installed with; if it can't update in place it tells you the exact command to run manually.

License

Proprietary. Copyright (c) 2026 Flip Technology Corporation. All rights reserved. See LICENSE.