@moonwatch/cli

Command-line interface for Moonwatch — query logs and manage watchers from the terminal. Built to be agent- and script-friendly: every command speaks --json, errors are machine-readable, and exit codes are meaningful.

Covers whoami, log files (list/create) + workspace keys + log queries, watchers (list/get/create/update), and monitoring (projects, dashboards, metrics, query, cards, data). Talks to the /v1 REST API exposed by the Moonwatch MCP service.

The binary is mw (the moonwatch name is taken by the ingestion CLI in @moonwatch/js — moonwatch log / moonwatch pipe / moonwatch event).

Install

npm install -g @moonwatch/cli
# or run without installing:
npx @moonwatch/cli logs files

Authentication

Provide a personal API key (mw_personal_..., create one at https://moonwatch.dev/app/api-keys). Resolved in this order:

1. --key <key> flag
2. MOONWATCH_PERSONAL_KEY environment variable
3. key field in ~/.config/moonwatch/config.json (or $XDG_CONFIG_HOME/moonwatch/config.json, or $MOONWATCH_CONFIG)

The API base URL defaults to https://mcp.moonwatch.dev/v1 and can be overridden with --api-url or MOONWATCH_API_URL (useful for local dev / self-hosting).

Usage

mw whoami                                              # workspaces + roles this key grants

mw logs files [--owned]
mw logs files create <name> --workspace <id> [--folder <id>]
mw logs key <logFileId>                                # workspace ingestion key (prints the bare key; --json for { key, name })
mw logs public-tokens list <logFileId>
mw logs public-tokens create <logFileId> --name "Production website" --origin https://example.com
mw logs public-tokens revoke <logFileId> <tokenId>
mw logs query <logFileId> "SELECT level, count(*) FROM logs.entries GROUP BY level"
mw logs query <logFileId> --file query.sql
echo "SELECT * FROM logs.entries WHERE level = 'ERROR' LIMIT 20" | mw logs query <logFileId>

mw watchers list [--log <logFileId>]
mw watchers get <id> [--no-ack]                         # detail; clears the new-data flag unless --no-ack
mw watchers create --title "..." --description "..." --log <logFileId>
mw watchers update <id> [--findings "..."] [--status active|resolved] [--status-summary "..."] [--title "..."] [--description "..."]

mw monitoring projects list
mw monitoring projects create <name> --workspace <id>
mw monitoring dashboards list --project <id>
mw monitoring dashboards create <name> --project <id>
mw monitoring metrics --project <id>
mw monitoring query <projectId> "SELECT name, count() FROM monitoring.events GROUP BY name"
mw monitoring cards list --dashboard <id>
mw monitoring cards get <id>
mw monitoring cards create --dashboard <id> --type graph|table|keyval --title "..." --config '<json>' [--width N]
mw monitoring cards update <id> [--title "..."] [--config '<json>'] [--w N] [--h N] [--x N] [--y N] [--type ...]
mw monitoring cards delete <id>
mw monitoring data delete --project <id> --name <name> --type poll|event|snapshot

logs query runs read-only SQL (SELECT / SHOW / DESCRIBE) against the logs.entries table; tenant and log scoping are injected server-side, so don't add tenant_id / log_id filters yourself. IDs may be given with or without their display prefix (log-, watcher-).

Output

Human-formatted tables on a TTY; JSON when piped or with --json.

Exit codes

| Code | Meaning | |------|---------| | 0 | Success | | 1 | API/server error or unexpected failure | | 2 | Bad usage or missing configuration | | 3 | Authentication failed (401/403) | | 4 | Rate limited (429) |

Development

npm install            # from the monorepo root
npm run build -w @moonwatch/cli
node cli/dist/index.js --help
# or: npm run dev -w @moonwatch/cli -- logs files