CLI reference

myrqen [--json] [--session <id>] <command> [options]

Derived from apps/cli/src/index.ts. Add --json to any command for machine-readable output — this is what an agent should always do. Add --session <id> to act on a specific local report instead of the current one.

myrqen --help
myrqen --version

Global options

Option	Effect
`--json`	Emit machine-readable JSON for agent consumption.
`--session <id>`	Act on a specific local report id instead of the current session.

Exit codes

Code	Meaning
`0`	Success.
`1`	Any other failure. The message says what.
`2`	The finding submission was rejected. The output explains why.
`3`	Out of scope, or not authorized.
`4`	The planned action is prohibited.

Effort shortcuts

myrqen low
myrqen high
myrqen xhigh
myrqen ultra
myrqen auto

Each is equivalent to session start --effort <effort> and takes the same flags:

Flag	Effect
`--sync yes\|no\|ask`	Answer the sync question up front. Default `ask`.
`--workspace <id>`	Bind this repository to an explicit workspace.
`--agent <name>`	Host agent name.
`--agent-version <version>`	Host agent version.
`--model <model>`	Host model identifier.

See Effort modes.

`session`

myrqen session start [--effort <effort>] [--sync <mode>] [--workspace <id>] \
                     [--agent <name>] [--agent-version <v>] [--model <model>]
myrqen session context
myrqen session sync-decision <yes|no>
myrqen session agent [--name <name>] [--agent-version <v>] [--model <model>]
myrqen session static-pass
myrqen session finish
myrqen session cancel

Command	Purpose
`start`	Start a session and print the context the host agent must work inside. `--effort` defaults to `auto`.
`context`	Re-read the current session context.
`sync-decision`	Record the user’s answer to the sync question for this scan.
`agent`	Record host agent and model metadata after the fact.
`static-pass`	Re-run the built-in static analysis pass and submit its candidates.
`finish`	Validate findings, write local report formats, and sync if this scan opted in.
`cancel`	Finish early and keep whatever was validated so far.

`phase`

myrqen phase start <phase>
myrqen phase complete <phase>

Valid phases: preflight, scope, discovery, source_review, runtime_validation, access_control, validation, reporting. An unknown phase is an error naming the valid set.

`target`

myrqen target authorize <url> [--grant]
myrqen target check <url>
myrqen target redirect <from> <to>

Command	Purpose
`authorize`	Authorize one exact external origin. `--grant` asserts that the user has explicitly confirmed this exact origin.
`check`	Ask whether a target is already in scope.
`redirect`	Decide whether a redirect may be followed.

Exit code 3 on denial. See Authorization and safety.

`action check`

myrqen action check --intent <intent> [--description <text>] [--method <method>] \
                    [--target <target>] [--repeat <count>] [--disposable]

--intent is required and should be short and machine-readable, such as read_order_as_other_identity. --repeat feeds mass-mutation detection. --disposable declares the target a machine-local disposable fixture. Exit code 4 when the action is prohibited.

`finding`

echo '<json>' | myrqen finding submit
myrqen finding submit --file finding.json
myrqen finding verify <findingId> --description "<text>" [--kind <kind>] [--location "<where>"]
myrqen finding refute <findingId> --reason "<text>"

Command	Notes
`submit`	JSON on stdin, or `--file <path>`. Exit code `2` on rejection.
`verify`	`--description` is required. `--kind` is one of `runtime` (default), `identity_differential`, `configuration`, `other`.
`refute`	`--reason` is required: what was tried and what happened instead.

See Finding schema.

`note`

myrqen note coverage "<text>" [--area "<area>"]
myrqen note limitation "<text>" [--area "<area>"]

coverage records something that was assessed; limitation records something that was not or could not be assessed.

`metrics token`

myrqen metrics token --source <exact|estimated|unavailable> [--count <n>] [--estimator <name>]

--source is required. Use estimated with an --estimator name and version, or unavailable when the host cannot report usage. Never state an exact count that did not come from the host.

`fix`

myrqen fix prompt <findingId>
myrqen fix record <findingId> --applied [--files a,b] [--note "<text>"]
myrqen fix record <findingId> --verified
myrqen fix record <findingId> --verification-failed
myrqen fix record <findingId> --reverted

fix record requires exactly one of --applied, --verified, --verification-failed, or --reverted. See Fix and retest.

Account and device

myrqen link [--url <url>] [--device-name <name>] [--no-open] [--skip-skill-install]
myrqen login                 # alias for link
myrqen install               # install or update the Agent Skill only
myrqen status                # account, device, and quota state
myrqen logout                # remove the local device credential
myrqen config set-url <url>  # set the API base URL
myrqen skill path            # where the portable skill bundle lives
myrqen doctor                # what this machine and agent setup can assess

logout is confirmation-gated, so in a non-interactive shell it reports “Left unchanged” and removes nothing. Run it in a real terminal.

Project and reports

myrqen workspace [--set <workspaceId>] [--detach]
myrqen reports
myrqen sync <localReportId>

Command	Purpose
`workspace`	Show or change the workspace binding for this repository.
`reports`	List local reports and their cloud state.
`sync`	Sync an existing local report after rechecking login, device, and quota.

workspace --set and workspace --detach are also confirmation-gated.

`update`

myrqen update [--apply] [--pin <version>] [--unpin] [--channel <stable|beta|canary>]

Verifies and stages a signed update. --apply downloads and verifies the artifact. Clients verify the ed25519 signature against a pinned public key, check the artifact digest and size, and refuse downgrades, stale manifests, and revoked versions before anything is written to disk.

Environment variables

Every variable the CLI, the web app, and the worker read.

Error codes

Stable API error codes and their HTTP statuses.

Getting started

Core concepts

Guides

Reference

Troubleshooting

Global options

Exit codes

Effort shortcuts

`session`

`phase`

`target`

`action check`

`finding`

`note`

`metrics token`

`fix`

Account and device

Project and reports

`update`

Environment variables

Error codes

​Global options

​Exit codes

​Effort shortcuts

​session

​phase

​target

​action check

​finding

​note

​metrics token

​fix

​Account and device

​Project and reports

​update

​Related

Environment variables

Error codes

Global options

Exit codes

Effort shortcuts

`session`

`phase`

`target`

`action check`

`finding`

`note`

`metrics token`

`fix`

Account and device

Project and reports

`update`

Related