> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrqen.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI reference

> Every myrqen command, flag, and exit code.

```
myrqen [--json] [--session <id>] <command> [options]
```

Derived from `apps/cli/src/index.ts`. Add `--json` to any command for machine-readable
output — this is what an agent should always do. Add `--session <id>` to act on a specific
local report instead of the current one.

```bash theme={null}
myrqen --help
myrqen --version
```

## Global options

| Option           | Effect                                                            |
| ---------------- | ----------------------------------------------------------------- |
| `--json`         | Emit machine-readable JSON for agent consumption.                 |
| `--session <id>` | Act on a specific local report id instead of the current session. |

## Exit codes

| Code | Meaning                                                       |
| ---- | ------------------------------------------------------------- |
| `0`  | Success.                                                      |
| `1`  | Any other failure. The message says what.                     |
| `2`  | The finding submission was rejected. The output explains why. |
| `3`  | Out of scope, or not authorized.                              |
| `4`  | The planned action is prohibited.                             |

## Effort shortcuts

```bash theme={null}
myrqen low
myrqen high
myrqen xhigh
myrqen ultra
myrqen auto
```

Each is equivalent to `session start --effort <effort>` and takes the same flags:

| Flag                        | Effect                                            |
| --------------------------- | ------------------------------------------------- |
| `--sync yes\|no\|ask`       | Answer the sync question up front. Default `ask`. |
| `--workspace <id>`          | Bind this repository to an explicit workspace.    |
| `--agent <name>`            | Host agent name.                                  |
| `--agent-version <version>` | Host agent version.                               |
| `--model <model>`           | Host model identifier.                            |

See [Effort modes](/concepts/effort-modes).

## `session`

```bash theme={null}
myrqen session start [--effort <effort>] [--sync <mode>] [--workspace <id>] \
                     [--agent <name>] [--agent-version <v>] [--model <model>]
myrqen session context
myrqen session sync-decision <yes|no>
myrqen session agent [--name <name>] [--agent-version <v>] [--model <model>]
myrqen session static-pass
myrqen session finish
myrqen session cancel
```

| Command         | Purpose                                                                                               |
| --------------- | ----------------------------------------------------------------------------------------------------- |
| `start`         | Start a session and print the context the host agent must work inside. `--effort` defaults to `auto`. |
| `context`       | Re-read the current session context.                                                                  |
| `sync-decision` | Record the user's answer to the sync question for this scan.                                          |
| `agent`         | Record host agent and model metadata after the fact.                                                  |
| `static-pass`   | Re-run the built-in static analysis pass and submit its candidates.                                   |
| `finish`        | Validate findings, write local report formats, and sync if this scan opted in.                        |
| `cancel`        | Finish early and keep whatever was validated so far.                                                  |

## `phase`

```bash theme={null}
myrqen phase start <phase>
myrqen phase complete <phase>
```

Valid phases: `preflight`, `scope`, `discovery`, `source_review`, `runtime_validation`,
`access_control`, `validation`, `reporting`. An unknown phase is an error naming the valid
set.

## `target`

```bash theme={null}
myrqen target authorize <url> [--grant]
myrqen target check <url>
myrqen target redirect <from> <to>
```

| Command     | Purpose                                                                                                          |
| ----------- | ---------------------------------------------------------------------------------------------------------------- |
| `authorize` | Authorize one exact external origin. `--grant` asserts that the user has explicitly confirmed this exact origin. |
| `check`     | Ask whether a target is already in scope.                                                                        |
| `redirect`  | Decide whether a redirect may be followed.                                                                       |

Exit code `3` on denial. See
[Authorization and safety](/concepts/authorization-and-safety).

## `action check`

```bash theme={null}
myrqen action check --intent <intent> [--description <text>] [--method <method>] \
                    [--target <target>] [--repeat <count>] [--disposable]
```

`--intent` is required and should be short and machine-readable, such as
`read_order_as_other_identity`. `--repeat` feeds mass-mutation detection. `--disposable`
declares the target a machine-local disposable fixture.

Exit code `4` when the action is prohibited.

## `finding`

```bash theme={null}
echo '<json>' | myrqen finding submit
myrqen finding submit --file finding.json
myrqen finding verify <findingId> --description "<text>" [--kind <kind>] [--location "<where>"]
myrqen finding refute <findingId> --reason "<text>"
```

| Command  | Notes                                                                                                                   |
| -------- | ----------------------------------------------------------------------------------------------------------------------- |
| `submit` | JSON on stdin, or `--file <path>`. Exit code `2` on rejection.                                                          |
| `verify` | `--description` is required. `--kind` is one of `runtime` (default), `identity_differential`, `configuration`, `other`. |
| `refute` | `--reason` is required: what was tried and what happened instead.                                                       |

See [Finding schema](/reference/finding-schema).

## `note`

```bash theme={null}
myrqen note coverage "<text>" [--area "<area>"]
myrqen note limitation "<text>" [--area "<area>"]
```

`coverage` records something that was assessed; `limitation` records something that was not
or could not be assessed.

## `metrics token`

```bash theme={null}
myrqen metrics token --source <exact|estimated|unavailable> [--count <n>] [--estimator <name>]
```

`--source` is required. Use `estimated` with an `--estimator` name and version, or
`unavailable` when the host cannot report usage. Never state an exact count that did not
come from the host.

## `fix`

```bash theme={null}
myrqen fix prompt <findingId>
myrqen fix record <findingId> --applied [--files a,b] [--note "<text>"]
myrqen fix record <findingId> --verified
myrqen fix record <findingId> --verification-failed
myrqen fix record <findingId> --reverted
```

`fix record` requires exactly one of `--applied`, `--verified`, `--verification-failed`, or
`--reverted`. See [Fix and retest](/guides/fix-and-retest).

## Account and device

```bash theme={null}
myrqen link [--url <url>] [--device-name <name>] [--no-open] [--skip-skill-install]
myrqen login                 # alias for link
myrqen install               # install or update the Agent Skill only
myrqen status                # account, device, and quota state
myrqen logout                # remove the local device credential
myrqen config set-url <url>  # set the API base URL
myrqen skill path            # where the portable skill bundle lives
myrqen doctor                # what this machine and agent setup can assess
```

<Warning>
  `logout` is confirmation-gated, so in a non-interactive shell it reports "Left unchanged"
  and removes nothing. Run it in a real terminal.
</Warning>

## Project and reports

```bash theme={null}
myrqen workspace [--set <workspaceId>] [--detach]
myrqen reports
myrqen sync <localReportId>
```

| Command     | Purpose                                                                  |
| ----------- | ------------------------------------------------------------------------ |
| `workspace` | Show or change the workspace binding for this repository.                |
| `reports`   | List local reports and their cloud state.                                |
| `sync`      | Sync an existing local report after rechecking login, device, and quota. |

`workspace --set` and `workspace --detach` are also confirmation-gated.

## `update`

```bash theme={null}
myrqen update [--apply] [--pin <version>] [--unpin] [--channel <stable|beta|canary>]
```

Verifies and stages a signed update. `--apply` downloads and verifies the artifact.
Clients verify the ed25519 signature against a pinned public key, check the artifact digest
and size, and refuse downgrades, stale manifests, and revoked versions before anything is
written to disk.

## Related

<CardGroup cols={2}>
  <Card title="Environment variables" icon="gear" href="/reference/environment-variables">
    Every variable the CLI, the web app, and the worker read.
  </Card>

  <Card title="Error codes" icon="triangle-exclamation" href="/reference/error-codes">
    Stable API error codes and their HTTP statuses.
  </Card>
</CardGroup>