CLI tools

nebbos is the command-line client. Everything the REST and MCP surfaces do, the CLI does too — scriptable from a shell, pipeable from any pipeline, testable in CI.

Install

macOS · Homebrew


brew install nebbos-ai/tap/nebbos

Linux · pipx


pipx install nebbos-cli

The command surface

Every command carries the same three-tier gate as the REST and MCP surfaces. A Guest identity can run read commands. Writes step the terminal up through the biometric ceremony on your device, and (for Host+) prompt for the Cradle.

Command families mirror the REST endpoint categories:


nebbos identity ...       # session lifecycle, tier stepping
nebbos pearl ...          # per-department reasoning
nebbos task ...           # operational tracker
nebbos signal ...         # cross-domain risk
nebbos audit ...          # hash-chained audit log
nebbos admin ...          # substrate mutation (Architect only)

Each family self-describes via nebbos <family> --help.

Scripting patterns

Every command supports --json and prints to stdout in a shape that jq reads. Combined with nebbos audit list --since 5m --json, a shell one-liner can walk the last five minutes of chain activity for the calling operator — the receipt an inspector would produce, but scriptable:


nebbos audit list --since 5m --json \
  | jq -r '.events[] | "\(.tool)\t\(.tier)\t\(.outcome)"'

Non-interactive CI use. Set the Bearer token in the environment (NEBBOS_TOKEN). Read operations run headless. Higher-tier write operations refuse under CI unless the operator identity has been provisioned as a service account with the matching tier — ordinary user identities do not escalate without the biometric + Cradle ceremony on the operator’s physical device.

Common one-liners


# Check my current tier and the departments I can see
nebbos identity whoami
 
# List every audit event from the last hour, tab-separated
nebbos audit list --since 1h --json \
  | jq -r '.events[] | [.ts, .operator, .tool, .outcome] | @tsv'
 
# Verify a chain segment (proves this operator's activity end-to-end)
nebbos audit verify --from evt_01H8Y... --to evt_01H8Z...
 
# Export my operator scope (portability bundle)
nebbos export --output ./my-nebbos-export.tar.gz