CLI reference
Every command the exeora binary takes, and the flags worth knowing.
Everything below connect is something connect already does for you. They exist because a script sometimes wants one step without the others.
| Command | What it does |
|---|---|
connect [path] | Sign in, register and serve, skipping whatever is already done |
login / logout | Sign in through the browser, or forget the session on this machine |
device register / device list | Register this machine by hand, or list your machines |
project add [path] | Register a directory without connecting |
project list / project remove <slug> | Manage this machine's projects |
init [path] | Write an exeora.toml restricting what agents may do in a directory |
status | Show registration, gateway and projects |
logs | Recent tool calls: what ran, which client asked, and how it ended |
sync | Reconcile this machine's registration and projects with the dashboard |
connect
A few flags for the cases it cannot guess:
| Flag | What it does |
|---|---|
--slug | Name the project in its URL |
--name | Name the machine, when registering it |
--no-add | Serve what is already registered, without adding this directory |
--reset | Register the machine again, after revoking it from the dashboard |
init
Interactive by default. Pass --yes to take the flags as given and ask nothing, and --force to replace a file that already exists.
exeora init --yes --mode allow_list --allow "npm,git *" --deny "sudo,rm *"
--tools takes the same comma-separated form. See what a project allows for what the values mean.
Machine-readable output
--json makes status, logs, device list and project list print one JSON document instead of drawing on the terminal. Errors become JSON on stderr with a non-zero exit, so a caller piping stdout into a parser gets either valid JSON or nothing.
exeora logs --json | jq '.[] | select(.status == "error")'
status carries accountMcpUrl alongside each project's own mcpUrl, on both the signed-in and signed-out shapes, so a script can find the URL that covers every project without having to build it.
On connect, which never finishes, it prints one JSON object per line as things happen, which is what a supervisor or a log collector can read as it arrives. In that mode there is nobody at the terminal, so confirmations go to the dashboard instead.
Where things are stored
The refresh token goes to the OS keychain. Machines with no secret service, which is most Linux servers and CI containers, get a 0600 file under $XDG_CONFIG_HOME/exeora/ instead, and the CLI says so when it happens. Everything else is plain JSON; exeora status prints the path.
EXEORA_GATEWAY_URL points the CLI at a different gateway, which is only useful when working on Exeora itself. It wins over the stored value without overwriting it.