CLI reference

All 16 `veefore` commands, their options and examples.

The CLI and veefore <command> --help read from the same command specs, so this page and your terminal can never disagree.

Non-interactive use

Prompts fall back to defaults when stdin is not a TTY, and the secret prompt refuses to run at all. In CI, supply VEEFORE_EMAIL, VEEFORE_PASSWORD and, where MFA is enabled, VEEFORE_MFA_CODE as environment variables.

#Commands

Command	Does
`veefore init`	Set up this project with Veefore. Also runs as plain `veefore`.
`veefore scan`	Preview what setup would find, without changing anything.
`veefore integrate`	Wrap your registered tools in guard() so Veefore decides every call.
`veefore undo`	Restore the files the last `veefore integrate` changed.
`veefore remove`	Take Veefore out of this project: guard() from the code, then disconnect.
`veefore dev`	Watch decisions live while you build.
`veefore doctor`	Audit the security posture of this setup.
`veefore status`	Show the current environment, mode and agent health.
`veefore test`	Verify enforcement works, without performing any action.
`veefore agents`	Inspect and control the agent fleet.
`veefore policies`	List, test and deploy policies.
`veefore logs`	Read or stream the decision log.
`veefore audit`	Query, verify and export the audit trail.
`veefore deploy`	Promote the environment to enforcement.
`veefore login`	Sign in through your browser and store a session token.
`veefore logout`	Sign out of Veefore on this machine.

#veefore init

Set up this project with Veefore. Also runs as plain veefore.

bash
veefore init [options]

Connects to hosted Veefore, or to the self-hosted Veefore named with --control-plane (remembered afterwards), signs you in through the browser, scans the project locally (framework, tools, the hosts they call, the credentials they read — names only, never values), shows what it will set up and asks once. It then creates an agent with a key pair generated on this machine, registers each tool with its own capability and authorizes it for this agent, adds a starter policy in OBSERVE mode, writes veefore.config.json and .env.local, and validates the connection. The private key is written to .env.local only and is never sent, printed or recoverable.

Option	Meaning
`--force`	Replace an existing veefore.config.json.
`--new-agent`	Create a separate agent even if one with this name exists. By default the existing agent is reused with a new key, so its delegations and limits keep applying.
`--control-plane <url>`	Self-hosted Veefore address. Needed once; remembered after.
`--gateway <url>`	Gateway base URL that agents will call.
`--organization <id>`	Skip the organization prompt.
`--workspace <id>`	Skip the workspace prompt.
`--environment <id>`	Skip the environment prompt.
`--name <name>`	Agent display name.
`--capability <key>`	Grant a capability. Repeatable.
`--skip-policy`	Do not create a starter policy.
`--skip-code`	Do not offer to change your code; run `veefore integrate` later.
`--approval-mode <wait\|throw>`	When approval is required, guarded tools wait for the decision (default) or return at once.

bash
veefore init
veefore init --name finance-agent --capability refund.create

#veefore scan

Preview what setup would find, without changing anything.

bash
veefore scan [--json]

Scans the project locally and lists its framework, tools, the external hosts each tool calls and the credentials the code reads. Reads source files only: .env files and other hidden files are never opened, and secret values are never read. Needs no sign-in.

Option	Meaning
`--json`	Machine-readable scan and the setup plan it implies.

#veefore integrate

Wrap your registered tools in guard() so Veefore decides every call.

bash
veefore integrate [--dry-run] [--check] [--assist=manual|own|veefore|off] [--yes]

Finds each tool registered for this agent in your code and wraps its function in guard() (TypeScript/JavaScript) or adds @guard above it (Python). Your function bodies are not edited. Shows a diff and asks before writing, backs up every file it changes, then runs your TypeScript compiler (--noEmit), node --check or a Python syntax check; if a check newly fails, every file is restored automatically. For tools it will not change on its own, you choose: make the change yourself from exact instructions, use AI with your own Anthropic or OpenAI key (code goes only to that provider), or use Veefore AI if enabled. Before anything is sent, secrets are replaced with placeholders and you see what goes where and must agree; an AI change is accepted only if it keeps every line of your code and adds nothing but the guard, and you still review the diff.

Option	Meaning
`--dry-run`	Show the diff and write nothing.
`--check`	Report which registered tools are guarded in the code. Exits 1 if any are not.
`--assist=<how>`	manual (default when not interactive), own, veefore, or off.
`--yes`	Apply without asking.

bash
veefore integrate --dry-run
veefore integrate --assist=manual
ANTHROPIC_API_KEY=… veefore integrate --assist=own
veefore integrate --check

#veefore undo

Restore the files the last veefore integrate changed.

bash
veefore undo [--force]

Restores each file from the backup taken before the last rewrite. A file you edited afterwards is left alone and listed, unless --force is given.

Option	Meaning
`--force`	Restore files even if they were edited after the rewrite.

#veefore remove

Take Veefore out of this project: guard() from the code, then disconnect.

bash
veefore remove [--dry-run] [--keep-agent]

Offers to revoke the agent in Veefore if it is still active, removes every guard() this CLI added (showing the diff, asking once, backing up and rolling back if your checks fail), then deletes veefore.config.json and the Veefore block in .env.local, including the private key. Edits you made after setup are kept. veefore offers this automatically when the agent was revoked in the console.

Option	Meaning
`--dry-run`	Show what would change and write nothing.
`--keep-agent`	Do not offer to revoke the agent in Veefore.

bash
veefore remove --dry-run
veefore remove

#veefore dev

Watch decisions live while you build.

bash
veefore dev [--all]

Confirms the gateway is reachable, reports the enforcement mode, then streams every decision for this agent with the next concrete step for each outcome.

Option	Meaning
`--all`	Stream decisions for every agent in the environment.

#veefore doctor

Audit the security posture of this setup.

bash
veefore doctor [--strict]

Checks authentication, MFA, TLS, local secret permissions, identity and passport validity, gateway health, dangerous tools, network restrictions, policy coverage, production data access, MCP transport and authorization, audit chain integrity, credential rotation, and SDK version alignment.

Option	Meaning
`--strict`	Exit non-zero on warnings as well as failures.

#veefore status

Show the current environment, mode and agent health.

bash
veefore status

Prints the active organization, workspace and environment, the enforcement mode, the agent lifecycle state, gateway health, and the last few decisions.

#veefore test

Verify enforcement works, without performing any action.

bash
veefore test [--tool <key>]

Runs a dry-run probe across every tool this agent is authorized for, checks that policy test cases pass, and fails if a dangerous tool is permitted only by the default decision. Suitable as a CI gate.

Option	Meaning
`--tool <key>`	Probe a single tool.

#veefore agents

Inspect and control the agent fleet.

bash
veefore agents <list|show|pause|resume|suspend|revoke|rotate-key> [agentId]

Lifecycle control. revoke is irreversible for the identity and shows the full blast radius before asking for confirmation. rotate-key issues a new key pair and invalidates every outstanding session for that agent.

Option	Meaning
`--all`	List across the whole organization, not just this environment.
`--status <status>`	Filter by lifecycle status.
`--reason "<text>"`	Reason recorded in the audit trail.

bash
veefore agents list
veefore agents revoke agt_01ABC --reason "Key suspected compromised"

#veefore policies

List, test and deploy policies.

bash
veefore policies <list|show|test|deploy|diff> [policyId]

test runs the recorded test cases. deploy activates a version and refuses to do so while any test case fails; it requires a reason and step-up authentication.

Option	Meaning
`--version <n>`	Version to deploy, for `deploy`.
`--from <n> --to <n>`	Versions to compare, for `diff`.
`--reason "<text>"`	Reason recorded in the audit trail.

bash
veefore policies list
veefore policies test
veefore policies deploy pol_01ABC

#veefore logs

Read or stream the decision log.

bash
veefore logs [--follow] [--decision <d>] [--limit <n>]

Every line is a server-side decision with the policy and rule that produced it.

Option	Meaning
`--follow, -f`	Stream new decisions as they happen.
`--decision <d>`	Filter by decision, e.g. BLOCK.
`--agent <id>`	Filter by agent.
`--all`	Include every agent in the environment.
`--limit <n>`	Number of recent decisions to show.

#veefore audit

Query, verify and export the audit trail.

bash
veefore audit <list|show|verify|export> [eventId]

verify re-checks the hash chain and exits non-zero if it is broken. export returns a JSON or CSV file together with a content hash an auditor can use to prove the file is unaltered.

Option	Meaning
`--severity <s>`	Filter by severity.
`--type <t>`	Filter by event type.
`--from <iso> --to <iso>`	Time range.
`--format <json\|csv>`	Export format.
`--reason "<text>"`	Why this export is being taken. Recorded in the audit trail.
`--out <file>`	Write the export to a file (mode 0600).

bash
veefore audit verify
veefore audit export --format csv --reason "Quarterly SOC 2 evidence" --out audit.csv

#veefore deploy

Promote the environment to enforcement.

bash
veefore deploy [--mode ENFORCE|SIMULATE|OBSERVE]

Runs preflight checks, replays recent observed traffic to show exactly what starts being refused, then requires confirmation, a reason and step-up authentication. Reducing enforcement always requires a reason and is recorded as a CRITICAL audit event.

Option	Meaning
`--mode <mode>`	Target mode. Defaults to ENFORCE.
`--reason "<text>"`	Reason recorded in the audit trail.
`--skip-preflight`	Incident use only. Recorded in the audit reason.

bash
veefore login [--device] [--password] [--control-plane <url>]

Opens the console in your browser, where you sign in (or create an account) and approve this terminal. The terminal never sees your password. Over SSH, or with --device, it prints a link and a code to enter in any browser instead. Only the resulting session token is stored, in ~/.veefore/credentials.json at mode 0600, and the session can be revoked from your profile. In CI, set VEEFORE_EMAIL and VEEFORE_PASSWORD.

Option	Meaning
`--device`	Show a link and a code instead of opening a browser here.
`--password`	Type email and password in the terminal instead of using the browser.

#veefore logout

Sign out of Veefore on this machine.

bash
veefore logout [--all]

Ends the session on the server and deletes the stored token. Signing out of the console with "Also sign out of the Veefore CLI" ticked does the same for every terminal you approved; the next command here then says you were signed out and asks you to sign in again.

Option	Meaning
`--all`	Sign out of every control plane this machine is signed in to.

CLI reference

#Commands

#veefore init

#veefore scan

#veefore integrate

#veefore undo

#veefore remove

#veefore dev

#veefore doctor

#veefore status

#veefore test

#veefore agents

#veefore policies

#veefore logs

#veefore audit

#veefore deploy

#veefore login

#veefore logout