AgentTrust Docs

Overview

The agentrust CLI provides onboarding, status checks, policy management, audit inspection, and queue operations.

Why It Matters

Operators use the CLI for day-to-day governance administration without writing code.

Prerequisites

pip install agentrust-py

Entry point: agentrust = "agentrust_sdk.cli:main"

Step-by-Step Guide

Commands

Command	Purpose	Tier
`agentrust init`	Onboard — cloud auth, or `--local` for an offline key	—
`agentrust whoami`	Auth identity, tier, and the full capability matrix	—
`agentrust status`	Config file locations and whether `AGENTRUST_KEY` is set	—
`agentrust policy sync`	Pull policy packs from the control plane	Team+
`agentrust policy push <file>`	Publish a policy pack version	Team+
`agentrust policy list`	List locally cached policy packs	—
`agentrust policy pack list \| bundle \| install \| export`	Offline policy-pack management for air-gapped installs	—
`agentrust audit tail`	Last 20 executions from the local SQLite ledgers	Free+
`agentrust queue status`	Count of buffered validations	—
`agentrust queue replay`	Drain the queue buffer to the gateway	—
`agentrust certify run`	Run Trust Certify against `certify.yaml`	Free+
`agentrust certify corrections`	Continuous-learning correction queue	Team+
`agentrust export [file]`	Export local audit records to JSONL	—
`agentrust purge --confirm`	Delete the local SQLite databases	—
`agentrust disable`	Print kill-switch / rollback instructions	—
`agentrust uninstall`	Export + purge local data, optionally hard-delete gateway data	—
`agentrust upgrade`	Open the upgrade page	—

agentrust status reports config, not connectivity — it prints the global and project config paths, the resolved tier, and whether AGENTRUST_KEY is set. It does not contact the gateway. To test reachability, curl $AGENTRUST_GATEWAY_URL/health.

agentrust uninstall removes local databases and, with --delete-from-gateway, irreversibly purges gateway records. It does not delete ~/.agentrust/config.yaml — remove that by hand if you want the API key gone.

Examples

# Onboard
agentrust init
agentrust init --local

# Identity and config (status does NOT contact the gateway)
agentrust status
agentrust whoami
curl "$AGENTRUST_GATEWAY_URL/health"    # reachability

# Audit
agentrust audit tail
agentrust export ./audit.jsonl

# Queue (air-gap)
agentrust queue status
agentrust queue replay

# Cleanup
agentrust purge --confirm

# Rollback instructions
agentrust disable

Best Practices

Run agentrust whoami after changing keys to confirm the tier the SDK resolved
Use export before purge to back up audit data
Use init --local for air-gapped environments
agentrust uninstall requires --confirm; add --export-to backup.jsonl to snapshot first

Common Mistakes

Running purge without --confirm (safety guard)
Expecting audit tail to show remote gateway records — it reads only ~/.agentrust/audit.db and ~/.agentrust/embedded.db
Expecting agentrust status to prove the gateway is reachable

Troubleshooting

Issue	Fix
Command not found	Reinstall `agentrust-py`; check PATH
Init fails offline	Use `--local` flag

CLI Reference