CLI Reference

Vigo has two CLI binaries:

vigo -- the Rust agent that runs on managed machines. See Agent CLI for daemon, register, bootstrap, run, status, traits, and version commands. The agent binary also houses the read-only vigo swarm diagnostic verbs (status / seeds {list,show} / peers list) for envoy-side substrate inspection, the vigo swarm gitback recovery CLI for inspecting and recovering personal-DR git mirrors, the vigo swarm lockbox CLI for managing lockbox — the per-user encrypted P2P directory, the vigo swarm puddle CLI for managing puddle — the per-user puddle identity primitive, the vigo swarm curator CLI for publishing + consuming artifacts in the curator P2P artifact registry, and the vigo swarm poolq CLI for posting + consuming messages on the poolq P2P ordered-log queue.
vigocli -- the admin CLI that talks to the server's REST API (documented below).

vigocli

vigocli communicates with the server's REST API to manage enrollment, envoys, operations, orchestration, secrets, and spanner.

Global Flags

Flag	Default	Description
`--server`	`https://localhost:8443`	Base URL for the Vigo REST API
`--ca-file`	`$VIGO_CA_FILE`, else `/srv/vigo/tls/ca`	CA bundle that verifies the server's TLS certificate. A loopback `--server` (`localhost`, `127.0.0.1`, `::1`) is always verified against it, and vigocli refuses to connect if it can't read it. For any other `--server` the system roots are used unless you name a CA here.
`--insecure`	`false`	Skip TLS certificate verification entirely. Your API token goes to whatever answers `--server`, so use it only when you have no copy of the CA.
`--yes`	`false`	Skip the confirmation prompt on destructive commands (revoke, delete, purge, rollback, restore, drain, …). Required for non-interactive use — without a TTY and without `--yes`, a destructive command errors loudly instead of silently doing nothing.

Commands

Top-level commands, grouped by area. Several commands are subcommands of a group (e.g. vigocli security audit, vigocli traits inventory); the detail pages are linked under their parent.

Enrollment & fleet

Command	Description
approved	Manage approved enrollment patterns
tokens	Generate one-time enrollment tokens
envoys	Inspect + manage enrolled envoys — `list`, `show`, `preview`, `push`, `revert`, `revoke`, `delete`, `purge`, `rebootstrap`, `maintenance`
runs	View convergence run history

Config

Command	Description
config	Publish, inspect, and manage `.vgo` config — `publish`, `edit`, `validate`, `trace`, `tree`, `history`, `rollback`, `promote`, `freeze`, `search`, `stacks`, `server.yaml`
test	Run config tests against expected outcomes

Traits & inventory

Command	Description
traits	Search + explore trait dot-paths — `inventory`, `livequery`, `search`

Operations

Command	Description
task	Dispatch + monitor ad-hoc commands on envoys
workflow	Run + monitor multi-step workflows
scrier	Remote access — user mappings and interactive sessions
ask	Ask the AI assistant about your fleet

Security & compliance

Command	Description
security	Security posture — `audit`, `cve`, `risk`
compliance	Compliance — `report`, `export`, `remediation`, `bundles`, `provisions`

Server administration

Command	Description
doctor	Server health checks (config, TLS, secrets, DB, spanner)
secrets	Manage AES-256-GCM encrypted secrets
webusers	Manage web UI + API user accounts
auth	Manage this CLI's auth token
backup	Create + restore full server backups
server	Peer replication — promote to primary, check status
db	Inspect + maintain the SQLite database
spanner	Federated control-plane operations
sandgorgon	Bare-metal lifecycle — commission, provision, decommission
`completion`	Generate shell completion scripts (bash, zsh, fish, powershell)

Swarm

vigocli swarm views the envoy P2P substrate and each content subsystem's fleet state.

Command	Description
swarm	Substrate-level view of the envoy P2P network (status + peers)
swarm filecast	Admin-pushed file distribution on the substrate
swarm gitback	Fleet-wide read-only view of gitback projects
swarm longdrawer	Fleet view of the longdrawer per-user directory sync
swarm lockbox	Fleet view of the lockbox per-user encrypted directory sync
swarm puddle	Puddle fleet view + cross-envoy ops (eviction, names)
swarm curator	Fleet view of the curator artifact registry + admin block (ADR-024)
swarm poolq	Fleet view of the poolq ordered-log queue + admin block (ADR-029)