Flags and Traces

unbound flags lists terminal commands that a tool policy flagged and PII or secrets that a data security guardrail found. unbound trace shows everything recorded for one trace ID. Listing requires Admin, Manager or Analytics Viewer. Marking a false positive requires Admin.

Terminal runs

unbound flags terminal
unbound flags terminal --action block,warn --time-window SEVEN_DAYS
unbound flags terminal mark-fp 81234 --risk-score 8 --comment "Our build script"

Flag	Filters by
`--action <actions>`	`block`, `approval`, `warn`, `audit`. Default all four
`--policy <ids>`	Tool policy IDs
`--trace <trace-id>`	One trace ID
`--tool <types>`	AI tool, e.g. `CLAUDE_CODE,CURSOR`
`--family <families>`	Command family

mark-fp takes the run’s ID and its Risk value, 1 to 10. It saves the same feedback as rejecting a risk score in the dashboard, and the run’s Feedback column then reads False positive.

Data security

unbound flags data-security
unbound flags data-security --guardrail Secrets --findings false-positive
unbound flags data-security mark-fp 5521

Flag	Filters by
`--guardrail <names>`	Guardrail names or IDs, e.g. `PII,Secrets`
`--action <actions>`	`block`, `redact`, `route`, `audit`
`--findings <which>`	`real` (default), `false-positive`, `all`. With `--trace` the default is `all`
`--trace <trace-id>`	One trace ID
`--reveal`	Show detected values and prompts

Each row is one detection. mark-fp takes its Action ID, and the gateway then skips that value for your whole organization, as Mark as False Positive does in Data Security.

The CLI masks detected values in the table and in --json. --reveal prints them in clear text.

Both list commands also take --page (10 rows per page), --json, --wide, and the time flags from Analytics.

Look up a trace ID

unbound trace 3f2a6c1e-8b7d-4e2f-9a1c-5d6e7f8a9b0c
unbound trace 3f2a6c1e-8b7d-4e2f-9a1c-5d6e7f8a9b0c --json

The trace ID is the UUID a user sees under a blocked or warned action. trace searches Logs, Terminal Runs (last 3 months) and Data Security (last 3 months, false positives included). Prompts and detected values stay hidden unless you pass --reveal. It exits 1 if a source fails, for example because your role can’t read it, or matches more than 10 pages. The other sources still print.

Requires CLI 1.16.21 or later.

Getting Started

CLI

Policies

Analytics

Hooks API

Integrations

MDM Integrations

Connections

Support & Troubleshooting

Terminal runs

Data security

Look up a trace ID

​Terminal runs

​Data security

​Look up a trace ID

Terminal runs

Data security

Look up a trace ID