Unbound CLI - Unbound Security

The Unbound CLI (unbound) lets you authenticate, configure AI coding tools, manage policies, inspect usage, and administer your organization — all without leaving the terminal.

Installation

Requires Node.js 18+.

npm install -g unbound-cli

On Linux installs where Node lives in a system path (e.g. the NodeSource apt package), npm install -g writes to a root-owned directory and needs sudo:

sudo npm install -g unbound-cli

With a user-scoped Node manager (nvm, fnm, volta) or a custom npm prefix, no sudo is required.

Verify:

unbound --version

Both unbound and unbound-cli are installed and point to the same binary. If unbound resolves to a different program, see CLI Path Conflicts. Credentials and URL settings are stored at ~/.unbound/config.json, created automatically on first login.

Commands at a glance

Command	What it does
`unbound login`	Authenticate via browser or API key
`unbound setup <tool>`	Configure an AI coding tool to route through Unbound
`unbound nuke`	Remove Unbound entirely — tools and credentials (run with `sudo` to also clear device-wide MDM config)
`unbound policy <type>`	Create, list, and manage policies
`unbound users list`	List organization members
`unbound user-groups list`	List and manage user groups
`unbound tools list`	See connected AI tools
`unbound discover`	Scan this device for installed AI tools
`unbound chat`	Query usage data in natural language
`unbound status`	Check CLI config and API connectivity, your role, and connected tools
`unbound doctor`	Deep per-tool health check of your local install
`unbound config <subcommand>`	View or change the gateway / frontend / backend URLs without re-logging in (see Configuration below)

Use unbound <command> --help for flag details on any command.

Configuration

unbound config reads and writes the three URLs stored in ~/.unbound/config.json (gateway, frontend, backend) without forcing you to re-run unbound login. Useful for tenant / custom-domain installs, switching between staging and production, or recovering from a bad URL set.

Subcommand	What it does
`unbound config show`	Print the current gateway, frontend, and backend URLs (plus login state). Add `--json` for machine-readable output.
`unbound config urls <gateway> <frontend> <backend>`	Set all three URLs in one call. Positional order matters: gateway → frontend → backend.
`unbound config set-gateway-url <url>`	Update only the gateway URL (LLM proxy — what the SDK and tool hooks talk to).
`unbound config set-frontend-url <url>`	Update only the frontend URL (the dashboard / workspace UI).
`unbound config set-backend-url <url>`	Update only the backend URL (CLI API — auth, policy, usage queries).

Example — point the CLI at a tenant install without logging out. Positional order is gateway → frontend → backend, which is easy to mix up because the customer-facing dashboard is conventionally hosted at gateway.<domain> (the URL prefix gateway here refers to the dashboard host, while the gateway URL argument refers to the LLM proxy):

# Positional order: <gateway (LLM proxy)> <frontend (dashboard)> <backend (CLI API)>
unbound config urls https://api.acme.com https://gateway.acme.com https://backend.acme.com
unbound config show

See Tenant / Custom Domains for the full custom-domain setup, including passing the same URLs at login time.

Authentication

Tool Setup

Configure AI tools to route through Unbound

Policy Management

Create and manage all four policy types

Users & Groups

Manage members, user groups, and tool connections

Discovery

Scan devices for AI tools and schedule recurring scans

Chat

Query usage data with natural language