Unbound CLI

The Unbound CLI (unbound) lets you authenticate, configure AI coding tools, manage policies, inspect usage, and administer your organization — all without leaving the terminal.

Installation

Requires Node.js 18+.

npm install -g unbound-cli

On Linux installs where Node lives in a system path (e.g. the NodeSource apt package), npm install -g writes to a root-owned directory and needs sudo:

sudo npm install -g unbound-cli

With a user-scoped Node manager (nvm, fnm, volta) or a custom npm prefix, no sudo is required.

Verify:

unbound --version

Both unbound and unbound-cli are installed and point to the same binary. If unbound resolves to a different program, see CLI Path Conflicts. Credentials and URL settings are stored at ~/.unbound/config.json, created automatically on first login.

Commands at a glance

Command	What it does
`unbound login`	Authenticate via browser or API key
`unbound setup <tool>`	Configure an AI coding tool to route through Unbound
`unbound nuke`	Remove Unbound entirely — tools and credentials (run with `sudo` to also clear device-wide MDM config)
`unbound policy <type>`	Create, list, and manage policies
`unbound users list`	List organization members
`unbound user-groups list`	List and manage user groups
`unbound tools list`	See connected AI tools
`unbound discover`	Scan this device for installed AI tools
`unbound chat`	Query usage data in natural language
`unbound status`	Check CLI config and API connectivity, your role, and connected tools
`unbound doctor`	Deep per-tool health check of your local install
`unbound config <subcommand>`	View or change the gateway / frontend / backend URLs without re-logging in (see Configuration below)

Use unbound <command> --help for flag details on any command.

Configuration

unbound config reads and writes the three URLs stored in ~/.unbound/config.json (gateway, frontend, backend) without forcing you to re-run unbound login. Useful for tenant / custom-domain installs, switching between staging and production, or recovering from a bad URL set.

Subcommand	What it does
`unbound config show`	Print the current gateway, frontend, and backend URLs (plus login state). Add `--json` for machine-readable output.
`unbound config urls <gateway> <frontend> <backend>`	Set all three URLs in one call. Positional order matters: gateway → frontend → backend.
`unbound config set-gateway-url <url>`	Update only the gateway URL (LLM proxy — what the SDK and tool hooks talk to).
`unbound config set-frontend-url <url>`	Update only the frontend URL (the dashboard / workspace UI).
`unbound config set-backend-url <url>`	Update only the backend URL (CLI API — auth, policy, usage queries).

Example — point the CLI at a tenant install without logging out. Positional order is gateway → frontend → backend, which is easy to mix up because the customer-facing dashboard is conventionally hosted at gateway.<domain> (the URL prefix gateway here refers to the dashboard host, while the gateway URL argument refers to the LLM proxy):

# Positional order: <gateway (LLM proxy)> <frontend (dashboard)> <backend (CLI API)>
unbound config urls https://api.acme.com https://gateway.acme.com https://backend.acme.com
unbound config show

See Tenant / Custom Domains for the full custom-domain setup, including passing the same URLs at login time.

Authentication

Tool Setup

Configure AI tools to route through Unbound

Policy Management

Create and manage all four policy types

Users & Groups

Manage members, user groups, and tool connections

Discovery

Scan devices for AI tools and schedule recurring scans

Chat

Query usage data with natural language

Getting Started

CLI

Policies

Analytics

API Reference

Integrations

MDM Integrations

Connections

Support & Troubleshooting

Installation

Commands at a glance

Configuration

Authentication

Tool Setup

Policy Management

Users & Groups

Discovery

Chat

​Installation

​Commands at a glance

​Configuration

Authentication

Tool Setup

Policy Management

Users & Groups

Discovery

Chat

Installation

Commands at a glance

Configuration