Skip to main content
The core CLI commands, with exact flag spellings. The task-oriented pages explain when to use these; this page is the lookup. The oacb family has its own page — see OACB. All long flags take two dashes. -o, -y, -m and -c are the only short flags in the CLI.

​
Global

Binaries are unbound and unbound-cli — the same program. Requires Node 18 or later.

​
Account

Omit --api-key on login and a browser opens instead. That flow times out after 120 seconds, so pass --api-key on a headless machine.

​
Health

doctor exits non-zero when a tool is tampered, your API key is invalid, or CLAUDE_CONFIG_DIR is set-but-empty or points somewhere other than your install. The last two fail the run with every tool healthy — see Doctor.

​
Setup

Tool names. cursor, copilot, augment, pi, claude-code, claude-code-subscription, claude-code-gateway, gemini-cli, codex, codex-subscription, codex-gateway, roo-code, cline, kilo-code, custom-access. Constraints. --subscription and --gateway are mutually exclusive and apply only to Claude Code and Codex. --all cannot be combined with explicit tool names. Scope follows privileges — there is no scope flag; run under sudo for org-wide.
unbound setup needs Python 3 on your PATH. Without it, setup exits with Python 3 not found. Instruction-only tools — roo-code, cline, kilo-code, custom-access — don’t need it.

​
Policies

--user and --group are booleans; <id> is a required positional. --group treats the id as a user-group id, --user is the default. There is also a raw-config pair, unbound policy create and unbound policy update <id>, taking --name, --type <COST|SECURITY> and --config <json> (all three required on create) plus --scope-groups <ids>, --scope-tools <types>, --priority <n> and --enabled / --no-enabled. Prefer the type-specific commands below — the CLI’s own help says so.

​
Cost and security

--guardrail, --route and --error-route are repeatable. policy security update does not accept the create-time type flags — guardrail and routing changes go through --config '<json>'.

​
Tool policies

Both create commands require a mode. Pass --prompt for AI assist or --no-ai for raw flags; with neither the command exits 2. --field is repeatable and ANDed. --action is one of AUDIT, BLOCK, WARN, REQUIRE_SLACK_APPROVAL, and BLOCK or WARN always requires --custom-message.

​
Users and groups

--user-ids takes numeric ids, as shown in the ID column of unbound users list. A non-numeric value is silently dropped rather than rejected, so the member simply doesn’t get added.unbound tools connect <TOOL_TYPE> prints the newly generated API key in plaintext. Redact it before pasting that output anywhere.

​
Analytics and exports

Datasets: terminal, mcp-actions, unsanctioned, mcp-servers. Shared flags: --time-window · --start / --end · --tool · --user · --risk · --policy · --format <table\|json\|csv> · --json · -o · --limit · --offset · --wide. Per-dataset flags — this is the part that surprises people: Passing one where it isn’t accepted fails with unknown option. Limits. --limit defaults to 20, caps at 100 for a table and 1,000 for JSON, and over the cap the command exits rather than clamping. -o requires --format json or --format csv. Custom date ranges must be used in pairs and span 90 days or less. Exports cap at 25,000 rows and are kept for 6 hours. Both need Admin or Analytics Viewer.

​
Chat

No flags starts an interactive session. --json, -o and -c each require a non-empty -m. -c takes the conversation_id from a previous reply. Messages cap at 4,000 characters. Needs Admin, Analytics Viewer or Manager.

​
Discovery

On Linux use systemctl --user status unbound-scheduled.timer, or on systems with no systemd user session (WSL2, containers, headless) the crontab fallback crontab -l | grep 'ai.getunbound.scheduled'; on Windows Get-ScheduledTask -TaskName "ai.getunbound.scheduled".

​
Configuration

Settings live in ~/.unbound. The directory and the files holding credentials are created readable by your account only. These are the CLI’s own files. The discovery scan and the installed hooks keep their state in the same directory — see Discovery. unbound logout removes api_key, email and org_name and keeps the URLs. unbound nuke deletes config.json and tears down the scheduled scan and the key it runs with (scheduled-creds.json on Linux, Keychain / Credential Manager elsewhere); identity.json and update-check.json are left in place.
If you clone or image a machine, delete identity.json first — otherwise every clone reports as the same device.
The CLI checks for a newer version at most once a day and tells you on stderr if there is one. It never blocks the command you ran, it does not run in CI, and UNBOUND_NO_UPDATE_CHECK turns it off everywhere. Crash reporting is off. The CLI reports its own crashes only if you set UNBOUND_CLI_SENTRY_DSN yourself; nothing in the CLI sets it, and while it is unset nothing is sent. Where you do turn it on, API keys, key-shaped tokens, your home directory, your username and your hostname are all stripped before anything leaves the machine, and UNBOUND_TELEMETRY=0 turns it off again.

​
Environment variables

The three URL variables override anything in the config file, silently. If a command reaches the wrong host after you ran unbound config urls, check these first — a stale export from an earlier shell shadows the file. unbound config show prints what’s actually in effect.

​
Exit codes

unbound oacb subcommands exit 1 on failure; see OACB. The direct installers unbound setup calls also use 3, but there it means the device is MDM-managed and the install was skipped. unbound setup reports that as a skip rather than passing the code through.