> ## Documentation Index > Fetch the complete documentation index at: https://docs.getunbound.ai/llms.txt > Use this file to discover all available pages before exploring further. # Command Reference > Every unbound command and flag, with defaults, constraints and exit codes Every command the CLI accepts, with exact flag spellings. The task-oriented pages explain *when* to use these; this page is the lookup. All long flags take **two** dashes. `-o`, `-y`, `-m` and `-c` are the only short flags in the CLI. ## Global ```bash theme={null} unbound [--version] [--help] [subcommand] [options] ``` Binaries are `unbound` and `unbound-cli` — the same program. Requires Node 18 or later. ## Account | Command | Flags | | ---------------- | ---------------------------------------------------------------------------------------------------------------- | | `unbound login` | `--api-key ` · `--gateway-url ` · `--frontend-url ` · `--backend-url ` · `--domain ` | | `unbound logout` | none — clears credentials, keeps your URL settings | | `unbound status` | `--json` | Omit `--api-key` on login and a browser opens instead. That flow times out after 120 seconds, so pass `--api-key` on a headless machine. ## Health | Command | Flags | | ---------------- | ------------------ | | `unbound doctor` | `--fix` · `--json` | `doctor` exits non-zero when a tool is tampered, your API key is invalid, **or** `CLAUDE_CONFIG_DIR` is set-but-empty or points somewhere other than your install. The last two fail the run **with every tool healthy** — see [Doctor](/cli/doctor). ## Setup | Command | Flags | | ------------------------------------ | --------------------------------------------------------------------------------------- | | `unbound setup [tools...]` | `--api-key ` · `--clear` · `--subscription` · `--gateway` · `--all` · `--backfill` | | `unbound nuke` *(alias `uninstall`)* | `-y, --yes` | | `unbound onboard` | `--api-key ` · `--domain ` · `--set-cron` · `--backfill` | | `unbound onboard unschedule` | none | **Tool names.** `cursor`, `copilot`, `augment`, `claude-code`, `claude-code-subscription`, `claude-code-gateway`, `gemini-cli`, `codex`, `codex-subscription`, `codex-gateway`, `roo-code`, `cline`, `kilo-code`, `custom-access`. **Constraints.** `--subscription` and `--gateway` are mutually exclusive and apply only to Claude Code and Codex. `--all` cannot be combined with explicit tool names. Scope follows privileges — there is no scope flag; run under `sudo` for org-wide. `unbound setup` runs a per-tool installer written in Python, so **Python 3 must be on your `PATH`**. Without it, setup exits with `Python 3 not found`. Instruction-only tools — `roo-code`, `cline`, `kilo-code`, `custom-access` — don't need it. ## Policies | Command | Flags | | ------------------------------- | ----------------------------------------------------------------------------- | | `unbound policy list` | `--type ` · `--enabled` · `--search ` · `--json` | | `unbound policy get ` | `--json` | | `unbound policy delete ` | `--yes` — **no `--json`** | | `unbound policy form-data` | `--json` | | `unbound policy effective ` | `--user` · `--group` · `--json` | `--user` and `--group` are **booleans**; `` is a required positional. `--group` treats the id as a user-group id, `--user` is the default. There is also a raw-config pair, `unbound policy create` and `unbound policy update `, taking `--name`, `--type ` and `--config ` (all three required on create) plus `--scope-groups `, `--scope-tools `, `--priority ` and `--enabled` / `--no-enabled`. Prefer the type-specific commands below — the CLI's own help says so. ### Cost and security | Command | Flags | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `policy cost create` | `--name` *(required)* · `--monthly-budget ` · `--group` · `--priority` · `--disabled` · `--config` · `--json` | | `policy cost update ` | as create, plus `--enabled` / `--disabled` | | `policy security create` | `--name` *(required)* · `--sub-type ` · `--guardrail ` · `--route-model` · `--route ` · `--error-route ` · `--group` · `--priority` · `--disabled` · `--config` · `--json` | | `policy security update ` | `--name` · `--group` · `--priority` · `--enabled` / `--disabled` · `--config` · `--json` | `--guardrail`, `--route` and `--error-route` are repeatable. **`policy security update` does not accept the create-time type flags** — guardrail and routing changes go through `--config ''`. ### Tool policies | Command | Flags | | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `policy tool list` | `--type ` · `--search` · `--page` · `--page-size` · `--all` · `--json` | | `policy tool get ` | `--json` | | `policy tool delete ` | `--yes` | | `policy tool create-terminal` | `--prompt ` **XOR** `--no-ai` · `--name` · `--command-family` · `--field ` · `--action` · `--description` · `--custom-message` · `--group` · `--disabled` · `--config` · `--yes` · `--json` | | `policy tool create-mcp` | `--prompt` **XOR** `--no-ai` · `--name` · `--mcp-server` · `--mcp-tool` **XOR** `--mcp-action-type` · `--action` · plus the same shared flags | | `policy tool update ` | `--name` · `--description` · `--action` · `--custom-message` · `--group` · `--enabled` / `--disabled` · type-specific match flags · `--config` · `--json` | | `policy tool families` | `--json` | | `policy tool mcp-servers` | `--json` | **Both create commands require a mode.** Pass `--prompt` for AI assist or `--no-ai` for raw flags; with neither the command exits `2`. `--field` is repeatable and ANDed. `--action` is one of `AUDIT`, `BLOCK`, `WARN`, `REQUIRE_SLACK_APPROVAL`, and **`BLOCK` or `WARN` always requires `--custom-message`**. ## Users and groups | Command | Flags | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | `unbound users list` | `--json` | | `unbound users effective-policies ` | `--json` | | `unbound user-groups list` *(alias `groups`)* | `--search ` · `--json` | | `unbound user-groups get ` | `--json` | | `unbound user-groups create` | `--name` *(required)* · `--all-org-users` / `--no-all-org-users` · `--user-ids ` — **no `--json`** | | `unbound user-groups update ` | same set — **no `--json`** | | `unbound user-groups delete ` | `--yes` — **no `--json`** | | `unbound user-groups effective-policies ` | `--json` | | `unbound tools list` | `--json` | | `unbound tools connect ` | `--json` | | `unbound tools approved` | `--json` | `--user-ids` takes **numeric** ids, as shown in the `ID` column of `unbound users list`. A non-numeric value is silently dropped rather than rejected, so the member simply doesn't get added. `unbound tools connect` prints the newly generated API key in plaintext. Redact it before pasting that output anywhere. ## Analytics and exports | Command | Flags | | -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | `unbound analytics tool-use ` | see below | | `unbound download kinds` | `--json` | | `unbound download start ` | `--last ` · `--start` · `--end` · `--search` · `--filter ` · `-o ` · `--check` · `--json` · `--no-wait` | | `unbound download get ` | `-o ` | Datasets: `terminal`, `mcp-actions`, `unsanctioned`, `mcp-servers`. Shared flags: `--time-window` · `--start` / `--end` · `--tool` · `--user` · `--risk` · `--policy` · `--format ` · `--json` · `-o` · `--limit` · `--offset` · `--wide`. Per-dataset flags — this is the part that surprises people: | Dataset | `--family` | `--server` | `--initiator` | | -------------- | :--------: | :--------: | :-----------: | | `terminal` | ✅ | — | ✅ | | `mcp-actions` | — | ✅ | ✅ | | `unsanctioned` | — | ✅ | — | | `mcp-servers` | — | ✅ | — | Passing one where it isn't accepted fails with `unknown option`. **Limits.** `--limit` defaults to 20, caps at 100 for a table and 1,000 for JSON, and **over the cap the command exits rather than clamping**. `-o` requires `--format json` or `--format csv`. Custom date ranges must be used in pairs and span 90 days or less. Exports cap at 25,000 rows and are kept for 6 hours. Both need **Admin or Analytics Viewer**. ## Chat | Command | Flags | | -------------- | ---------------------------------------------------------------------------------------------- | | `unbound chat` | `-m, --message ` · `--json` · `-o, --output ` · `-c, --continue ` | No flags starts an interactive session. `--json`, `-o` and `-c` each require a non-empty `-m`. `-c` takes the `conversation_id` from a previous reply. Messages cap at 4,000 characters. Needs **Admin, Analytics Viewer or Manager**. ## Discovery | Command | Flags | | ----------------------------- | ---------------------------------------------------------------- | | `unbound discover` | `--api-key ` *(required)* · `--domain ` · `--set-cron` | | `unbound discover unschedule` | none | | `unbound discover status` | none — **macOS only** | On Linux use `systemctl --user status unbound-scheduled.timer`; on Windows `Get-ScheduledTask -TaskName "ai.getunbound.scheduled"`. ## Configuration | Command | Flags | | ---------------------------------------------------- | --------------------------------------- | | `unbound config urls ` | three required positionals, fixed order | | `unbound config set-backend-url ` | none | | `unbound config set-frontend-url ` | none | | `unbound config set-gateway-url ` | none | | `unbound config show` | `--json` | Settings live at `~/.unbound/config.json`. ### Environment variables | Variable | Effect | | ------------------------- | ----------------------------------------------------------------------------------- | | `UNBOUND_API_URL` | Sets the **backend** URL — despite the name, not the gateway | | `UNBOUND_FRONTEND_URL` | Sets the frontend URL | | `UNBOUND_GATEWAY_URL` | Sets the gateway URL | | `UNBOUND_API_KEY` | Fallback API key for `onboard` | | `CLAUDE_CONFIG_DIR` | Where Claude Code hooks are installed and verified. Set-but-empty is a hard failure | | `UNBOUND_NO_UPDATE_CHECK` | Any value disables the update check | | `NO_COLOR` | Disables coloured output | The three URL variables **override anything in the config file**, silently. If a command reaches the wrong host after you ran `unbound config urls`, check these first — a stale export from an earlier shell shadows the file. `unbound config show` prints what's actually in effect. ## Exit codes | Code | Meaning | | ----- | -------------------------------------------------------------------------- | | `0` | Success, or a confirmation you declined | | `1` | General failure — invalid input, network, or a failed operation | | `2` | Validation or steering error, such as a missing required mode flag | | `3` | Authentication or role failure — not logged in, or the command needs Admin | | `130` | Interrupted with Ctrl-C | The direct installers `unbound setup` calls also use `3`, but there it means the device is MDM-managed and the install was skipped. `unbound setup` reports that as a skip rather than passing the code through.