---
title: Command reference
description: Every hexel command, its arguments and flags.
url: https://hexelstudio.com/docs/cli/commands
---

{/* Generated by hexel-cli tools/clidocs from the command tree. Do not edit by hand: regenerate it. */}

Run `hexel <command> --help` for the same information in your terminal.

## Global flags

Every command accepts these flags.

| Flag | Description |
| --- | --- |
| `--context` | context to use (default: the current context; or HEXEL_CONTEXT) |
| `--env` | environment id (overrides the context; or HEXEL_ENV) |
| `--org` | organization id (overrides the context; or HEXEL_ORG) |
| `-o`, `--output` | output format: table, json or yaml (default `table`) |
| `--workspace` | workspace id (overrides the context; or HEXEL_WORKSPACE) |

## activity

Audit log, API activity and logs

### `hexel activity api`

Summarize the organization's API calls: volume, errors and latency

```text
hexel activity api [flags]
```

| Flag | Description |
| --- | --- |
| `--period` | 1h, 6h, 24h (default) or 7d |

### `hexel activity audit count`

Count audit events (same filters as list)

```text
hexel activity audit count [flags]
```

| Flag | Description |
| --- | --- |
| `--action` | only this action, e.g. token.issue |
| `--deployment-id` | only events for this deployment |
| `--resource` | only this resource |
| `--session` | only events in this session |
| `--since` | from this long ago (30m, 24h, 7d) or this RFC 3339 time |
| `--trace` | only events in this trace |
| `--until` | up to this long ago or this RFC 3339 time |
| `--user` | only events by this user or service user ID |

### `hexel activity audit get`

Show an audit event

```text
hexel activity audit get EVENT_ID
```

### `hexel activity audit list`

List audit events, newest first

```text
hexel activity audit list [flags]
```

Also: `ls`.

```bash Example
hexel activity audit list --since 24h
hexel activity audit list --action token.issue --user su_123 --limit 20
```

| Flag | Description |
| --- | --- |
| `--action` | only this action, e.g. token.issue |
| `--deployment-id` | only events for this deployment |
| `--limit` | events to show (1-1000) (default `50`) |
| `--offset` | events to skip (default `0`) |
| `--resource` | only this resource |
| `--session` | only events in this session |
| `--since` | from this long ago (30m, 24h, 7d) or this RFC 3339 time |
| `--trace` | only events in this trace |
| `--until` | up to this long ago or this RFC 3339 time |
| `--user` | only events by this user or service user ID |

### `hexel activity audit verify`

Check an audit event: Titan's audit service verifies the event's signature over its signed payload and that the indexed copy matches it. Exits 1 when the event does not verify.

```text
hexel activity audit verify EVENT_ID
```

### `hexel activity logs`

Show the organization's service logs, newest first

```text
hexel activity logs [flags]
```

```bash Example
hexel activity logs --level error --period 24h
hexel activity logs --service titan-gateway --search denied
```

| Flag | Description |
| --- | --- |
| `--level` | only this level, e.g. error |
| `--limit` | lines to show (1-500) (default `100`) |
| `--period` | 1h (default), 6h, 24h, 7d or 30d |
| `--search` | only lines containing this text |
| `--service` | only this service |

### `hexel activity requests`

List the organization's recent API requests, newest first

```text
hexel activity requests [flags]
```

```bash Example
hexel activity requests --status server_error --period 7d
hexel activity requests --request-id 97b7eff1-7802-4a5f-ab76-20df483c9a42
```

| Flag | Description |
| --- | --- |
| `--limit` | requests to show (1-200) (default `50`) |
| `--period` | 1h, 6h, 24h (default) or 7d |
| `--request-id` | only this request |
| `--status` | success, client_error, server_error or a 3-digit status |

## auth

Sign in, sign out, and show who you are

### `hexel auth login`

Sign in with your Hexel account: hexel shows a code, you approve it in the browser, and the login is stored in your OS keychain.

For CI and scripts, use a service user's API key instead:

```text
echo "$KEY" | hexel auth login --with-api-key
```

or set HEXEL_API_KEY, which is used without being stored.

```text
hexel auth login [flags]
```

| Flag | Description |
| --- | --- |
| `--with-api-key` | read an API key from standard input (or prompt for it) |

### `hexel auth logout`

Sign out and remove stored credentials

```text
hexel auth logout
```

### `hexel auth token`

Print a CIAM access token for the current organization (for scripts)

```text
hexel auth token
```

### `hexel auth whoami`

Show who you are signed in as, and the current context

```text
hexel auth whoami
```

Also: `status`.

## billing

Balance, usage, subscription, invoices and credits

### `hexel billing balance`

Show the balance and its credit buckets

```text
hexel billing balance
```

### `hexel billing budgets`

List budgets and what they have spent

```text
hexel billing budgets
```

Also: `budget`.

### `hexel billing forecast`

Show month-to-date spend and the projection for the month

```text
hexel billing forecast [flags]
```

| Flag | Description |
| --- | --- |
| `--period` | month, YYYY-MM (default: this month, UTC) |

### `hexel billing invoice get`

Show an invoice

```text
hexel billing invoice get ID
```

### `hexel billing invoice list`

List invoices

```text
hexel billing invoice list
```

Also: `ls`.

### `hexel billing invoice pdf`

Download an invoice as PDF

```text
hexel billing invoice pdf ID [flags]
```

| Flag | Description |
| --- | --- |
| `-f`, `--file` | where to save it (default: ID.pdf; - for standard output) |

### `hexel billing ledger`

List credit ledger entries (newest first)

```text
hexel billing ledger [flags]
```

| Flag | Description |
| --- | --- |
| `--limit` | entries to show (at most 200) (default `50`) |

### `hexel billing plans`

List the plans you can subscribe to

```text
hexel billing plans
```

### `hexel billing subscription`

Show the organization's subscription

```text
hexel billing subscription
```

Also: `plan`.

### `hexel billing usage`

Show a month's costs, by meter, workspace, environment or principal

```text
hexel billing usage [flags]
```

```bash Example
hexel billing usage
hexel billing usage --period 2026-09 --by workspace
hexel billing usage --workspace ws_123 --by environment
```

| Flag | Description |
| --- | --- |
| `--by` | break the total down by meter, workspace, environment or principal (default `meter`) |
| `--period` | month, YYYY-MM (default: this month, UTC) |
| `--view` | cash (usage as billed, the default) or amortized |

## completion

Generate the autocompletion script for the specified shell

### `hexel completion bash`

Generate the autocompletion script for bash

```text
hexel completion bash
```

| Flag | Description |
| --- | --- |
| `--no-descriptions` | disable completion descriptions |

### `hexel completion fish`

Generate the autocompletion script for fish

```text
hexel completion fish [flags]
```

| Flag | Description |
| --- | --- |
| `--no-descriptions` | disable completion descriptions |

### `hexel completion powershell`

Generate the autocompletion script for powershell

```text
hexel completion powershell [flags]
```

| Flag | Description |
| --- | --- |
| `--no-descriptions` | disable completion descriptions |

### `hexel completion zsh`

Generate the autocompletion script for zsh

```text
hexel completion zsh [flags]
```

| Flag | Description |
| --- | --- |
| `--no-descriptions` | disable completion descriptions |

## config

View and change hexel's settings (endpoints)

### `hexel config set`

Set a setting: api, sts, issuer or client-id (empty value restores the default)

```text
hexel config set KEY VALUE
```

### `hexel config view`

Show the effective settings and where they are stored

```text
hexel config view
```

## context

Choose the organization, workspace, environment and deployment to work in

### `hexel context delete`

Delete a context

```text
hexel context delete NAME
```

### `hexel context list`

List contexts

```text
hexel context list
```

Also: `ls`.

### `hexel context set`

Set fields of the current context

```text
hexel context set [flags]
```

```bash Example
hexel context set --org org_123 --workspace ws_456
hexel context set --deployment td-0123…   # default for hexel titan commands
```

| Flag | Description |
| --- | --- |
| `--deployment` | Titan deployment id (td-…) |
| `--env` | environment id |
| `--org` | organization id |
| `--workspace` | workspace id |

### `hexel context show`

Show the current context

```text
hexel context show
```

### `hexel context use`

Switch to a context (created empty when it does not exist)

```text
hexel context use NAME
```

## env

Environments in the current workspace

### `hexel env list`

List environments

```text
hexel env list
```

Also: `ls`.

## iam

Identity and access: service users, API keys, policies, groups, roles and members

### `hexel iam api-key create`

Create an API key for a service user. The key is printed once: Hexel Studio stores only a hash. Keys expire after 90 days unless --expires says otherwise, and at most a year from today.

```text
hexel iam api-key create SERVICE_USER_ID --name NAME [flags]
```

```bash Example
hexel iam api-key create su_123 --name github-actions --expires 30d
KEY=$(hexel iam api-key create su_123 --name ci -o json | jq -r .api_key)
```

| Flag | Description |
| --- | --- |
| `--description` | a longer note |
| `--expires` | 30d, a date (2026-12-31) or an RFC 3339 time (default: 90 days) |
| `--name` | what the key is for, e.g. github-actions (required) |

### `hexel iam api-key list`

List a service user's active API keys (never the keys themselves)

```text
hexel iam api-key list SERVICE_USER_ID
```

Also: `ls`.

### `hexel iam api-key revoke`

Revoke an API key (permanent)

```text
hexel iam api-key revoke SERVICE_USER_ID KEY_ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel iam group list`

List groups

```text
hexel iam group list
```

Also: `ls`.

### `hexel iam group members`

List a group's members

```text
hexel iam group members GROUP_ID
```

### `hexel iam members`

List the organization's members

```text
hexel iam members
```

Also: `member`.

### `hexel iam policy get`

Show a policy and its document

```text
hexel iam policy get ID
```

### `hexel iam policy list`

List policies (managed and your own)

```text
hexel iam policy list
```

Also: `ls`.

### `hexel iam role get`

Show a role and its trust policy

```text
hexel iam role get ID
```

### `hexel iam role list`

List roles

```text
hexel iam role list
```

Also: `ls`.

### `hexel iam service-user create`

Create a service user (it can do nothing until you attach a policy)

```text
hexel iam service-user create NAME [flags]
```

| Flag | Description |
| --- | --- |
| `--description` | what the service user is for |
| `--display-name` | display name (default: NAME) |

### `hexel iam service-user delete`

Delete a service user (its API keys stop working)

```text
hexel iam service-user delete ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel iam service-user get`

Show a service user

```text
hexel iam service-user get ID
```

### `hexel iam service-user list`

List service users

```text
hexel iam service-user list
```

Also: `ls`.

### `hexel iam service-user policy attach`

Attach a policy to a service user

```text
hexel iam service-user policy attach SERVICE_USER_ID POLICY_ID
```

### `hexel iam service-user policy detach`

Detach a policy (by attachment ID, from policy list)

```text
hexel iam service-user policy detach SERVICE_USER_ID ATTACHMENT_ID
```

### `hexel iam service-user policy list`

List the policies attached to a service user

```text
hexel iam service-user policy list SERVICE_USER_ID
```

Also: `ls`.

## memory

Memory stores: what your agents remember, and recall

### `hexel memory add`

Add a memory (or, with --extract, let Hexel Studio extract facts from TEXT)

```text
hexel memory add STORE_ID TEXT [flags]
```

```bash Example
hexel memory add mst_123 "Prefers metric units" --user u_42
hexel memory add mst_123 "I moved to Pune last month and work nights now" --user u_42 --extract
```

| Flag | Description |
| --- | --- |
| `--agent` | the agent the memories belong to |
| `--extract` | treat TEXT as a message and extract facts from it (waits up to 10s) |
| `--run` | the run (conversation) the memories belong to |
| `--user` | the end user the memories are about |

### `hexel memory delete`

Delete a memory

```text
hexel memory delete STORE_ID MEMORY_ID
```

### `hexel memory forget`

Erase everything a store holds for a user, agent or run (permanent)

```text
hexel memory forget STORE_ID --user ID | --agent ID | --run ID [flags]
```

| Flag | Description |
| --- | --- |
| `--agent` | the agent the memories belong to |
| `--run` | the run (conversation) the memories belong to |
| `--user` | the end user the memories are about |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel memory get`

Show a memory

```text
hexel memory get STORE_ID MEMORY_ID
```

### `hexel memory history`

Show how a memory changed

```text
hexel memory history STORE_ID MEMORY_ID
```

### `hexel memory job`

Show an extraction job

```text
hexel memory job STORE_ID JOB_ID
```

### `hexel memory list`

List a store's memories (oldest first)

```text
hexel memory list STORE_ID [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--agent` | the agent the memories belong to |
| `--limit` | memories to show (default `100`) |
| `--run` | the run (conversation) the memories belong to |
| `--user` | the end user the memories are about |

### `hexel memory recall`

Recall the memories that best match a query, from up to 8 stores

```text
hexel memory recall QUERY --store STORE_ID [--store STORE_ID...] [flags]
```

```bash Example
hexel memory recall "what units does she use" --store mst_123 --user u_42
hexel memory recall "deployment preferences" --store mst_1 --store mst_2 --top-k 5
```

| Flag | Description |
| --- | --- |
| `--agent` | the agent the memories belong to |
| `--run` | the run (conversation) the memories belong to |
| `--store` | a store to recall from (repeat for up to 8) |
| `--top-k` | memories to return (default `0`) |
| `--user` | the end user the memories are about |

### `hexel memory store create`

Create a memory store in the current workspace and environment.

--scope-policy caller_managed (the default) lets callers choose the scope of each memory; principal_bound always files a memory under the caller.

```text
hexel memory store create NAME [flags]
```

| Flag | Description |
| --- | --- |
| `--description` | what the store is for |
| `--retention-days` | delete memories after this many days (default: keep) (default `0`) |
| `--scope-policy` | caller_managed (default) or principal_bound |
| `--tier` | standard (default) or enterprise |

### `hexel memory store delete`

Delete a store and every memory in it (permanent)

```text
hexel memory store delete STORE_ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel memory store get`

Show a store

```text
hexel memory store get STORE_ID
```

### `hexel memory store list`

List memory stores

```text
hexel memory store list
```

Also: `ls`.

### `hexel memory store stats`

Count a store's memories

```text
hexel memory store stats STORE_ID
```

## org

Organizations you belong to

### `hexel org get`

Show an organization (default: the current one)

```text
hexel org get [ID]
```

### `hexel org list`

List your organizations

```text
hexel org list
```

Also: `ls`.

## skills

Agent skills in the Hexel Studio registry: publish, version, tag and resolve

### `hexel skills audit`

Show your organization's registry audit log (hash-chained)

```text
hexel skills audit [flags]
```

| Flag | Description |
| --- | --- |
| `--after` | records after this sequence number (default `0`) |
| `--limit` | records to show (default `50`) |

### `hexel skills deprecate`

Deprecate a version (consumers get a warning)

```text
hexel skills deprecate NAMESPACE/NAME@VERSION [flags]
```

| Flag | Description |
| --- | --- |
| `--reason` | shown to consumers as a warning or error |

### `hexel skills get`

Show a skill (its tags), or one version (files, digest, scan, status)

```text
hexel skills get NAMESPACE/NAME[@VERSION]
```

### `hexel skills list`

List the skills in a namespace

```text
hexel skills list NAMESPACE
```

Also: `ls`.

### `hexel skills namespace create`

Create a namespace in your organization. Names are global across the registry and cannot be renamed or moved yet, so pick a stable one. Names reserved for Hexel Studio (hexel*, titan*, look-alikes, words like official) are refused.

```text
hexel skills namespace create SLUG
```

### `hexel skills namespace list`

List your organization's namespaces

```text
hexel skills namespace list
```

Also: `ls`.

### `hexel skills publish`

Publish the skill in DIR (its SKILL.md and every file beside it) as a new version. The name comes from SKILL.md's frontmatter (or --name) and the version from its metadata.version (or --version). Versions are never reused: publishing the same content again is a no-op, different content under a published version is refused.

The registry checks the skill, signs the version and scans it; it returns warnings when the change looks bigger than the version bump. Skills up to 10 MB publish in one request; for larger ones use the registry's skills CLI.

```text
hexel skills publish DIR --namespace NAMESPACE [flags]
```

```bash Example
hexel skills publish ./release-notes --namespace acme --dry-run
hexel skills publish ./release-notes --namespace acme --tag beta
hexel skills publish . --namespace acme --version 1.2.0 --tag stable
```

| Flag | Description |
| --- | --- |
| `--dry-run` | list what would be published, without publishing |
| `--name` | skill name (default: SKILL.md's name) |
| `--namespace` | the namespace to publish in (required) |
| `--tag` | also point these tags at the new version |
| `--version` | semantic version (default: SKILL.md's metadata.version) |

### `hexel skills remove`

Remove a version's content (needs registry admin; permanent)

```text
hexel skills remove NAMESPACE/NAME@VERSION [flags]
```

| Flag | Description |
| --- | --- |
| `--detach-tags` | also remove custom tags that point at the version (required when one does) |
| `--reason` | shown to consumers as a warning or error |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel skills resolve`

Resolve references (NS/NAME, NS/NAME@1.2.3, NS/NAME@stable, NS/NAME@^1.2) to pinned versions

```text
hexel skills resolve REF...
```

### `hexel skills restore`

Make a deprecated or yanked version active again

```text
hexel skills restore NAMESPACE/NAME@VERSION [flags]
```

| Flag | Description |
| --- | --- |
| `--reason` | shown to consumers as a warning or error |

### `hexel skills scan`

Show a version's content scan and its findings

```text
hexel skills scan NAMESPACE/NAME@VERSION
```

### `hexel skills search`

Search the skills your organization may read

```text
hexel skills search QUERY [flags]
```

| Flag | Description |
| --- | --- |
| `--namespace` | only this namespace |

### `hexel skills tag delete`

Delete a tag

```text
hexel skills tag delete NAMESPACE/NAME TAG
```

### `hexel skills tag list`

List a skill's tags

```text
hexel skills tag list NAMESPACE/NAME
```

Also: `ls`.

### `hexel skills tag set`

Point a tag at a version (latest moves by itself)

```text
hexel skills tag set NAMESPACE/NAME TAG VERSION [flags]
```

```bash Example
hexel skills tag set acme/release-notes stable 1.2.0
hexel skills tag set acme/release-notes stable 1.3.0 --if-match 1.2.0   # only if it still points at 1.2.0
```

| Flag | Description |
| --- | --- |
| `--if-match` | only move the tag if it points at this version ("": only if it does not exist) |

### `hexel skills versions`

List a skill's versions, highest first

```text
hexel skills versions NAMESPACE/NAME [flags]
```

| Flag | Description |
| --- | --- |
| `--status` | only these statuses: active, deprecated, yanked, removed |

### `hexel skills whoami`

Show how the registry sees you: organization and permissions

```text
hexel skills whoami
```

### `hexel skills yank`

Yank a version (pinned consumers get an error)

```text
hexel skills yank NAMESPACE/NAME@VERSION [flags]
```

| Flag | Description |
| --- | --- |
| `--detach-tags` | also remove custom tags that point at the version (required when one does) |
| `--reason` | shown to consumers as a warning or error |
| `-y`, `--yes` | do not ask for confirmation |

## titan

Titan: control and audit what your AI agents do

These flags apply to every `hexel titan` command:

| Flag | Description |
| --- | --- |
| `--deployment` | Titan deployment id (td-…; overrides the context; or HEXEL_DEPLOYMENT) |

### `hexel titan agent create`

Register an agent

```text
hexel titan agent create --name NAME [flags]
```

```bash Example
hexel titan agent create --name support-bot --label team=support
```

| Flag | Description |
| --- | --- |
| `--description` | description |
| `--label` | label KEY=VALUE (repeatable) |
| `--name` | display name |

### `hexel titan agent events`

List an agent's registry events

```text
hexel titan agent events ID [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan agent get`

Show an agent

```text
hexel titan agent get ID
```

### `hexel titan agent list`

List agents in the organization

```text
hexel titan agent list
```

Also: `ls`.

### `hexel titan agent resume`

Resume a suspended agent

```text
hexel titan agent resume ID
```

### `hexel titan agent retire`

Retire an agent (permanent)

```text
hexel titan agent retire ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan agent suspend`

Suspend an agent (until resumed)

```text
hexel titan agent suspend ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan agent-deployment create`

Create an agent deployment: a published revision, running under a control profile, in the workspace and environment of the context (or --workspace and --env). --runtime-class is workload, interactive, ephemeral, titan_managed or external_managed.

```text
hexel titan agent-deployment create --name NAME --revision REVISION_ID --control-profile PROFILE_ID --runtime-class CLASS [flags]
```

```bash Example
hexel titan agent-deployment create --name support-prod --revision rev_123 --control-profile dcp_123 --runtime-class workload
```

| Flag | Description |
| --- | --- |
| `--control-profile` | the deployment control profile |
| `--name` | display name |
| `--revision` | the published agent revision to run |
| `--runtime-class` | workload, interactive, ephemeral, titan_managed or external_managed |
| `--valid-until` | when it stops being valid: 30d, a date (2026-12-31) or an RFC 3339 time (default: no end) |

### `hexel titan agent-deployment events`

List an agent deployment's registry events

```text
hexel titan agent-deployment events ID [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan agent-deployment get`

Show an agent deployment

```text
hexel titan agent-deployment get ID
```

### `hexel titan agent-deployment list`

List agent deployments

```text
hexel titan agent-deployment list [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--agent` | only this agent's deployments |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan agent-deployment resume`

Resume a suspended agent deployment

```text
hexel titan agent-deployment resume ID
```

### `hexel titan agent-deployment retire`

Retire an agent deployment (permanent)

```text
hexel titan agent-deployment retire ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan agent-deployment suspend`

Suspend an agent deployment (until resumed)

```text
hexel titan agent-deployment suspend ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan approval approve`

Approve a pending request

```text
hexel titan approval approve ID
```

### `hexel titan approval deny`

Deny a pending request

```text
hexel titan approval deny ID
```

### `hexel titan approval list`

List approvals (default: pending)

```text
hexel titan approval list [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--state` | pending, approved, denied, expired, revoked, invalidated or all (default `pending`) |

### `hexel titan binding create`

Create an identity binding from a JSON request body (- reads standard input). A Kubernetes service account binding:

```text
{"type": "kubernetes_service_account", "runtime_principal_id": "…",
 "selector": {"cluster_id": "…", "issuer": "…", "audience": "…",
              "namespace": "…", "service_account_name": "…",
              "service_account_uid": "…"}}
```

Optional: maximum_assurance and valid_until (RFC 3339). A device key binding (type titan_device_key) is made by hexel titan enrollment create.

```text
hexel titan binding create -f FILE [flags]
```

```bash Example
hexel titan binding create -f binding.json
```

| Flag | Description |
| --- | --- |
| `-f`, `--file` | the binding as JSON (- for standard input) |

### `hexel titan binding events`

List an identity binding's registry events

```text
hexel titan binding events ID [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan binding get`

Show an identity binding

```text
hexel titan binding get ID
```

### `hexel titan binding list`

List identity bindings

```text
hexel titan binding list [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of results (default `100`) |
| `--principal` | only this runtime principal's bindings |

### `hexel titan binding resume`

Resume a suspended identity binding

```text
hexel titan binding resume ID
```

### `hexel titan binding retire`

Retire an identity binding (permanent)

```text
hexel titan binding retire ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan binding suspend`

Suspend an identity binding (until resumed)

```text
hexel titan binding suspend ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan control list`

List the quarantines and kills in force

```text
hexel titan control list [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--target` | only this target's controls |
| `--type` | with --target: what it names (agent or deployment) (default `agent`) |

### `hexel titan control quarantine`

Quarantine stops a target at once and reversibly: Titan refuses its actions until hexel titan control resume. --type chooses what TARGET_ID names: agent (default) or deployment (an agent deployment).

```text
hexel titan control quarantine TARGET_ID [flags]
```

```bash Example
hexel titan control quarantine agt_123 --reason SECURITY_INCIDENT
```

| Flag | Description |
| --- | --- |
| `--reason` | OPERATOR_REQUEST, SECURITY_INCIDENT or POLICY_VIOLATION (default `OPERATOR_REQUEST`) |
| `--type` | what TARGET_ID names: agent or deployment (default `agent`) |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan control resume`

Lift a quarantine

```text
hexel titan control resume TARGET_ID [flags]
```

```bash Example
hexel titan control resume agt_123
```

| Flag | Description |
| --- | --- |
| `--reason` | OPERATOR_REQUEST, SECURITY_INCIDENT or POLICY_VIOLATION (default `OPERATOR_REQUEST`) |
| `--type` | what TARGET_ID names: agent or deployment (default `agent`) |

### `hexel titan control-profile create`

Create a deployment control profile in an enforcement deployment (default: the context's deployment). The switches it records are what Titan requires of every agent deployment that uses the profile.

```text
hexel titan control-profile create --attestation none|platform_bound|titan_managed [flags]
```

```bash Example
hexel titan control-profile create --attestation titan_managed --mandatory-mediation --credential-isolation --runtime-peer-auth --deny-egress-bypass
```

| Flag | Description |
| --- | --- |
| `--attestation` | platform instance attestation: none, platform_bound or titan_managed |
| `--credential-isolation` | agents never hold tool credentials |
| `--deny-egress-bypass` | deny destination egress that bypasses Titan |
| `--enforcement-deployment` | enforcement deployment td-… (default: the context's deployment) |
| `--mandatory-mediation` | every action must go through Titan |
| `--runtime-peer-auth` | require runtime peer authentication |
| `--valid-until` | when it stops being valid: 30d, a date (2026-12-31) or an RFC 3339 time (default: no end) |

### `hexel titan control-profile events`

List a control profile's registry events

```text
hexel titan control-profile events ID [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan control-profile get`

Show a control profile

```text
hexel titan control-profile get ID
```

### `hexel titan control-profile list`

List control profiles

```text
hexel titan control-profile list [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan control-profile resume`

Resume a suspended control profile

```text
hexel titan control-profile resume ID
```

### `hexel titan control-profile retire`

Retire a control profile (permanent)

```text
hexel titan control-profile retire ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan control-profile suspend`

Suspend a control profile (until resumed)

```text
hexel titan control-profile suspend ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan deployment domains`

List a deployment's custom domains

```text
hexel titan deployment domains [ID]
```

### `hexel titan deployment get`

Show a deployment (default: the context's)

```text
hexel titan deployment get [ID]
```

### `hexel titan deployment list`

List deployments in the organization

```text
hexel titan deployment list [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--all` | include retired deployments |

### `hexel titan deployment retire`

Retire a deployment (permanent: its agents stop getting tokens)

```text
hexel titan deployment retire ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan discovery events`

List a discovery card's registry events

```text
hexel titan discovery events ID [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan discovery get`

Show a discovery card

```text
hexel titan discovery get ID
```

### `hexel titan discovery list`

List the organization's discovery cards

```text
hexel titan discovery list [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--agent-deployment` | only this agent deployment's cards |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan discovery resume`

Resume a suspended discovery card

```text
hexel titan discovery resume ID
```

### `hexel titan discovery retire`

Retire a discovery card (permanent)

```text
hexel titan discovery retire ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan discovery search`

Search the discovery cards visible to the organization

```text
hexel titan discovery search [--capability ID] [flags]
```

```bash Example
hexel titan discovery search --capability invoice.summarize
```

| Flag | Description |
| --- | --- |
| `--capability` | only cards offering this capability |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan discovery suspend`

Suspend a discovery card (until resumed)

```text
hexel titan discovery suspend ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan enrollment create`

Enroll a device's Ed25519 public key (base64url, unpadded: the 32 raw bytes, as titand stores it) for a runtime principal. Titan creates the device key identity binding with it.

```text
hexel titan enrollment create --principal ID --public-key KEY [flags]
```

```bash Example
hexel titan enrollment create --principal rp_123 --public-key 3q2-7w…
```

| Flag | Description |
| --- | --- |
| `--principal` | the runtime principal |
| `--public-key` | the device's Ed25519 public key (base64url) |
| `--valid-until` | when it stops being valid: 30d, a date (2026-12-31) or an RFC 3339 time (default: no end) |

### `hexel titan enrollment get`

Show a device enrollment

```text
hexel titan enrollment get ID
```

### `hexel titan finding list`

List Defender findings

```text
hexel titan finding list
```

Also: `ls`.

### `hexel titan fleet list`

List the fleet's sessions

```text
hexel titan fleet list
```

Also: `ls`.

### `hexel titan kill`

Stops a target at once: Titan refuses its next action, and running sessions end. --type chooses what TARGET_ID names: agent (default), session, deployment, workspace, environment, connection, capability, destination or organization.

```text
hexel titan kill TARGET_ID [flags]
```

```bash Example
hexel titan kill agt_123 --reason SECURITY_INCIDENT
```

| Flag | Description |
| --- | --- |
| `--reason` | OPERATOR_REQUEST, SECURITY_INCIDENT or POLICY_VIOLATION (default `OPERATOR_REQUEST`) |
| `--type` | what TARGET_ID names (default `agent`) |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan ledger list`

Lists the Agent Ledger, oldest first: up to --limit entries with a sequence number (SEQ) above --after. To read the next page, pass the last SEQ shown as --after. Entries the deployment has pruned are not returned.

EXECUTOR is the Tool Gateway's own refusal code behind a PRE_DISPATCH_FAILED execution (for example NO_ELIGIBLE_CONNECTION); it is empty on other entries.

--type and --outcome filter on the client: the API returns the page of --limit entries, and the CLI shows only the entries in it that match (case-insensitive). A filtered page can show fewer entries than --limit, or none; page on with --after as usual.

```text
hexel titan ledger list [flags]
```

Also: `ls`.

```bash Example
hexel titan ledger list --limit 20
hexel titan ledger list --after 300 --type execution --outcome failed
```

| Flag | Description |
| --- | --- |
| `--after` | show entries with a SEQ above this (the last SEQ of the previous page) (default `0`) |
| `--limit` | entries to read (1-1000) (default `100`) |
| `--outcome` | only entries with this outcome, within the page read (client-side) |
| `--type` | only entries of this event type, within the page read (client-side) |

### `hexel titan ledger verify`

Recomputes the Agent Ledger's hash chain on the deployment, from the prune checkpoint to the head. It exits 1 when the chain is broken, and says at which entry.

```text
hexel titan ledger verify
```

### `hexel titan principal create`

Create a runtime principal for an agent deployment

```text
hexel titan principal create --agent-deployment ID --name NAME [flags]
```

```bash Example
hexel titan principal create --agent-deployment dep_123 --name worker-1
```

| Flag | Description |
| --- | --- |
| `--agent-deployment` | the agent deployment it belongs to |
| `--name` | display name |
| `--valid-until` | when it stops being valid: 30d, a date (2026-12-31) or an RFC 3339 time (default: no end) |

### `hexel titan principal events`

List a runtime principal's registry events

```text
hexel titan principal events ID [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan principal get`

Show a runtime principal

```text
hexel titan principal get ID
```

### `hexel titan principal list`

List runtime principals

```text
hexel titan principal list [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--agent-deployment` | only this agent deployment's principals |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan principal resume`

Resume a suspended runtime principal

```text
hexel titan principal resume ID
```

### `hexel titan principal retire`

Retire a runtime principal (permanent)

```text
hexel titan principal retire ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan principal suspend`

Suspend a runtime principal (until resumed)

```text
hexel titan principal suspend ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan revision create`

Create a draft revision of an agent (publish it to use it)

```text
hexel titan revision create AGENT_ID --artifact-digest D --configuration-digest D --manifest-digest D [flags]
```

```bash Example
hexel titan revision create agt_123 --artifact-digest sha256:… --configuration-digest sha256:… --manifest-digest sha256:… --capability tools.call
```

| Flag | Description |
| --- | --- |
| `--artifact-digest` | digest of the agent artifact |
| `--capability` | a capability it declares (repeatable) |
| `--configuration-digest` | digest of its configuration |
| `--manifest-digest` | digest of its manifest |

### `hexel titan revision events`

List a revision's registry events

```text
hexel titan revision events ID [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan revision get`

Show a revision

```text
hexel titan revision get ID
```

### `hexel titan revision list`

List an agent's revisions

```text
hexel titan revision list AGENT_ID [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of results (default `100`) |

### `hexel titan revision publish`

Publish a revision so it can be deployed

```text
hexel titan revision publish ID
```

### `hexel titan revision resume`

Resume a suspended revision

```text
hexel titan revision resume ID
```

### `hexel titan revision retire`

Retire a revision (permanent)

```text
hexel titan revision retire ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan revision suspend`

Suspend a revision (until resumed)

```text
hexel titan revision suspend ID [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan session get`

Show a session

```text
hexel titan session get ID
```

### `hexel titan session list`

List sessions

```text
hexel titan session list [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--limit` | maximum number of sessions (default `100`) |
| `--state` | active, suspended, revoked, expired or closed |

### `hexel titan session resume`

Resume a suspended session

```text
hexel titan session resume ID [flags]
```

| Flag | Description |
| --- | --- |
| `--reason` | OPERATOR_REQUEST, SECURITY_INCIDENT or POLICY_VIOLATION (default `OPERATOR_REQUEST`) |

### `hexel titan session revoke`

Revoke a session permanently

```text
hexel titan session revoke ID [flags]
```

| Flag | Description |
| --- | --- |
| `--reason` | OPERATOR_REQUEST, SECURITY_INCIDENT or POLICY_VIOLATION (default `OPERATOR_REQUEST`) |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel titan session suspend`

Suspend a session (it can be resumed)

```text
hexel titan session suspend ID [flags]
```

| Flag | Description |
| --- | --- |
| `--reason` | OPERATOR_REQUEST, SECURITY_INCIDENT or POLICY_VIOLATION (default `OPERATOR_REQUEST`) |

## tools

Toolkits, tools, connections and MCP servers your agents use

### `hexel tools apply`

Register the toolkit and tools a manifest describes: create what is missing, update drafts that changed, and leave the rest alone, after showing the plan. hexel tools import openapi --out writes a manifest; you can also write one by hand (the fields are the registry's create-tool fields).

```text
hexel tools apply -f FILE [flags]
```

```bash Example
hexel tools apply -f tools.yaml --dry-run
hexel tools apply -f tools.yaml --publish --yes
```

| Flag | Description |
| --- | --- |
| `--dry-run` | show the plan only |
| `-f`, `--file` | the manifest (- for standard input) |
| `--publish` | publish the tools after registering (default: leave them as drafts) |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel tools auth-config list`

List auth configs in the current workspace

```text
hexel tools auth-config list
```

Also: `ls`.

### `hexel tools connection list`

List connected accounts in the current workspace

```text
hexel tools connection list
```

Also: `ls`.

### `hexel tools import openapi`

Turn every operation of an OpenAPI 3 or Swagger 2.0 document (a file or an https URL, JSON or YAML) into a tool of one toolkit, and register them.

hexel shows the plan first: each operation, whether it changes data, and whether it is created, updated or left alone; operations the executor cannot call (a non-JSON body, a GET with a body, a required header) are listed as skipped with the reason. Nothing changes until you confirm.

Tools are registered as drafts: review them, then publish the ones your agents may use (--publish publishes them now). Running the import again is safe: unchanged tools are left alone and changed drafts are updated.

Authentication comes from the document's security schemes (an API key in a header or query parameter, HTTP bearer or basic, or OAuth 2); --auth overrides it. Connections of the toolkit supply the credential.

To review or edit the tools before registering, write them to a manifest with --out, then register it with hexel tools apply -f.

```text
hexel tools import openapi SPEC [flags]
```

```bash Example
hexel tools import openapi ./openapi.yaml --dry-run
hexel tools import openapi https://api.example.com/openapi.json --toolkit EXAMPLE --read-only
hexel tools import openapi spec.json --include 'GET /orders*' --exclude '*Admin*' --publish
hexel tools import openapi spec.json --out tools.yaml   # review, then: hexel tools apply -f tools.yaml
```

| Flag | Description |
| --- | --- |
| `--auth` | credential placement: none, bearer, basic, header:NAME or query:NAME (default: from the document) |
| `--base-url` | https base URL of the API (default: the document's first server) |
| `--dry-run` | show the plan only |
| `--exclude` | leave out operations matching these globs |
| `--include` | only operations matching these globs: operationId, "GET /path*" or "/path*" |
| `--out` | write the tools to this manifest (.yaml or .json) instead of registering them |
| `--publish` | publish the tools after registering (default: leave them as drafts) |
| `--read-only` | only GET operations |
| `--tag` | only operations with one of these tags |
| `--toolkit` | toolkit slug (default: from the document's title) |
| `--version` | tool version (default: the document's info.version) |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel tools mcp import`

Read the server's tools/list and register each tool as a draft in the server's toolkit; publish them with hexel tools tool publish --toolkit &lt;toolkit&gt; --all. Re-importing is safe: slugs stay stable, and a tool that changed upstream returns to draft.

A server that needs authentication is imported with a connection of your organization (--connection) or a bearer token read from an environment variable (--bearer-env), used for this import only.

```text
hexel tools mcp import SERVER_ID [flags]
```

| Flag | Description |
| --- | --- |
| `--bearer-env` | authenticate the import with the bearer token in this environment variable |
| `--connection` | authenticate the import with this connection |

### `hexel tools mcp list`

List MCP servers

```text
hexel tools mcp list
```

Also: `ls`.

### `hexel tools mcp register`

Register an MCP server, then import its tools with hexel tools mcp import. --auth-toolkit names the toolkit whose connections authenticate the server's tools, when it needs authentication.

```text
hexel tools mcp register URL --slug SLUG [flags]
```

```bash Example
hexel tools mcp register https://mcp.example.com/mcp --slug example --name "Example MCP"
hexel tools mcp import <server-id> && hexel tools tool publish --toolkit <toolkit> --all
```

| Flag | Description |
| --- | --- |
| `--auth-toolkit` | toolkit whose connections authenticate the server's tools |
| `--name` | display name (default: the slug) |
| `--slug` | server slug: lowercase letters, digits and _ (required) |

### `hexel tools tool delete`

Delete tools

```text
hexel tools tool delete [SLUG|ID...] [--toolkit SLUG] [--all] [flags]
```

| Flag | Description |
| --- | --- |
| `--all` | every draft or retired tool of --toolkit |
| `--toolkit` | the tools' toolkit (needed for slugs shared by several toolkits, and for --all) |
| `--version` | the tool version (default: the latest) |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel tools tool deprecate`

Deprecate published tools

```text
hexel tools tool deprecate [SLUG|ID...] [--toolkit SLUG] [--all] [flags]
```

| Flag | Description |
| --- | --- |
| `--all` | every published tool of --toolkit |
| `--toolkit` | the tools' toolkit (needed for slugs shared by several toolkits, and for --all) |
| `--version` | the tool version (default: the latest) |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel tools tool get`

Show a tool, with its input schema

```text
hexel tools tool get SLUG [flags]
```

| Flag | Description |
| --- | --- |
| `--toolkit` | toolkit slug, when several toolkits have a tool of this slug |

### `hexel tools tool list`

List tools

```text
hexel tools tool list [flags]
```

Also: `ls`.

```bash Example
hexel tools tool list --toolkit GITHUB
```

| Flag | Description |
| --- | --- |
| `--lifecycle` | draft, published, deprecated or retired |
| `--limit` | maximum number of tools (default `100`) |
| `--toolkit` | only this toolkit's tools (slug) |

### `hexel tools tool publish`

Publish draft tools (the owner's approval: only published tools reach agents)

```text
hexel tools tool publish [SLUG|ID...] [--toolkit SLUG] [--all] [flags]
```

| Flag | Description |
| --- | --- |
| `--all` | every draft tool of --toolkit |
| `--toolkit` | the tools' toolkit (needed for slugs shared by several toolkits, and for --all) |
| `--version` | the tool version (default: the latest) |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel tools tool retire`

Retire tools (agents can no longer use them); published tools are deprecated first

```text
hexel tools tool retire [SLUG|ID...] [--toolkit SLUG] [--all] [flags]
```

| Flag | Description |
| --- | --- |
| `--all` | every published or deprecated tool of --toolkit |
| `--toolkit` | the tools' toolkit (needed for slugs shared by several toolkits, and for --all) |
| `--version` | the tool version (default: the latest) |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel tools toolkit create`

Create a toolkit in your organization

```text
hexel tools toolkit create SLUG --name NAME [flags]
```

| Flag | Description |
| --- | --- |
| `--auth-scheme` | api_key or oauth2 (repeat for several; default: none) |
| `--category` | category (default `custom`) |
| `--description` | what the toolkit is for |
| `--docs-url` | the API's documentation |
| `--name` | display name (default: SLUG) |

### `hexel tools toolkit delete`

Delete one of your organization's toolkits

```text
hexel tools toolkit delete SLUG [flags]
```

| Flag | Description |
| --- | --- |
| `-y`, `--yes` | do not ask for confirmation |

### `hexel tools toolkit get`

Show a toolkit

```text
hexel tools toolkit get SLUG
```

### `hexel tools toolkit list`

List toolkits

```text
hexel tools toolkit list [flags]
```

Also: `ls`.

| Flag | Description |
| --- | --- |
| `--category` | only toolkits in this category |

## version

Show the hexel version

### `hexel version`

Show the hexel version

```text
hexel version
```

## workspace

Workspaces in the current organization

### `hexel workspace list`

List workspaces

```text
hexel workspace list
```

Also: `ls`.