CLI Reference Public Tachyonic commands, authentication, and compatibility reference
tachyonic [OPTIONS] < COMMAND > -v, --verbose works on every command. --json selects machine-readable output
for sandbox and workspace commands. --api-url overrides the API origin.
Run tachyonic <command> --help for your installed version's full flag list.
Sandbox and workspace commands require CLI 0.18.0 or later.
Command Description tachyonic sandbox (sb)Create and drive sandboxes. See Sandbox CLI tachyonic whoamiRead the current workspace and key scopes tachyonic regionsList regions and sandbox pools tachyonic keys lsRead accessible workspace key metadata tachyonic usageRead organization usage, credits, and spend tachyonic budgetRead or manage the workspace monthly budget tachyonic runtimeStart and manage runtimes. See Runtimes tachyonic verifyVerify the signature on an evidence bundle. See Verifying Evidence tachyonic loginAuthorize a workspace-bound device key, or store an existing key with --with-key tachyonic logoutClear local login and revoke a device-created key; --keep-key preserves it
tachyonic login tachyonic whoami For an existing console-created key, use tachyonic login --with-key and paste
it at the hidden prompt, or supply it on stdin. CI should supply
TACHYONIC_API_KEY through its secret environment; the CLI reads it in-process.
Keep credentials out of arguments, URLs, shell history, and output.
Device-login keys cannot change budgets. See Authentication .
tachyonic runtime < COMMAN D > Subcommand Description planRender and validate a runtime bundle without spending budget startCreate and begin a runtime, from a manifest or --target statusShow point-in-time status watchFollow a runtime until it reaches a terminal state eventsList lifecycle events artifactsList result artifacts with signed URLs logsFetch or follow the runtime log approveApprove or deny a gated action cancelCancel a running runtime
Flag Value Default Description [MANIFEST]pathRuntime manifest YAML. Mutually exclusive with --target. --target<URL>Quick-start shorthand. The objective is derived from the host. --region<REGION>Region for the --target shorthand, for example aws-us-east-1. Omit on Free.
tachyonic verify [OPTIONS] < BUNDLE > <BUNDLE> is an evidence manifest (.manifest.json), an artifact, or a bundle directory.
Flag Value Default Description --pubkey-url<URL>Override the signing key URL. The default is https://tachyonic.sh/.well-known/signing-pubkey.json. --pubkeypathLocal PEM public key. Skips the network fetch.
The existing scan, attacks, report, upload, and doctor commands remain
compatibility surfaces and are hidden from top-level help. The following local
scan reference remains available for existing callers; new hosted tests use
security runtimes .
Run a security scan against an LLM endpoint, AI agent, or MCP server.
Flag Value Default Description -t, --target<URL>Target URL or endpoint. -p, --provider<NAME>Provider preset: open-ai, anthropic, gemini, open-responses, mistral, deep-seek, ollama, groq, together-ai, nvidia, moonshot, zai, baseten. -m, --model<NAME>Model to use. --api-key<KEY>API key. Prefer environment variables: CLI arguments show up in process listings. --auth-modeapi-key | session | autoapi-keyCredential resolution mode. -c, --configpathConfiguration file. See Configuration .
Flag Value Default Description --categories<LIST>Comma-separated categories. See the Attack Catalog . --max-attacks<N>Maximum number of attacks to run. --include-builtinAdd built-in attacks to the external library. --no-triageDisable triage and emit raw findings. --max-cost<USD>Stop when the estimated cost exceeds this amount.
Flag Value Default Description --parallelEnable parallel execution. --max-concurrent<N>5Concurrent requests in parallel mode. --min-delay<MS>100Minimum delay between requests. --http-timeout-ms<MS>30000HTTP request timeout.
Flag Value Default Description -f, --formatjson | html | sarifjsonOutput format. -o, --outputpathstdoutOutput file. --include-rawInclude raw responses. --no-progressHide the progress bar. --save-baselinepathSave results as a baseline. --baselinepathCompare against a saved baseline.
Flag Value Default Description --tools-json, --tools-fileJSONTool definitions to include in HTTP requests. --tool-choicestringTool choice policy, as JSON or a plain string. --tool-call-paths<LIST>JSONPaths that extract tool calls from responses. --allowed-tool<NAME>Expected tool names when tools/list is unavailable. --request-overrides, --request-overrides-fileJSONExtra request fields to merge.
Flag Value Default Description --mcp-transportstdio | httpstdioTransport type. --mcp-command<CMD>Server command (stdio). --mcp-args<ARGS>Server arguments (stdio). --mcp-url<URL>Server URL (HTTP). --mcp-timeout-ms<MS>30000MCP request timeout. --mcp-expected-server-name<NAME>Expected initialize.serverInfo.name. --disable-tool-schema-poisoningSkip tool schema poisoning checks. --tool-schema-threshold<0-1>0.75Minimum confidence for schema poisoning matches.
See MCP for examples.
Flag Value Default Description --verify-llmLLM verification of borderline detections. --verify-provider<NAME>Verification provider. Defaults to the scan provider. --verify-model<NAME>Verification model. --verify-trigger-threshold<0-1>0.85Confidence that triggers verification. --verify-consensusMulti-judge consensus verification. --verify-judges<LIST>provider:model pairs for consensus judges. --verify-consensus-strategymajority | unanimous | weightedmajorityHow judges combine.
Flag Value Default Description --cli-command<CMD>CLI command for agent testing. --cli-agent<NAME>CLI agent name. --ssh-hostuser@hostRun the CLI agent over SSH.
See CLI agents for capability flags.
Variable Description ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY, MISTRAL_API_KEY, DEEPSEEK_API_KEY, GROQ_API_KEY, TOGETHER_API_KEY, NVIDIA_API_KEY, MOONSHOT_API_KEY, ZAI_API_KEY, BASETEN_API_KEYProvider API keys TACHYONIC_API_KEYWorkspace API key for Tachyonic; use provider-specific variables for model credentials TACHYONIC_API_URLAPI origin; default https://api.tachyonic.sh TACHYONIC_VERIFY_API_KEYAPI key for the verification provider TACHYONIC_LIBRARY_PATHAttack library root. Default ~/.tachyonic/library. HEURISTICS_PATH is the older name and still works TACHYONIC_HOMECredentials, platform session and scan state. Default ~/.tachyonic RUST_LOGLog level: info, debug, tachyonic=debug
The compatibility command tachyonic doctor prints resolved paths.
Code Meaning 0The command completed; sandbox exec and shell return the remote command's own exit code 1The command failed, for example on a network, auth or verification error 2Invalid arguments 69API unreachable or unavailable 75Sandbox capacity or concurrency unavailable; retry later 77Login, permission, budget, or allowance requires action
The additional codes describe sandbox and workspace failures. Runtime and
compatibility scan commands retain their own existing failure behavior.