CLI Inspection & Management Commands¶
What you'll learn: How to inspect agents, policies, manifests, and assignments from the command line.
The examples use an illustrative workspace with two active agents, one inactive agent, and manifests in a connected repository. Your IDs and rows will differ. Help and table wrapping depend on terminal width.
kyvvu list-agents¶
List the registered agents in your workspace. Deactivated agents are left out
unless you pass --include-inactive.
Usage: kyvvu list-agents [OPTIONS]
List registered agents.
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ --environment <str> Filter by environment (development, qa, staging, production) │
│ --include-inactive Include inactive (deactivated) agents │
│ --help Show this message and exit. │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Example¶
$ kyvvu list-agents
┏━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━┳━━━━━━━━┓
┃ AGENT_KEY ┃ AGENT_ID ┃ NAME ┃ ENVIRONMENT ┃ ACTIVE ┃
┡━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━╇━━━━━━━━┩
│ hello-kyvvu │ agent_3f9c2a1b7d4e8f60 │ Hello Kyvvu │ development │ ✓ │
│ gmail-assistant │ agent_8e1d47c09b2a5f13 │ Gmail Assistant │ production │ ✓ │
└─────────────────┴────────────────────────┴─────────────────┴─────────────┴────────┘
With --include-inactive, a deactivated agent is listed and marked ✗ in the
ACTIVE column:
$ kyvvu list-agents --include-inactive
┏━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━┳━━━━━━━━┓
┃ AGENT_KEY ┃ AGENT_ID ┃ NAME ┃ ENVIRONMENT ┃ ACTIVE ┃
┡━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━╇━━━━━━━━┩
│ hello-kyvvu │ agent_3f9c2a1b7d4e8f60 │ Hello Kyvvu │ development │ ✓ │
│ gmail-assistant │ agent_8e1d47c09b2a5f13 │ Gmail Assistant │ production │ ✓ │
│ old-triage-bot │ agent_c52e90d17a4b3f88 │ Old Triage Bot │ production │ ✗ │
└─────────────────┴────────────────────────┴─────────────────┴─────────────┴────────┘
Requires an active CLI session (kyvvu auth).
kyvvu list-policies¶
List policies for your organization, optionally filtered by agent.
Usage: kyvvu list-policies [OPTIONS]
List policies.
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ --agent-id <str> Filter by agent: its agent_... id or its agent key │
│ --enforcement-point <str> Filter by enforcement point (agent_registration, step_execution) │
│ --enabled --disabled Filter by enabled state │
│ --help Show this message and exit. │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Example¶
$ kyvvu list-policies --agent-id hello-kyvvu
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━┓
┃ NAME ┃ ENFORCEMENT POINT ┃ RULE_TYPE ┃ SEVERITY ┃ SOURCE ┃ ENABLED ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━┩
│ Agent must declare a substantive purpose │ agent_registration │ field_matches_regex │ high │ kyvvu-manifests-public/manifests/security/owasp-agentic-defau… │ ✓ │
│ Tool calls must be in the declared allowlist │ step_execution │ step_name_in_allowlist │ critical │ kyvvu-manifests-public/manifests/security/owasp-agentic-defau… │ ✓ │
└──────────────────────────────────────────────┴────────────────────┴────────────────────────┴──────────┴────────────────────────────────────────────────────────────────┴─────────┘
The Source column shows the path of the manifest the policy came from (or - for manually created policies).
Requires an active CLI session (kyvvu auth).
kyvvu list-manifests¶
List available manifests from connected GitHub repositories.
Usage: kyvvu list-manifests [OPTIONS]
List available manifests from connected repositories.
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ --repo-id <int> Filter by repo ID │
│ --help Show this message and exit. │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Example¶
$ kyvvu list-manifests
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━┳━━━━━━━┓
┃ MANIFEST ┃ FILE ┃ SOURCE ┃ REPO ID ┃ POLICIES ┃ VALID ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━╇━━━━━━━┩
│ OWASP Top 10 for Agentic Applications - Default Security Template │ manifests/security/owasp-agentic-default.yaml │ Kyvvu/manifests │ 1 │ 8 │ ✓ │
│ EU AI Act - Minimal / Limited Risk Compliance │ manifests/compliance/eu-ai-act-minimal.yaml │ Kyvvu/manifests │ 1 │ 7 │ ✓ │
└───────────────────────────────────────────────────────────────────┴───────────────────────────────────────────────┴─────────────────┴─────────┴──────────┴───────┘
If no repositories are connected, you'll see a message directing you to the dashboard.
Requires an active CLI session (kyvvu auth).
kyvvu assign-manifest¶
Assign a manifest to an agent, creating policies automatically.
Usage: kyvvu assign-manifest [OPTIONS]
Assign a manifest to an agent.
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ * --agent-id <str> The agent: its agent_... id or its agent key [required] │
│ * --repo-id <int> Repository ID [required] │
│ * --manifest <str> Manifest file path [required] │
│ --help Show this message and exit. │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
--agent-id takes either the id the platform assigned (agent_…, the
AGENT_ID column of kyvvu list-agents) or the agent key your code registers
with (the AGENT_KEY column). A key is looked up among the workspace's active
agents; if two agents share it, pass the id instead. The same holds for
--agent-id on list-policies and list-assignments.
Example¶
$ kyvvu assign-manifest --agent-id hello-kyvvu --repo-id 1 --manifest manifests/operational/demo.yaml
✓ Assigned 'Kyvvu Demo' to agent agent_3f9c2a1b7d4e8f60 (2 policies created). Assignment id: 12
The assignment id is what kyvvu unassign-manifest takes.
If the platform refuses the assignment, you get its reason on one line, and the command exits 1:
$ kyvvu assign-manifest --agent-id hello-kyvvu --repo-id 1 --manifest manifests/operational/demo.yaml
Error (409 manifest_already_assigned): Manifest 'Kyvvu Demo' is already assigned to this agent at 'manifests/operational/demo.yaml' (assignment 12).
Every CLI command reports a platform error the same way:
Error (<status> <code>): <detail>, the code omitted when the platform sends
none (Error (404): Agent not found.).
Risk filtering is applied automatically — policies with a risk classification higher than the agent's level are skipped.
Requires an active CLI session (kyvvu auth).
kyvvu list-assignments¶
List manifest assignments, optionally filtered by agent.
Usage: kyvvu list-assignments [OPTIONS]
List manifest assignments.
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ --agent-id <str> Filter by agent: its agent_... id or its agent key │
│ --help Show this message and exit. │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Example¶
$ kyvvu list-assignments --agent-id hello-kyvvu
┏━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━┓
┃ ID ┃ AGENT ┃ MANIFEST ┃ POLICIES ┃ SHA ┃ ASSIGNED AT ┃
┡━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━┩
│ 12 │ agent_3f9c2a1b7d4e8f60 │ Kyvvu Demo │ 2 │ 3523abc │ 2026-10-16 │
│ 9 │ agent_3f9c2a1b7d4e8f60 │ OWASP Top 10 for Agentic Applications │ 8 │ f91de02 │ 2026-10-16 │
└────┴────────────────────────┴───────────────────────────────────────┴──────────┴─────────┴─────────────┘
The ID column is the assignment id that kyvvu unassign-manifest takes.
Requires an active CLI session (kyvvu auth).
kyvvu unassign-manifest¶
Remove a manifest assignment (and the policies it created) from an agent.
Usage: kyvvu unassign-manifest [OPTIONS]
Remove a manifest assignment.
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ * --assignment-id <int> Assignment ID (the ID column of list-assignments) [required] │
│ --help Show this message and exit. │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Example¶
$ kyvvu unassign-manifest --assignment-id 12
✓ Assignment 12 removed. Policies disabled.
Requires an active CLI session (kyvvu auth).
Other CLI commands¶
| Command | Description | Reference |
|---|---|---|
kyvvu auth |
Log in via the device-code flow | Auth |
kyvvu logout |
Log out | Auth |
kyvvu whoami |
Show current user and account status | Auth |
kyvvu doctor |
Diagnose versions, credentials, and what is actually enforced | Doctor |
kyvvu try |
Enforce policies offline — no account, no API key, no network | Try |
kyvvu init |
Scaffold a project | Init |
kyvvu serve |
Start local engine server | Serve |
kyvvu template show <name> |
Print a template supplied by the Python client (decorator) or by an installed integration package (for example langchain, langgraph, crewai) to copy and edit |
Custom template |
kyvvu integrations |
List the integrations and their install commands | CLI reference |
kyvvu claude … |
The Claude Code plugin's commands | Claude Code |
kyvvu docs |
Print the documentation URLs of the installed packages | CLI reference |
kyvvu explain <rule> |
Describe a rule or exception | CLI reference |
kyvvu schema manifest [--validate <file>] |
Print the manifest JSON schema, or validate a manifest against it | CLI reference |
kyvvu --version |
Print version | — |
Next steps¶
- Manifests — manifest structure and assignment workflow
- Dashboard Guide — visual interface for the same data