CLI Command Reference

Complete reference for every command in @zeuslock/cli (v0.1.x). For installation and first login, start with the CLI quick-start guide. Every data-returning command supports --json for scripting, and --help works on every command and subcommand.

Command index

Credentials and configuration

The CLI uses two different credentials, on purpose. User credentials (a login session or a personal CLI access token from the dashboard CLI page) drive the dashboard-data commands. The organization API key (zl_…, from the dashboard API Keys page) drives the content and SIEM commands, which act for the organization rather than one person.

Environment variables

The config directory (macOS ~/Library/Application Support/zeuslock/, Windows %APPDATA%\ZeusLock\, Linux ~/.config/zeuslock/) holds auth.json (session tokens, 0600), api-key.json (saved org key), and siem-cursors.json (tail cursors). Passwords are never stored, and the CLI never prints stored secrets.

zeuslock auth

zeuslock auth login --email admin@example.com
zeuslock whoami
zeuslock auth api-key set zl_your_org_api_key
zeuslock auth api-key status

auth login

auth api-key set / status / clear

set validates the key against GET /api/rules/sync before saving; status shows the configured state with a masked key; clear removes it. The full key is never printed after saving.

Key precedence for machine-authenticated commands: --api-key flag → ZEUSLOCK_API_KEY → saved key.

zeuslock status

zeuslock status
zeuslock status --api-key zl_your_key_here --require-license
zeuslock status --json

zeuslock scan

zeuslock scan ./secrets.txt
zeuslock scan ./src --fail-on alert
cat prompt.txt | zeuslock scan --stdin --json

Uploads content to POST /api/v1/dlp/analyze under the organization's active DLP policy. Directories are walked recursively (.git skipped) and uploaded in batches of 5 files. A scan that results in alert/block creates a real incident — there is no dry-run.

zeuslock anonymize

zeuslock anonymize customer-data.txt --output customer-data.safe.txt

Sends UTF-8 text to POST /api/v1/anonymize and returns the masked text. Text only — PDF/image/Office files are not supported by the backend endpoint.

zeuslock hook install / run

zeuslock hook install --fail-on alert
zeuslock hook run --json

install writes .git/hooks/pre-commit (0755, --force to replace an existing hook); run scans staged blobs exactly as they will be committed (added/copied/modified/renamed files only) via the same DLP analyze endpoint and blocks the commit at the chosen threshold. Hook incidents carry source=git_pre_commit, platform=git, method=PRE_COMMIT. install --fail-on never is rejected — a hook that never blocks is not enforcement.

zeuslock incidents list / stats / export

zeuslock incidents list --days 7 --severity critical
zeuslock incidents stats --days 30
zeuslock incidents export --days 30 --format csv --output incidents.csv

zeuslock agents / extensions

zeuslock agents list --status offline --search linux
zeuslock agents revoke AGENT-123 --yes
zeuslock extensions status --json

zeuslock users / keys

zeuslock users list --role admin
zeuslock users remove departing@example.com --yes
zeuslock keys list --status active
zeuslock keys create --name rotation-2026-08
zeuslock keys revoke <key_id> --yes

zeuslock shadow-ai / mcp

zeuslock shadow-ai stats --days 30
zeuslock shadow-ai tools --source endpoint --status shadow
zeuslock shadow-ai users --days 7
zeuslock mcp stats
zeuslock mcp events --transport stdio --decision block --method tools/call
zeuslock mcp servers

Both groups follow the dashboard feature gates from GET /api/org: Shadow AI requires settings.shadow_ai_enabled; MCP is on unless settings.mcp_enabled is explicitly false. MCP events are sanitized metadata only — raw prompts are never exposed.

zeuslock siem pull / tail

zeuslock siem pull --api-key zl_your_key_here --severity high --limit 100
zeuslock siem tail --category dlp --interval 10 --cursor-name splunk-prod

Retrieves OCSF events from GET /api/v1/siem/events (org API key auth). pull fetches one page; tail polls continuously and persists its cursor in siem-cursors.json, scoped by API URL, cursor name, category, and severity — so separate consumers can tail independently. Output is JSONL by default, pipe-friendly for SIEM ingestion.

zeuslock deploy gpo-config / agent-verify

zeuslock deploy gpo-config --api-key zl_your_key_here --output zeuslock-deploy
zeuslock deploy gpo-config --artifact agent --create-key-name fleet-deploy
zeuslock deploy agent-verify --hostname CLIENT01 --status online

gpo-config generates local deployment files: Chrome/Edge extension force-install policies and ExtensionSettings JSON, the Windows agent policy .reg (ServerUrl/LicenseKey under HKLM\SOFTWARE\Policies\ZeusLock), an agent-config.json, and a non-secret deployment-summary.json. Extension artifacts require the Business/Enterprise plan. Key source precedence: --api-key → --create-key-name → --key-id → the single active decryptable key. agent-verify checks enrollment/heartbeat against GET /api/agents and exits nonzero when not verified — useful after a GPO rollout.

zeuslock rules get / diff

zeuslock rules get --output zeuslock.rules.yaml
zeuslock rules get --scope policy --policy-id default --format json
zeuslock rules diff zeuslock.rules.yaml

Read-only policy-as-code: get exports live policy state as deterministic YAML/JSON (schema_version: zeuslock.rules.v1, volatile fields stripped so exports diff cleanly); diff compares a local file against live state and exits 1 when differences are found — ready for CI drift checks. There is no import/apply: policies are changed in the dashboard.

Exit codes