CLI Overview

The dome CLI is the primary command-line interface for the Dome Platform.

Installation

macOS (Homebrew)

brew trust dome-systems/tap
brew install dome-systems/tap/dome

Homebrew 6 requires the brew trust line before it loads a third-party tap's formulae. Refer to Install for the full walkthrough, including a direct-download alternative.

Global flags

All commands support these flags:

Flag	Type	Description
`--context`	string	Use a specific context (overrides active context)
`--server`	string	Target a different Dome Platform host. Resolves a context for that host (credential and scope), not just the URL.
`--activity`	string	Stable activity ID this run asserts. Every Connect RPC carries `X-Dome-Activity-Id` so audit events from the run share one activity chain. Overrides `DOME_ACTIVITY_ID`.
`--format`	string	Output format: `text`, `json`, or `quiet`
`--json`	bool	Output as JSON
`--quiet`	bool	Minimal output (IDs only)
`--no-color`	bool	Disable colored output

--server does not send the active context's token to a new host. Exactly one stored context for that host is adopted. Several matching contexts is an error that names the candidates — pick one with --context. None falls back to the stored session for that host with the previous workspace cleared. Auth and context commands are exempt, so dome auth login --server still works before any context exists. Naming the same host the active context already uses is a no-op.

Environment variables

Variable	Description
`DOME_API_KEY`	Sets the active context's token. Useful for CI and scripts.
`DOME_ACTIVITY_ID`	Default activity ID for the process. `--activity` overrides it.

Command groups

Connect

Command	Description
`agents`	Manage agent registrations, lifecycle, and API keys
`callers`	Inspect and erase verified end users projected from audit activity
`verification-providers`	Manage the OIDC and HMAC providers that verify end-user identity
`tools`	Manage MCP server connections the gateway proxies
`models`	Manage LLM model connections and routing pools
`gateways`	Manage Gateways, membership, and agent access

Secure

Command	Description
`rules`	Deploy, validate, simulate, and rollback authorization rules
`guards`	Create and assign content Filters and tool Validators
`quotas`	Cap spend, tokens, or calls for workspace, agent, pool, model, Gateway, and tool subjects

Operate

Command	Description
`audit`	Query, stream, and export audit events
`integrations`	List integrations connected to the active workspace
`webhooks`	Manage webhook subscriptions, delivery history, and the provider catalog
`usage`	Show LLM token usage and estimated cost for the active workspace
`usage-caps`	Show free-tier monthly allowances for the active workspace

Manage

Command	Description
`config`	Platform configuration
`platform-keys`	Manage platform API keys
`tenants`	List, inspect, and create tenants
`tenant`	Manage tenant-level Act-As provider selection
`orgs`	Manage organization-level Act-As provider selection
`workspaces`	Manage workspaces, members, Act-As, and verification providers
`billing`	Manage organization plans, seats, invoices, and payment methods

Developer

Command	Description
`quickstart`	Scaffold a new Dome-enabled project
`sandbox`	Provision sandbox environments

Session

Command	Description
`auth`	Authentication management
`context`	Manage CLI contexts (org/tenant/workspace sessions)

Standalone

Command	Description
`mcp`	MCP server for AI agents
`version`	Show CLI version

Next steps

Authenticate first, then scaffold — or drive the same jobs from MCP:

Install to authenticate and select a workspace
Quickstart to scaffold and verify governed traffic
MCP when you prefer tool-based access from an assistant
API for the management and data-plane HTTP surfaces

CLI Overview

On this page