CLI Commands Reference¶

Complete reference for the cloudslash CLI. All commands are also available via the cs shorthand alias: both names are interchangeable.

# These are identical:
cloudslash scan --format=sarif
cs scan --format=sarif

Global Persistent Flags & Environment¶

The binary accepts persistent flags that apply across commands, as well as environment variables prefixed with CLOUDSLASH_. Flags override environment variables, which in turn supersede configuration file defaults.

Command Matrix¶

Command Reference¶

scan¶

Stateless shift-left infrastructure scanner for CI/CD and local development. Discovers cloud resources via gRPC plugins, evaluates heuristic waste patterns, evaluates CEL rules, and enforces exit-code gates.

cs scan [flags]

Exit Codes¶

• 0: Scan succeeded; all findings below --fail-on threshold.
• 1: Findings exceeded --fail-on threshold (CI build failure).
• 2: Cost increased by more than --cost-threshold since last scan.
• 3: Infrastructure drift detected with --compare-to-baseline.

init¶

Interactive setup wizard. Detects local cloud credentials, provisions the graph store, and writes the local config.

cs init

config¶

Configuration manager for viewing and modifying settings in ~/.cloudslash/cloudslash.yaml.

cs config                          # Interactive configuration wizard
cs config get <key>                # Read a configuration value
cs config set <key> <value>        # Set a configuration value
cs config path                     # Display path to active configuration file

doctor¶

Dynamic system health diagnostic suite that cross-references credentials, plugins, snapshots, and local storage with auto-repair capabilities.

cs doctor           # Run diagnostic checks
cs doctor --fix     # Automatically repair fixable errors

tui¶

Launches the terminal user interface (TUI) powered by Bubbletea, providing quad-pane visualization of the resource topology, waste findings, and remediation controls.

cs tui

watch¶

Runs the engine in continuous in-process scanning mode on a periodic interval, diffing subsequent runs and reporting modifications.

cs watch [flags]

schedule¶

Installs periodic scans in the operating system's own scheduler instead of keeping a process alive. Each tick runs a normal cloudslash scan, inheriting your credential chain and writing the same snapshot and history. CloudSlash starts no daemon and stores no credentials for scheduled runs.

cs schedule add [-- scan flags]
cs schedule list
cs schedule remove [name]

Extra arguments after -- are appended to the scan invocation, e.g. cs schedule add --every 6h -- --region all.

Installers by platform: launchd (~/Library/LaunchAgents/dev.cloudslash.scan.<name>.plist) on macOS, systemd user timer (cloudslash-scan-<name>.timer) on Linux, and crontab as a fallback. Installing replaces an existing job with the same name; the first run happens after one interval, never at install time. Output goes to ~/.cloudslash/logs/schedule-<name>.log.

cs schedule add --every 15m
cs schedule list
tail -f ~/.cloudslash/logs/schedule-scan.log
cs schedule remove scan

Scheduled runs are ordinary scans: they update ~/.cloudslash/graph.snap, feed cs history, cs diff, cs trend, and keep cs tui warm. Use cs watch instead when you want a foreground loop that streams diffs.

drift¶

Performs a live scan and diffs discovered resources against the latest local snapshot to identify unmanaged or missing resources.

cs drift [flags]

diff¶

Compares infrastructure snapshots over time to highlight new waste, resolved waste, and dollar cost movement.

cs diff [flags]

trend¶

Renders terminal sparklines depicting cost and waste movements over historical scan snapshots.

cs trend [flags]

audit¶

Generates an M&A due-diligence infrastructure audit report in structured JSON format, detailing spend, waste percentage, attribution coverage, and prioritized remediations.

cs audit --target "Company Name" [flags]

chargeback¶

Generates an executive-ready, three-sheet Excel (.xlsx) workbook categorizing cloud spend and waste by team and attribution owner based on ~/.cloudslash/org-map.yaml.

cs chargeback [flags]

plan¶

Scans infrastructure and outputs an actionable remediation plan JSON ordered by highest projected dollar savings.

cs plan [flags]

approval¶

CLI workflow for managing human sign-offs on remediation requests requiring quorum.

cs approval list                     # List all pending approval requests
cs approval approve <request-id>     # Approve pending request
cs approval reject <request-id>      # Reject and veto pending request

remediate¶

Executes a remediation plan locally via the SAU engine, taking safe snapshots and enforcing rollback availability.

cs remediate [flags]

revert¶

Reviews recent destructive interventions (purge and quarantine) from the immutable audit ledger to prepare reversal or restoration.

cs revert [flags]

policy¶

Developer toolkit for authoring, compiling, and testing Common Expression Language (CEL) policy packs.

cs policy validate rules.yaml    # Check CEL syntax and schema validity
cs policy test rules.yaml        # Dry-run policy against latest scan snapshot
cs policy lint rules.yaml        # Scan rules for common logical errors

permissions¶

Inspects installed plugin manifests and computes a least-privilege IAM policy containing only the exact cloud actions required for scanning and remediation.

cs permissions [flags]

plugin¶

Complete lifecycle management for provider plugins and policy packs.

cs plugin search [query]          # Search registry for plugins or policies
cs plugin install <name>          # Install plugin from registry or GitHub
cs plugin list                    # List all installed plugins and load status
cs plugin uninstall <name>        # Remove an installed plugin from disk
cs plugin create <name>           # Scaffold a new gRPC plugin project
cs plugin local install <url>     # Install plugin directly from file/URL
cs plugin local list              # List local plugins bypassing registry
cs plugin status                  # Show user's published plugins
cs plugin verify                  # Validate manifest and binary before publishing

codegen¶

Metagraph compiler tool that reads a Terraform provider schema (terraform providers schema -json) and generates deterministic Go structs with graph edge helpers and trait injectors.

cs codegen --schema=aws.json --output=./generated/

login & logout¶

Authenticate your local CLI session with the CloudSlash Horizon SaaS platform via a browser-based OAuth loopback flow.

cs login     # Opens system browser for OAuth authentication
cs logout    # Destroys local session token

sync¶

Uploads the most recent local scan snapshot (~/.cloudslash/state/latest.json) to CloudSlash Horizon so team dashboards reflect live infrastructure.

cs sync [flags]

status¶

Provides an immediate terminal snapshot of discovered nodes, active waste, estimated monthly savings, and drift counts.

cs status

history¶

Queries the persistent event ledger in BadgerDB (~/.cloudslash/data/eventstore) containing records of scans, approvals, policy changes, and remediations.

cs history [flags]

upgrade¶

Checks GitHub Releases for new CloudSlash versions and performs an atomic binary swap.

cs upgrade [flags]

uninstall¶

Safely cleans up CloudSlash storage (~/.cloudslash), terminates daemon processes, and displays removal instructions.

cs uninstall [flags]