CLI reference
Every neurostrike-agent command and its key flags — the same on Linux and Windows.
The agent is a single static binary — neurostrike-agent on Linux, neurostrike-agent.exe on
Windows — and every command below works the same on both. Run neurostrike-agent --help, or
neurostrike-agent <command> --help, on any host for the full detail.
Nothing here contacts a network except the relay (when configured) and the targets you name explicitly. On an air-gapped host, every command runs offline.
Install (Linux)
sudo ./install.sh # installs the binary + state dir, and (air-gapped) the licence
# or run the container image (log in with the registry credential from the dashboard first):
docker login registry.neurostrike.com
docker run -d --network host \
-e AGENT_TOKEN=... -e RELAY_URL=wss://agents.neurostrike.com \
registry.neurostrike.com/agent:latestThe bundle's install.sh drops neurostrike-agent in /usr/local/bin and creates
/var/lib/neurostrike for state. On Windows, use the MSI installer instead —
the commands are identical once installed.
Commands
| Command | What it does |
|---|---|
doctor | Check the host is ready and say what's missing |
init | Write an engagement file (scope, ceiling, retention) |
preflight | Print what a configuration permits — the sign-off sheet |
assess | Assess this host, and a target when you name one |
report | Render a report from a stored assessment |
console | Serve a read-only fleet view of stored assessments |
audit | Verify or export the tamper-evident activity record |
purge | Destroy data past its retention term, with a certificate |
intel | Load or inspect vulnerability data (air-gapped sideload) |
meter | Prepaid scan credits: balance, receipt, top-up |
llm | Check the local reasoning model |
activate | Enroll this host to your tenant (device flow) |
fingerprint | Print this host's machine fingerprint (for air-gapped licensing) |
healthcheck | Report agent health (for container orchestration) |
| (no command) | Run the relay-connected daemon — needs AGENT_TOKEN + RELAY_URL |
Common workflows
Assess this host (assumed breach)
neurostrike-agent doctor
neurostrike-agent assess --require-roe=false
neurostrike-agent report --out assessment.htmlRun an engagement against targets
neurostrike-agent init --engagement "ACME Q1" --allow 10.20.1.0/24 \
--ceiling low_impact_active --retention-days 30 --eea-only
neurostrike-agent preflight --roe .neurostrike/engagement.yaml --target 10.20.1.10
neurostrike-agent assess --roe .neurostrike/engagement.yaml --target 10.20.1.10
neurostrike-agent report --out assessment.html
neurostrike-agent purge --confirm # at the end of the engagementEnroll (relay-connected)
neurostrike-agent activate # prints a code — approve it in the dashboardAir-gapped: activate + sideload data
neurostrike-agent fingerprint # prints this host's fingerprint — send it to NeuroStrike
# …install the licence file you receive, then:
neurostrike-agent intel load /media/usb/cve-bundle.json
neurostrike-agent intel status
neurostrike-agent llm status # check the local reasoning modelKey flags
init — --engagement (required), --allow / --deny (CIDRs/hosts), --ceiling
(read_only…exploit), --retention-days, --eea-only, --require-target, --attended,
--out, --force.
assess — --roe (engagement file), --target (host/CIDR; omit for local-only),
--require-roe (default true; pass =false for a quick host check), --ceiling,
--assumed-breach, --timeout, --db, --findings.
report — --out (default stdout), --from (a specific findings file), --format.
purge — --confirm (required), --older-than-days (0 applies the engagement's retention
term), --out (destruction certificate).
console — --listen, --tls-cert, --tls-key (TLS strongly recommended).
activate — --url (platform URL), --token-file (where to store the token).
audit — audit verify (check the chain), audit export --format cef (for a SIEM).
Configuration
Every setting — scope and rules in the engagement file, plus environment variables — is in the Configuration reference. It applies identically on Linux and Windows.
Help on any host
neurostrike-agent --help
neurostrike-agent assess --help