CLI reference

bex blueprints <subcommand> [flags]

# Validate a blueprint file
  bex blueprints validate ./render.yaml

bex blueprints validate [file] [flags]

# Validate ./render.yaml
  bex blueprints validate
 
  # Validate a specific Blueprint file
  bex blueprints validate ./my-blueprint.yaml
 
  # Output validation results as JSON
  bex blueprints validate -o json

bex code [subcommand] [flags]

bex code keys [subcommand] [flags]

bex code keys set <provider> [flags]

bex code keys unset <provider> [flags]

Claude Code - starts an interactive session by default, use -p/--print for
non-interactive output
Arguments:
prompt                                Your prompt
Options:
--add-dir <directories...>            Additional directories to allow tool
access to
--agent <agent>                       Agent for the current session. Overrides
the 'agent' setting.
--agents <json>                       JSON object defining custom agents (e.g.
'{"reviewer": {"description": "Reviews
code", "prompt": "You are a code
reviewer"}}')
--allow-dangerously-skip-permissions  Enable bypassing all permission checks
as an option, without it being enabled
by default. Recommended only for
sandboxes with no internet access.
--allowedTools, --allowed-tools <tools...>
Comma or space-separated list of tool names to allow (e.g. "Bash(git *)
Edit")
--append-system-prompt <prompt>       Append a system prompt to the default
system prompt
--ax-screen-reader                    Render screen-reader friendly output
(flat text, no decorative borders or
animations).
--bg, --background                    Start the session as a background agent
and return immediately (manage with
`claude agents`)
--bare                                Minimal mode: skip hooks, LSP, plugin
sync, attribution, auto-memory,
background prefetches, keychain reads,
and CLAUDE.md auto-discovery. Sets
CLAUDE_CODE_SIMPLE=1. Anthropic auth is
strictly ANTHROPIC_API_KEY or
apiKeyHelper via --settings (OAuth and
keychain are never read). 3P providers
(Bedrock/Vertex/Foundry) use their own
credentials. Skills still resolve via
/skill-name. Explicitly provide context
via: --system-prompt[-file],
--append-system-prompt[-file], --add-dir
(CLAUDE.md dirs), --mcp-config,
--settings, --agents, --plugin-dir.
--betas <betas...>                    Beta headers to include in API requests
(API key users only)
--brief                               Enable SendUserMessage tool for
agent-to-user communication
--chrome                              Enable Claude in Chrome integration
-c, --continue                        Continue the most recent conversation in
the current directory
--dangerously-skip-permissions        Bypass all permission checks.
Recommended only for sandboxes with no
internet access.
-d, --debug [filter]                  Enable debug mode with optional category
filtering (e.g., "api,hooks" or
"!1p,!file")
--debug-file <path>                   Write debug logs to a specific file path
(implicitly enables debug mode)
--disable-slash-commands              Disable all skills
--disallowedTools, --disallowed-tools <tools...>
Comma or space-separated list of tool names to deny (e.g. "Bash(git *)
Edit")
--effort <level>                      Effort level for the current session
(low, medium, high, xhigh, max)
--exclude-dynamic-system-prompt-sections
Move per-machine sections (cwd, env info, memory paths, git status) from
the system prompt into the first user message. Improves cross-user
prompt-cache reuse. Only applies with the default system prompt (ignored
with --system-prompt). (default: false)
--fallback-model <model>              Enable automatic fallback to specified
model(s) when the default model is
overloaded or not available. Accepts a
comma-separated list to try each in
order. Re-tries the primary at the start
of each user turn. (only works with
--print)
--file <specs...>                     File resources to download at startup.
Format: file_id:relative_path (e.g.,
--file file_abc:doc.txt
file_def:img.png)
--fork-session                        When resuming, create a new session ID
instead of reusing the original (use
with --resume or --continue)
--from-pr [value]                     Resume a session linked to a PR by PR
number/URL, or open interactive picker
with optional search term
-h, --help                            Display help for command
--ide                                 Automatically connect to IDE on startup
if exactly one valid IDE is available
--include-hook-events                 Include all hook lifecycle events in the
output stream (only works with
--output-format=stream-json)
--include-partial-messages            Include partial message chunks as they
arrive (only works with --print and
--output-format=stream-json)
--input-format <format>               Input format (only works with --print):
"text" (default), or "stream-json"
(realtime streaming input) (choices:
"text", "stream-json")
--json-schema <schema>                JSON Schema for structured output
validation. Example:
{"type":"object","properties":{"name":{"type":"string"}},"required":["name"]}
--max-budget-usd <amount>             Maximum dollar amount to spend on API
calls (only works with --print)
--mcp-config <configs...>             Load MCP servers from JSON files or
strings (space-separated)
--mcp-debug                           [DEPRECATED. Use --debug instead] Enable
MCP debug mode (shows MCP server errors)
--model <model>                       Model for the current session. Provide
an alias for the latest model (e.g.
'fable', 'opus', or 'sonnet') or a
model's full name (e.g.
'claude-fable-5').
-n, --name <name>                     Set a display name for this session
(shown in the prompt box, /resume
picker, and terminal title)
--no-chrome                           Disable Claude in Chrome integration
--no-session-persistence              Disable session persistence - sessions
will not be saved to disk and cannot be
resumed (only works with --print)
--output-format <format>              Output format (only works with --print):
"text" (default), "json" (single
result), or "stream-json" (realtime
streaming) (choices: "text", "json",
"stream-json")
--permission-mode <mode>              Permission mode to use for the session
(choices: "acceptEdits", "auto",
"bypassPermissions", "default",
"dontAsk", "plan")
--plugin-dir <path>                   Load a plugin from a directory or .zip
for this session only (repeatable:
--plugin-dir A --plugin-dir B.zip)
(default: [])
--plugin-url <url>                    Fetch a plugin .zip from a URL for this
session only (repeatable: --plugin-url A
--plugin-url B) (default: [])
-p, --print                           Print response and exit (useful for
pipes). Note: The workspace trust dialog
is skipped when Claude is run in
non-interactive mode (via -p, or when
stdout is not a TTY, e.g. piped or
redirected output). Only use this in
directories you trust. Settings files
that fail validation are silently
ignored in this mode (no error dialog is
shown).
--prompt-suggestions [value]          Enable prompt suggestions. In print/SDK
mode, emits a prompt_suggestion message
after each turn with a predicted next
user prompt (choices: "true", "false",
"1", "0", "yes", "no", "on", "off",
preset: "true")
--remote-control [name]               Start an interactive session with Remote
Control enabled (optionally named)
--remote-control-session-name-prefix <prefix>
Prefix for auto-generated Remote Control session names (default: hostname)
--replay-user-messages                Re-emit user messages from stdin back on
stdout for acknowledgment (only works
with --input-format=stream-json and
--output-format=stream-json)
-r, --resume [value]                  Resume a conversation by session ID, or
open interactive picker with optional
search term
--safe-mode                           Start with all customizations
(CLAUDE.md, skills, plugins, hooks, MCP
servers, custom commands and agents,
output styles, workflows, custom themes,
keybindings, and more) disabled — useful
for troubleshooting a broken
configuration. Admin-managed (policy)
settings still apply. Auth, model
selection, built-in tools, and
permissions work normally. Sets
CLAUDE_CODE_SAFE_MODE=1.
--session-id <uuid>                   Use a specific session ID for the
conversation (must be a valid UUID)
--setting-sources <sources>           Comma-separated list of setting sources
to load (user, project, local).
--settings <file-or-json>             Path to a settings JSON file or a JSON
string to load additional settings from
--strict-mcp-config                   Only use MCP servers from --mcp-config,
ignoring all other MCP configurations
--system-prompt <prompt>              System prompt to use for the session
--tmux                                Create a tmux session for the worktree
(requires --worktree). Uses iTerm2
native panes when available; use
--tmux=classic for traditional tmux.
--tools <tools...>                    Specify the list of available tools from
the built-in set. Use "" to disable all
tools, "default" to use all tools, or
specify tool names (e.g.
"Bash,Edit,Read").
--verbose                             Override verbose mode setting from
config
-v, --version                         Output the version number
-w, --worktree [name]                 Create a new git worktree for this
session (optionally specify a name)
Commands:
agents [options]                      Manage background agents
auth                                  Manage authentication
auto-mode                             Inspect auto mode classifier
configuration
doctor                                Check the health of your Claude Code
auto-updater. Note: The workspace trust
dialog is skipped and stdio servers from
.mcp.json are spawned for health checks.
Only use this command in directories you
trust.
install [options] [target]            Install Claude Code native build. Use
[target] to specify version (stable,
latest, or specific version)
mcp                                   Configure and manage MCP servers
plugin|plugins                        Manage Claude Code plugins
project                               Manage Claude Code project state
setup-token                           Set up a long-lived authentication token
(requires Claude subscription)
ultrareview [options] [target]        Run a cloud-hosted multi-agent code
review of the current branch (or a PR
number / base branch) and print the
findings
update|upgrade                        Check for updates and install if
available

bex deploys <subcommand> [flags]

# List deploys for a service
  bex deploys list srv-abc123
 
  # Trigger a deploy for a service
  bex deploys create srv-abc123

bex deploys cancel <serviceID> <deployID> [flags]

# Cancel a running deploy
  bex deploys cancel srv-abc123 dep-xyz789

bex deploys create [serviceID] [flags]

# Trigger a deploy for a service
  bex deploys create srv-abc123
 
  # Deploy a specific commit
  bex deploys create srv-abc123 --commit 0123abcd
 
  # Wait until deploy completes
  bex deploys create srv-abc123 --wait

bex deploys list [serviceID] [flags]

# List deploys for a service
  bex deploys list srv-abc123
 
  # Browse deploys interactively
  bex deploys list

bex docs [flags]

# Open Bex documentation
  bex docs

bex ea [subcommand] [flags]

# List early access object storage resources
  bex ea objects list --region=oregon

bex ea objects <subcommand> [flags]

# List objects in object storage
  bex ea objects list --region=oregon
 
  # Upload an object
  bex ea objects put backups/2026-04-15/users.ndjson --file=./exports/users.ndjson --region=oregon
 
  # Download an object
  bex ea objects get backups/2026-04-15/users.ndjson --file=./downloads/users.ndjson --region=oregon
 
  # Delete an object
  bex ea objects delete uploads/test/avatar.png --region=oregon --yes

bex ea objects delete <key> [additionalKeys...] [flags]

# Delete a single object
  bex ea objects delete assets/images/old-logo.png --region=oregon
 
  # Delete multiple objects without confirmation
  bex ea objects delete tmp/import-001.json tmp/import-002.json --region=oregon --yes
 
  # Delete from local object storage
  bex ea objects delete local-dev/fixtures/sample.json --region=oregon --local --yes

bex ea objects get <key> [--file=<path>] [flags]

# Download an object to a file
  bex ea objects get backups/2026-04-15/users.ndjson --file=./downloads/users.ndjson --region=oregon
 
  # Write object content to stdout
  bex ea objects get config/runtime/env.json --region=oregon
 
  # Read from local object storage
  bex ea objects get local-dev/fixtures/sample.json --file=./tmp/sample.json --region=oregon --local

bex ea objects list [flags]

# List objects in cloud storage
  bex ea objects list --region=oregon
 
  # Limit number of objects returned
  bex ea objects list --region=oregon --limit=200
 
  # List objects from local storage
  bex ea objects list --region=oregon --local

bex ea objects put <key> --file=<path> [flags]

# Upload a local file
  bex ea objects put backups/2026-04-15/users.ndjson --file=./exports/users.ndjson --region=oregon
 
  # Upload with a relative file path
  bex ea objects put assets/images/logo.png --file=./public/logo.png --region=oregon
 
  # Upload to local object storage
  bex ea objects put local-dev/fixtures/sample.json --file=./fixtures/sample.json --region=oregon --local

bex ea sandbox-groups <subcommand> [flags]

bex ea sandbox-groups list
  bex ea sandbox-groups list -o json

bex ea sandbox-groups list [flags]

# List sandbox groups in the active workspace
  bex ea sandbox-groups list
 
  # Output as JSON
  bex ea sandbox-groups list -o json

bex ea sandboxes <subcommand> [flags]

bex ea sandboxes create
  bex ea sandboxes create --plan=standard --region=oregon
  bex ea sandboxes create --snapshot-id snp-abc123
  bex ea sandboxes copy ./main.py sbx-abc123:/app/main.py
  bex ea sandboxes exec sbx-abc123 -- echo hello
  bex ea sandboxes snapshots create sbx-abc123
  bex ea sandboxes snapshots list --group sbg-abc123
  bex ea sandboxes stop sbx-abc123 --confirm

bex ea sandboxes copy <src> <dst> [flags]

bex ea sandboxes copy ./main.py sbx-abc123:main.py
  bex ea sandboxes copy sbx-abc123:output.json ./output.json
  bex ea sandboxes copy ./src sbx-abc123:/tmp/src
  bex ea sandboxes cp sbx-abc123:. ./sandbox-home
  bex ea sandboxes copy sbx-abc123:output.json ./downloads/ --output json

bex ea sandboxes create [flags]

bex ea sandboxes create
  bex ea sandboxes create --plan=standard --region=oregon
  bex ea sandboxes create --timeout=3600
  bex ea sandboxes create --network-policy=deny-all
  bex ea sandboxes create --env-var FOO=bar --env-var BAZ=qux
  bex ea sandboxes create --env-file .env.production --env-var LOG_LEVEL=debug
  bex ea sandboxes create --snapshot-id snp-abc123

bex ea sandboxes exec <sandboxId> -- <command> [flags]

bex ea sandboxes exec sbx-abc123 -- echo hello
  bex ea sandboxes exec sbx-abc123 -- python script.py

bex ea sandboxes list [flags]

bex ea sandboxes list
  bex ea sandboxes list --all
  bex ea sandboxes list --status=running
  bex ea sandboxes list --status=running --status=creating
  bex ea sandboxes list -o json

bex ea sandboxes snapshots <subcommand> [flags]

# Snapshot a running sandbox
  bex ea sandboxes snapshots create sbx-abc123
 
  # List the snapshots in the default sandbox group
  bex ea sandboxes snapshots list
 
  # List the snapshots in a specific sandbox group
  bex ea sandboxes snapshots list --group sbg-abc123
 
  # Get one snapshot
  bex ea sandboxes snapshots get snp-abc123

bex ea sandboxes snapshots create <sandboxId> [flags]

# Snapshot the filesystem (default)
  bex ea sandboxes snapshots create sbx-abc123
 
  # Also capture memory and CPU state
  bex ea sandboxes snapshots create sbx-abc123 --kind runtime
 
  # JSON output
  bex ea sandboxes snapshots create sbx-abc123 --output json

bex ea sandboxes snapshots get <snapshotId> [flags]

# Get a snapshot
  bex ea sandboxes snapshots get snp-abc123
 
  # Get a snapshot in a specific group
  bex ea sandboxes snapshots get snp-abc123 --group sbg-abc123
 
  # JSON output
  bex ea sandboxes snapshots get snp-abc123 --output json

bex ea sandboxes snapshots list [flags]

# List every snapshot in the default sandbox group
  bex ea sandboxes snapshots list
 
  # List snapshots in a specific group
  bex ea sandboxes snapshots list --group sbg-abc123
 
  # Only snapshots that are ready to start a sandbox from
  bex ea sandboxes snapshots list --status available
 
  # JSON output
  bex ea sandboxes snapshots list --output json

bex ea sandboxes stop <sandboxId> [flags]

# Preview termination (no changes made)
  bex ea sandboxes stop sbx-abc123
 
  # Terminate the sandbox
  bex ea sandboxes stop sbx-abc123 --confirm
 
  # JSON output
  bex ea sandboxes stop sbx-abc123 --confirm --output json

bex environments <projectID> [flags]

# List environments for a project
  bex environments prj-abc123

Claude Code - starts an interactive session by default, use -p/--print for
non-interactive output
Arguments:
prompt                                Your prompt
Options:
--add-dir <directories...>            Additional directories to allow tool
access to
--agent <agent>                       Agent for the current session. Overrides
the 'agent' setting.
--agents <json>                       JSON object defining custom agents (e.g.
'{"reviewer": {"description": "Reviews
code", "prompt": "You are a code
reviewer"}}')
--allow-dangerously-skip-permissions  Enable bypassing all permission checks
as an option, without it being enabled
by default. Recommended only for
sandboxes with no internet access.
--allowedTools, --allowed-tools <tools...>
Comma or space-separated list of tool names to allow (e.g. "Bash(git *)
Edit")
--append-system-prompt <prompt>       Append a system prompt to the default
system prompt
--ax-screen-reader                    Render screen-reader friendly output
(flat text, no decorative borders or
animations).
--bg, --background                    Start the session as a background agent
and return immediately (manage with
`claude agents`)
--bare                                Minimal mode: skip hooks, LSP, plugin
sync, attribution, auto-memory,
background prefetches, keychain reads,
and CLAUDE.md auto-discovery. Sets
CLAUDE_CODE_SIMPLE=1. Anthropic auth is
strictly ANTHROPIC_API_KEY or
apiKeyHelper via --settings (OAuth and
keychain are never read). 3P providers
(Bedrock/Vertex/Foundry) use their own
credentials. Skills still resolve via
/skill-name. Explicitly provide context
via: --system-prompt[-file],
--append-system-prompt[-file], --add-dir
(CLAUDE.md dirs), --mcp-config,
--settings, --agents, --plugin-dir.
--betas <betas...>                    Beta headers to include in API requests
(API key users only)
--brief                               Enable SendUserMessage tool for
agent-to-user communication
--chrome                              Enable Claude in Chrome integration
-c, --continue                        Continue the most recent conversation in
the current directory
--dangerously-skip-permissions        Bypass all permission checks.
Recommended only for sandboxes with no
internet access.
-d, --debug [filter]                  Enable debug mode with optional category
filtering (e.g., "api,hooks" or
"!1p,!file")
--debug-file <path>                   Write debug logs to a specific file path
(implicitly enables debug mode)
--disable-slash-commands              Disable all skills
--disallowedTools, --disallowed-tools <tools...>
Comma or space-separated list of tool names to deny (e.g. "Bash(git *)
Edit")
--effort <level>                      Effort level for the current session
(low, medium, high, xhigh, max)
--exclude-dynamic-system-prompt-sections
Move per-machine sections (cwd, env info, memory paths, git status) from
the system prompt into the first user message. Improves cross-user
prompt-cache reuse. Only applies with the default system prompt (ignored
with --system-prompt). (default: false)
--fallback-model <model>              Enable automatic fallback to specified
model(s) when the default model is
overloaded or not available. Accepts a
comma-separated list to try each in
order. Re-tries the primary at the start
of each user turn. (only works with
--print)
--file <specs...>                     File resources to download at startup.
Format: file_id:relative_path (e.g.,
--file file_abc:doc.txt
file_def:img.png)
--fork-session                        When resuming, create a new session ID
instead of reusing the original (use
with --resume or --continue)
--from-pr [value]                     Resume a session linked to a PR by PR
number/URL, or open interactive picker
with optional search term
-h, --help                            Display help for command
--ide                                 Automatically connect to IDE on startup
if exactly one valid IDE is available
--include-hook-events                 Include all hook lifecycle events in the
output stream (only works with
--output-format=stream-json)
--include-partial-messages            Include partial message chunks as they
arrive (only works with --print and
--output-format=stream-json)
--input-format <format>               Input format (only works with --print):
"text" (default), or "stream-json"
(realtime streaming input) (choices:
"text", "stream-json")
--json-schema <schema>                JSON Schema for structured output
validation. Example:
{"type":"object","properties":{"name":{"type":"string"}},"required":["name"]}
--max-budget-usd <amount>             Maximum dollar amount to spend on API
calls (only works with --print)
--mcp-config <configs...>             Load MCP servers from JSON files or
strings (space-separated)
--mcp-debug                           [DEPRECATED. Use --debug instead] Enable
MCP debug mode (shows MCP server errors)
--model <model>                       Model for the current session. Provide
an alias for the latest model (e.g.
'fable', 'opus', or 'sonnet') or a
model's full name (e.g.
'claude-fable-5').
-n, --name <name>                     Set a display name for this session
(shown in the prompt box, /resume
picker, and terminal title)
--no-chrome                           Disable Claude in Chrome integration
--no-session-persistence              Disable session persistence - sessions
will not be saved to disk and cannot be
resumed (only works with --print)
--output-format <format>              Output format (only works with --print):
"text" (default), "json" (single
result), or "stream-json" (realtime
streaming) (choices: "text", "json",
"stream-json")
--permission-mode <mode>              Permission mode to use for the session
(choices: "acceptEdits", "auto",
"bypassPermissions", "default",
"dontAsk", "plan")
--plugin-dir <path>                   Load a plugin from a directory or .zip
for this session only (repeatable:
--plugin-dir A --plugin-dir B.zip)
(default: [])
--plugin-url <url>                    Fetch a plugin .zip from a URL for this
session only (repeatable: --plugin-url A
--plugin-url B) (default: [])
-p, --print                           Print response and exit (useful for
pipes). Note: The workspace trust dialog
is skipped when Claude is run in
non-interactive mode (via -p, or when
stdout is not a TTY, e.g. piped or
redirected output). Only use this in
directories you trust. Settings files
that fail validation are silently
ignored in this mode (no error dialog is
shown).
--prompt-suggestions [value]          Enable prompt suggestions. In print/SDK
mode, emits a prompt_suggestion message
after each turn with a predicted next
user prompt (choices: "true", "false",
"1", "0", "yes", "no", "on", "off",
preset: "true")
--remote-control [name]               Start an interactive session with Remote
Control enabled (optionally named)
--remote-control-session-name-prefix <prefix>
Prefix for auto-generated Remote Control session names (default: hostname)
--replay-user-messages                Re-emit user messages from stdin back on
stdout for acknowledgment (only works
with --input-format=stream-json and
--output-format=stream-json)
-r, --resume [value]                  Resume a conversation by session ID, or
open interactive picker with optional
search term
--safe-mode                           Start with all customizations
(CLAUDE.md, skills, plugins, hooks, MCP
servers, custom commands and agents,
output styles, workflows, custom themes,
keybindings, and more) disabled — useful
for troubleshooting a broken
configuration. Admin-managed (policy)
settings still apply. Auth, model
selection, built-in tools, and
permissions work normally. Sets
CLAUDE_CODE_SAFE_MODE=1.
--session-id <uuid>                   Use a specific session ID for the
conversation (must be a valid UUID)
--setting-sources <sources>           Comma-separated list of setting sources
to load (user, project, local).
--settings <file-or-json>             Path to a settings JSON file or a JSON
string to load additional settings from
--strict-mcp-config                   Only use MCP servers from --mcp-config,
ignoring all other MCP configurations
--system-prompt <prompt>              System prompt to use for the session
--tmux                                Create a tmux session for the worktree
(requires --worktree). Uses iTerm2
native panes when available; use
--tmux=classic for traditional tmux.
--tools <tools...>                    Specify the list of available tools from
the built-in set. Use "" to disable all
tools, "default" to use all tools, or
specify tool names (e.g.
"Bash,Edit,Read").
--verbose                             Override verbose mode setting from
config
-v, --version                         Output the version number
-w, --worktree [name]                 Create a new git worktree for this
session (optionally specify a name)
Commands:
agents [options]                      Manage background agents
auth                                  Manage authentication
auto-mode                             Inspect auto mode classifier
configuration
doctor                                Check the health of your Claude Code
auto-updater. Note: The workspace trust
dialog is skipped and stdio servers from
.mcp.json are spawned for health checks.
Only use this command in directories you
trust.
install [options] [target]            Install Claude Code native build. Use
[target] to specify version (stable,
latest, or specific version)
mcp                                   Configure and manage MCP servers
plugin|plugins                        Manage Claude Code plugins
project                               Manage Claude Code project state
setup-token                           Set up a long-lived authentication token
(requires Claude subscription)
ultrareview [options] [target]        Run a cloud-hosted multi-agent code
review of the current branch (or a PR
number / base branch) and print the
findings
update|upgrade                        Check for updates and install if
available

bex jobs <subcommand> [flags]

# List jobs for a service
  bex jobs list srv-abc123
 
  # Create a job for a service
  bex jobs create srv-abc123 --start-command "bundle exec rake task"

bex jobs cancel <serviceID> <jobID> [flags]

# Cancel a running job
  bex jobs cancel srv-abc123 job-xyz789

bex jobs create [serviceID] [flags]

# Create a job for a service
  bex jobs create srv-abc123 --start-command "bundle exec rake task"
 
  # Create a job with a specific plan
  # See https://render.com/docs/one-off-jobs for available job plans
  bex jobs create srv-abc123 --start-command "npm run worker" --plan-id plan-srv-006

bex jobs list [serviceID] [flags]

# List jobs for a service
  bex jobs list srv-abc123
 
  # Browse jobs interactively
  bex jobs list

bex keyvalues <subcommand> [flags]

bex keyvalues create [flags]

# Interactive wizard (guided prompts for each option)
  bex kv create
 
  # Specify all options; wizard still asks for confirmation before creating
  bex kv create --name my-cache --plan 256mb --region oregon
 
  # Skip all prompts and create immediately (no confirmation)
  bex kv create --name my-cache --plan free --confirm
 
  # Machine-readable output (non-interactive, no prompts)
  bex kv create --name my-cache --plan 256mb --output json
 
  # Use as a cache with no on-disk persistence
  bex kv create --name my-cache --plan 256mb --persistence-mode off
 
  # With IP allow-listing (repeat the flag for multiple entries)
  bex kv create --name my-cache \
    --ip-allow-list "cidr=203.0.113.5/32,description=office" \
    --ip-allow-list "cidr=10.0.0.0/8,description=internal"

bex keyvalues delete <keyValueID|keyValueName> [flags]

# Preview deletion (no changes made)
  bex kv delete red-abc123def456ghi789jkl0
 
  # Delete by ID
  bex kv delete red-abc123def456ghi789jkl0 --confirm
 
  # Delete by name
  bex kv delete my-cache --confirm
 
  # Disambiguate a name that exists in multiple environments
  bex kv delete my-cache --environment production --confirm
 
  # JSON output
  bex kv delete red-abc123def456ghi789jkl0 --confirm --output json

bex keyvalues get <keyValueID|keyValueName> [flags]

# Get by ID
  bex kv get red-abc123def456ghi789jkl0
 
  # Get by name
  bex kv get my-cache
 
  # Include connection strings (contains credentials)
  bex kv get my-cache --include-sensitive-connection-info
 
  # Disambiguate by project
  bex kv get my-cache --project my-project
 
  # Disambiguate a name that exists in multiple environments
  bex kv get my-cache --environment production
 
  # JSON output
  bex kv get red-abc123def456ghi789jkl0 --output json

bex keyvalues list [flags]

# List all Key Value instances in the active workspace
  bex kv list
 
  # List all Key Value instances in a project
  bex kv list --project my-project
 
  # Filter by environment name
  bex kv list --environment production
 
  # Disambiguate an environment name by project
  bex kv list --project my-project --environment production
 
  # JSON output
  bex kv list --output json

bex keyvalues resume <keyValueID|keyValueName> [flags]

# Resume by ID
  bex kv resume red-abc123def456ghi789jkl0
 
  # Resume by name
  bex kv resume my-cache
 
  # Disambiguate a name that exists in multiple environments
  bex kv resume my-cache --environment production
 
  # JSON output
  bex kv resume red-abc123def456ghi789jkl0 --output json

bex keyvalues suspend <keyValueID|keyValueName> [flags]

# Preview suspension (no changes made)
  bex kv suspend red-abc123def456ghi789jkl0
 
  # Suspend by ID
  bex kv suspend red-abc123def456ghi789jkl0 --confirm
 
  # Suspend by name
  bex kv suspend my-cache --confirm
 
  # Disambiguate a name that exists in multiple environments
  bex kv suspend my-cache --environment production --confirm
 
  # JSON output
  bex kv suspend red-abc123def456ghi789jkl0 --confirm --output json

bex keyvalues update <keyValueID|keyValueName> [flags]

Update an existing Bex Key Value instance.
 
The positional argument is the target Key Value (ID red-... or name). At least
one mutating flag must be supplied. Use --name to rename the instance; the
positional argument always identifies the target and is never the new name.
 
Environment, project, workspace, and region are immutable. A Key Value instance
cannot be moved between them; the --environment flag is for name disambiguation
only.
 
Name lookup is scoped to your active workspace. If a name isn't found, switch
workspaces with 'bex workspace set <name|ID>' and try again, or pass the
Key Value ID instead (which works across workspaces). If a name matches more
than one instance, narrow the search with --environment <id|name>.
 
The --ip-allow-list flag replaces the server-side list; pass it once per entry.
To remove all allow-list entries, pass --clear-ip-allow-list. The two flags are
mutually exclusive.

# Rename
  bex kv update red-abc123def456ghi789jkl0 --name new-cache-name
 
  # Change plan
  bex kv update my-cache --plan 1g
 
  # Replace the IP allow-list (entire list, not append)
  bex kv update my-cache \
    --ip-allow-list "cidr=203.0.113.5/32,description=office" \
    --ip-allow-list "cidr=10.0.0.0/8,description=internal"
 
  # Clear the IP allow-list
  bex kv update my-cache --clear-ip-allow-list
 
  # Disambiguate a name that exists in multiple environments
  bex kv update my-cache --environment production --memory-policy queue
 
  # Turn off on-disk persistence
  bex kv update my-cache --persistence-mode off
 
  # JSON output
  bex kv update red-abc123def456ghi789jkl0 --plan 5g --output json

Claude Code - starts an interactive session by default, use -p/--print for
non-interactive output
Arguments:
prompt                                Your prompt
Options:
--add-dir <directories...>            Additional directories to allow tool
access to
--agent <agent>                       Agent for the current session. Overrides
the 'agent' setting.
--agents <json>                       JSON object defining custom agents (e.g.
'{"reviewer": {"description": "Reviews
code", "prompt": "You are a code
reviewer"}}')
--allow-dangerously-skip-permissions  Enable bypassing all permission checks
as an option, without it being enabled
by default. Recommended only for
sandboxes with no internet access.
--allowedTools, --allowed-tools <tools...>
Comma or space-separated list of tool names to allow (e.g. "Bash(git *)
Edit")
--append-system-prompt <prompt>       Append a system prompt to the default
system prompt
--ax-screen-reader                    Render screen-reader friendly output
(flat text, no decorative borders or
animations).
--bg, --background                    Start the session as a background agent
and return immediately (manage with
`claude agents`)
--bare                                Minimal mode: skip hooks, LSP, plugin
sync, attribution, auto-memory,
background prefetches, keychain reads,
and CLAUDE.md auto-discovery. Sets
CLAUDE_CODE_SIMPLE=1. Anthropic auth is
strictly ANTHROPIC_API_KEY or
apiKeyHelper via --settings (OAuth and
keychain are never read). 3P providers
(Bedrock/Vertex/Foundry) use their own
credentials. Skills still resolve via
/skill-name. Explicitly provide context
via: --system-prompt[-file],
--append-system-prompt[-file], --add-dir
(CLAUDE.md dirs), --mcp-config,
--settings, --agents, --plugin-dir.
--betas <betas...>                    Beta headers to include in API requests
(API key users only)
--brief                               Enable SendUserMessage tool for
agent-to-user communication
--chrome                              Enable Claude in Chrome integration
-c, --continue                        Continue the most recent conversation in
the current directory
--dangerously-skip-permissions        Bypass all permission checks.
Recommended only for sandboxes with no
internet access.
-d, --debug [filter]                  Enable debug mode with optional category
filtering (e.g., "api,hooks" or
"!1p,!file")
--debug-file <path>                   Write debug logs to a specific file path
(implicitly enables debug mode)
--disable-slash-commands              Disable all skills
--disallowedTools, --disallowed-tools <tools...>
Comma or space-separated list of tool names to deny (e.g. "Bash(git *)
Edit")
--effort <level>                      Effort level for the current session
(low, medium, high, xhigh, max)
--exclude-dynamic-system-prompt-sections
Move per-machine sections (cwd, env info, memory paths, git status) from
the system prompt into the first user message. Improves cross-user
prompt-cache reuse. Only applies with the default system prompt (ignored
with --system-prompt). (default: false)
--fallback-model <model>              Enable automatic fallback to specified
model(s) when the default model is
overloaded or not available. Accepts a
comma-separated list to try each in
order. Re-tries the primary at the start
of each user turn. (only works with
--print)
--file <specs...>                     File resources to download at startup.
Format: file_id:relative_path (e.g.,
--file file_abc:doc.txt
file_def:img.png)
--fork-session                        When resuming, create a new session ID
instead of reusing the original (use
with --resume or --continue)
--from-pr [value]                     Resume a session linked to a PR by PR
number/URL, or open interactive picker
with optional search term
-h, --help                            Display help for command
--ide                                 Automatically connect to IDE on startup
if exactly one valid IDE is available
--include-hook-events                 Include all hook lifecycle events in the
output stream (only works with
--output-format=stream-json)
--include-partial-messages            Include partial message chunks as they
arrive (only works with --print and
--output-format=stream-json)
--input-format <format>               Input format (only works with --print):
"text" (default), or "stream-json"
(realtime streaming input) (choices:
"text", "stream-json")
--json-schema <schema>                JSON Schema for structured output
validation. Example:
{"type":"object","properties":{"name":{"type":"string"}},"required":["name"]}
--max-budget-usd <amount>             Maximum dollar amount to spend on API
calls (only works with --print)
--mcp-config <configs...>             Load MCP servers from JSON files or
strings (space-separated)
--mcp-debug                           [DEPRECATED. Use --debug instead] Enable
MCP debug mode (shows MCP server errors)
--model <model>                       Model for the current session. Provide
an alias for the latest model (e.g.
'fable', 'opus', or 'sonnet') or a
model's full name (e.g.
'claude-fable-5').
-n, --name <name>                     Set a display name for this session
(shown in the prompt box, /resume
picker, and terminal title)
--no-chrome                           Disable Claude in Chrome integration
--no-session-persistence              Disable session persistence - sessions
will not be saved to disk and cannot be
resumed (only works with --print)
--output-format <format>              Output format (only works with --print):
"text" (default), "json" (single
result), or "stream-json" (realtime
streaming) (choices: "text", "json",
"stream-json")
--permission-mode <mode>              Permission mode to use for the session
(choices: "acceptEdits", "auto",
"bypassPermissions", "default",
"dontAsk", "plan")
--plugin-dir <path>                   Load a plugin from a directory or .zip
for this session only (repeatable:
--plugin-dir A --plugin-dir B.zip)
(default: [])
--plugin-url <url>                    Fetch a plugin .zip from a URL for this
session only (repeatable: --plugin-url A
--plugin-url B) (default: [])
-p, --print                           Print response and exit (useful for
pipes). Note: The workspace trust dialog
is skipped when Claude is run in
non-interactive mode (via -p, or when
stdout is not a TTY, e.g. piped or
redirected output). Only use this in
directories you trust. Settings files
that fail validation are silently
ignored in this mode (no error dialog is
shown).
--prompt-suggestions [value]          Enable prompt suggestions. In print/SDK
mode, emits a prompt_suggestion message
after each turn with a predicted next
user prompt (choices: "true", "false",
"1", "0", "yes", "no", "on", "off",
preset: "true")
--remote-control [name]               Start an interactive session with Remote
Control enabled (optionally named)
--remote-control-session-name-prefix <prefix>
Prefix for auto-generated Remote Control session names (default: hostname)
--replay-user-messages                Re-emit user messages from stdin back on
stdout for acknowledgment (only works
with --input-format=stream-json and
--output-format=stream-json)
-r, --resume [value]                  Resume a conversation by session ID, or
open interactive picker with optional
search term
--safe-mode                           Start with all customizations
(CLAUDE.md, skills, plugins, hooks, MCP
servers, custom commands and agents,
output styles, workflows, custom themes,
keybindings, and more) disabled — useful
for troubleshooting a broken
configuration. Admin-managed (policy)
settings still apply. Auth, model
selection, built-in tools, and
permissions work normally. Sets
CLAUDE_CODE_SAFE_MODE=1.
--session-id <uuid>                   Use a specific session ID for the
conversation (must be a valid UUID)
--setting-sources <sources>           Comma-separated list of setting sources
to load (user, project, local).
--settings <file-or-json>             Path to a settings JSON file or a JSON
string to load additional settings from
--strict-mcp-config                   Only use MCP servers from --mcp-config,
ignoring all other MCP configurations
--system-prompt <prompt>              System prompt to use for the session
--tmux                                Create a tmux session for the worktree
(requires --worktree). Uses iTerm2
native panes when available; use
--tmux=classic for traditional tmux.
--tools <tools...>                    Specify the list of available tools from
the built-in set. Use "" to disable all
tools, "default" to use all tools, or
specify tool names (e.g.
"Bash,Edit,Read").
--verbose                             Override verbose mode setting from
config
-v, --version                         Output the version number
-w, --worktree [name]                 Create a new git worktree for this
session (optionally specify a name)
Commands:
agents [options]                      Manage background agents
auth                                  Manage authentication
auto-mode                             Inspect auto mode classifier
configuration
doctor                                Check the health of your Claude Code
auto-updater. Note: The workspace trust
dialog is skipped and stdio servers from
.mcp.json are spawned for health checks.
Only use this command in directories you
trust.
install [options] [target]            Install Claude Code native build. Use
[target] to specify version (stable,
latest, or specific version)
mcp                                   Configure and manage MCP servers
plugin|plugins                        Manage Claude Code plugins
project                               Manage Claude Code project state
setup-token                           Set up a long-lived authentication token
(requires Claude subscription)
ultrareview [options] [target]        Run a cloud-hosted multi-agent code
review of the current branch (or a PR
number / base branch) and print the
findings
update|upgrade                        Check for updates and install if
available

bex kv-cli [keyValueID|keyValueName] [flags]

# Open an interactive kv-cli session
  bex kv-cli kv-abc123
 
  # Pass through redis-cli arguments
  bex kv-cli kv-abc123 -- --scan

bex login [flags]

# Authenticate with Bex
  bex login

bex logout [flags]

bex logs [flags]

# Tail logs for a service
  bex logs --resources srv-abc123 --tail
 
  # Query logs in a time range
  bex logs --resources srv-abc123 --start 2026-03-01T00:00:00Z --end 2026-03-01T01:00:00Z
 
  # Output logs as JSON in non-interactive mode
  bex logs --resources srv-abc123 --output json

Claude Code - starts an interactive session by default, use -p/--print for
non-interactive output
Arguments:
prompt                                Your prompt
Options:
--add-dir <directories...>            Additional directories to allow tool
access to
--agent <agent>                       Agent for the current session. Overrides
the 'agent' setting.
--agents <json>                       JSON object defining custom agents (e.g.
'{"reviewer": {"description": "Reviews
code", "prompt": "You are a code
reviewer"}}')
--allow-dangerously-skip-permissions  Enable bypassing all permission checks
as an option, without it being enabled
by default. Recommended only for
sandboxes with no internet access.
--allowedTools, --allowed-tools <tools...>
Comma or space-separated list of tool names to allow (e.g. "Bash(git *)
Edit")
--append-system-prompt <prompt>       Append a system prompt to the default
system prompt
--ax-screen-reader                    Render screen-reader friendly output
(flat text, no decorative borders or
animations).
--bg, --background                    Start the session as a background agent
and return immediately (manage with
`claude agents`)
--bare                                Minimal mode: skip hooks, LSP, plugin
sync, attribution, auto-memory,
background prefetches, keychain reads,
and CLAUDE.md auto-discovery. Sets
CLAUDE_CODE_SIMPLE=1. Anthropic auth is
strictly ANTHROPIC_API_KEY or
apiKeyHelper via --settings (OAuth and
keychain are never read). 3P providers
(Bedrock/Vertex/Foundry) use their own
credentials. Skills still resolve via
/skill-name. Explicitly provide context
via: --system-prompt[-file],
--append-system-prompt[-file], --add-dir
(CLAUDE.md dirs), --mcp-config,
--settings, --agents, --plugin-dir.
--betas <betas...>                    Beta headers to include in API requests
(API key users only)
--brief                               Enable SendUserMessage tool for
agent-to-user communication
--chrome                              Enable Claude in Chrome integration
-c, --continue                        Continue the most recent conversation in
the current directory
--dangerously-skip-permissions        Bypass all permission checks.
Recommended only for sandboxes with no
internet access.
-d, --debug [filter]                  Enable debug mode with optional category
filtering (e.g., "api,hooks" or
"!1p,!file")
--debug-file <path>                   Write debug logs to a specific file path
(implicitly enables debug mode)
--disable-slash-commands              Disable all skills
--disallowedTools, --disallowed-tools <tools...>
Comma or space-separated list of tool names to deny (e.g. "Bash(git *)
Edit")
--effort <level>                      Effort level for the current session
(low, medium, high, xhigh, max)
--exclude-dynamic-system-prompt-sections
Move per-machine sections (cwd, env info, memory paths, git status) from
the system prompt into the first user message. Improves cross-user
prompt-cache reuse. Only applies with the default system prompt (ignored
with --system-prompt). (default: false)
--fallback-model <model>              Enable automatic fallback to specified
model(s) when the default model is
overloaded or not available. Accepts a
comma-separated list to try each in
order. Re-tries the primary at the start
of each user turn. (only works with
--print)
--file <specs...>                     File resources to download at startup.
Format: file_id:relative_path (e.g.,
--file file_abc:doc.txt
file_def:img.png)
--fork-session                        When resuming, create a new session ID
instead of reusing the original (use
with --resume or --continue)
--from-pr [value]                     Resume a session linked to a PR by PR
number/URL, or open interactive picker
with optional search term
-h, --help                            Display help for command
--ide                                 Automatically connect to IDE on startup
if exactly one valid IDE is available
--include-hook-events                 Include all hook lifecycle events in the
output stream (only works with
--output-format=stream-json)
--include-partial-messages            Include partial message chunks as they
arrive (only works with --print and
--output-format=stream-json)
--input-format <format>               Input format (only works with --print):
"text" (default), or "stream-json"
(realtime streaming input) (choices:
"text", "stream-json")
--json-schema <schema>                JSON Schema for structured output
validation. Example:
{"type":"object","properties":{"name":{"type":"string"}},"required":["name"]}
--max-budget-usd <amount>             Maximum dollar amount to spend on API
calls (only works with --print)
--mcp-config <configs...>             Load MCP servers from JSON files or
strings (space-separated)
--mcp-debug                           [DEPRECATED. Use --debug instead] Enable
MCP debug mode (shows MCP server errors)
--model <model>                       Model for the current session. Provide
an alias for the latest model (e.g.
'fable', 'opus', or 'sonnet') or a
model's full name (e.g.
'claude-fable-5').
-n, --name <name>                     Set a display name for this session
(shown in the prompt box, /resume
picker, and terminal title)
--no-chrome                           Disable Claude in Chrome integration
--no-session-persistence              Disable session persistence - sessions
will not be saved to disk and cannot be
resumed (only works with --print)
--output-format <format>              Output format (only works with --print):
"text" (default), "json" (single
result), or "stream-json" (realtime
streaming) (choices: "text", "json",
"stream-json")
--permission-mode <mode>              Permission mode to use for the session
(choices: "acceptEdits", "auto",
"bypassPermissions", "default",
"dontAsk", "plan")
--plugin-dir <path>                   Load a plugin from a directory or .zip
for this session only (repeatable:
--plugin-dir A --plugin-dir B.zip)
(default: [])
--plugin-url <url>                    Fetch a plugin .zip from a URL for this
session only (repeatable: --plugin-url A
--plugin-url B) (default: [])
-p, --print                           Print response and exit (useful for
pipes). Note: The workspace trust dialog
is skipped when Claude is run in
non-interactive mode (via -p, or when
stdout is not a TTY, e.g. piped or
redirected output). Only use this in
directories you trust. Settings files
that fail validation are silently
ignored in this mode (no error dialog is
shown).
--prompt-suggestions [value]          Enable prompt suggestions. In print/SDK
mode, emits a prompt_suggestion message
after each turn with a predicted next
user prompt (choices: "true", "false",
"1", "0", "yes", "no", "on", "off",
preset: "true")
--remote-control [name]               Start an interactive session with Remote
Control enabled (optionally named)
--remote-control-session-name-prefix <prefix>
Prefix for auto-generated Remote Control session names (default: hostname)
--replay-user-messages                Re-emit user messages from stdin back on
stdout for acknowledgment (only works
with --input-format=stream-json and
--output-format=stream-json)
-r, --resume [value]                  Resume a conversation by session ID, or
open interactive picker with optional
search term
--safe-mode                           Start with all customizations
(CLAUDE.md, skills, plugins, hooks, MCP
servers, custom commands and agents,
output styles, workflows, custom themes,
keybindings, and more) disabled — useful
for troubleshooting a broken
configuration. Admin-managed (policy)
settings still apply. Auth, model
selection, built-in tools, and
permissions work normally. Sets
CLAUDE_CODE_SAFE_MODE=1.
--session-id <uuid>                   Use a specific session ID for the
conversation (must be a valid UUID)
--setting-sources <sources>           Comma-separated list of setting sources
to load (user, project, local).
--settings <file-or-json>             Path to a settings JSON file or a JSON
string to load additional settings from
--strict-mcp-config                   Only use MCP servers from --mcp-config,
ignoring all other MCP configurations
--system-prompt <prompt>              System prompt to use for the session
--tmux                                Create a tmux session for the worktree
(requires --worktree). Uses iTerm2
native panes when available; use
--tmux=classic for traditional tmux.
--tools <tools...>                    Specify the list of available tools from
the built-in set. Use "" to disable all
tools, "default" to use all tools, or
specify tool names (e.g.
"Bash,Edit,Read").
--verbose                             Override verbose mode setting from
config
-v, --version                         Output the version number
-w, --worktree [name]                 Create a new git worktree for this
session (optionally specify a name)
Commands:
agents [options]                      Manage background agents
auth                                  Manage authentication
auto-mode                             Inspect auto mode classifier
configuration
doctor                                Check the health of your Claude Code
auto-updater. Note: The workspace trust
dialog is skipped and stdio servers from
.mcp.json are spawned for health checks.
Only use this command in directories you
trust.
install [options] [target]            Install Claude Code native build. Use
[target] to specify version (stable,
latest, or specific version)
mcp                                   Configure and manage MCP servers
plugin|plugins                        Manage Claude Code plugins
project                               Manage Claude Code project state
setup-token                           Set up a long-lived authentication token
(requires Claude subscription)
ultrareview [options] [target]        Run a cloud-hosted multi-agent code
review of the current branch (or a PR
number / base branch) and print the
findings
update|upgrade                        Check for updates and install if
available

bex pgcli [postgresID|postgresName] [flags]

# Open an interactive pgcli session
  bex pgcli pg-abc123
 
  # Pass through pgcli arguments
  bex pgcli pg-abc123 -- --csv -q

bex postgres <subcommand> [flags]

bex postgres create [flags]

# Launch the interactive wizard
  bex pg create
 
  # Create immediately with defaults and text output
  bex pg create --confirm
 
  # Create immediately with explicit values
  bex pg create --confirm --name analytics --plan 2c-8g --version 17 --region ohio
 
  # Include flag-only settings while using the wizard for prompted values
  bex pg create \
    --ip-allow-list "cidr=203.0.113.5/32,description=office" \
    --ip-allow-list "cidr=10.0.0.0/8,description=internal"
 
  # Machine-readable output
  bex pg create --output json

bex postgres delete <postgresID|postgresName> [flags]

# Preview deletion (no changes made)
  bex pg delete dpg-abc123def456ghi789jkl0
 
  # Delete by ID
  bex pg delete dpg-abc123def456ghi789jkl0 --confirm
 
  # Delete by name
  bex pg delete my-db --confirm
 
  # Disambiguate a name that exists in multiple environments
  bex pg delete my-db --environment production --confirm
 
  # Disambiguate a name that exists in multiple projects
  bex pg delete my-db --project analytics --confirm
 
  # JSON output
  bex pg delete dpg-abc123def456ghi789jkl0 --confirm --output json

bex postgres get <postgresID|postgresName> [flags]

# Get by ID
  bex pg get dpg-abc123def456ghi789jkl0
 
  # Get by name
  bex pg get my-db
 
  # Include connection strings (contains credentials)
  bex pg get my-db --include-sensitive-connection-info
 
  # Disambiguate by project
  bex pg get my-db --project my-project
 
  # Disambiguate a name that exists in multiple environments
  bex pg get my-db --environment production
 
  # JSON output
  bex pg get dpg-abc123def456ghi789jkl0 --output json

bex postgres list [flags]

# List all Postgres databases in the active workspace
  bex pg list
 
  # List all Postgres databases in a project
  bex pg list --project my-project
 
  # Filter by environment name
  bex pg list --environment production
 
  # Disambiguate an environment name by project
  bex pg list --project my-project --environment production
 
  # JSON output
  bex pg list --output json

bex postgres resume <postgresID|postgresName> [flags]

# Resume by ID
  bex pg resume dpg-abc123def456ghi789jkl0
 
  # Resume by name
  bex pg resume my-db
 
  # Disambiguate a name that exists in multiple environments
  bex pg resume my-db --environment production
 
  # Disambiguate a name that exists in multiple projects
  bex pg resume my-db --project analytics
 
  # JSON output
  bex pg resume dpg-abc123def456ghi789jkl0 --output json