CLI Reference

The Rekor CLI (rekor-cli) is the primary interface for human operators and AI agents using tools like Claude Code or Cursor. Install it, authenticate, and start managing data from your terminal.

Installation and Setup

npm install -g rekor-cli
rekor login

After login, the CLI stores your API token in your OS secure credential store. Non-secret settings live in ~/.config/rekor/config.json. When no credential store is available, the token falls back to that same file (mode 0600). You can override credentials with environment variables:

Environment Variable	Purpose
`REKOR_TOKEN`	Override the stored API token
`REKOR_API_URL`	Override the API base URL

Global Flags

These flags work with every command:

Flag	Description
`--base <id>`	Target base ID (required for most commands)
`--output <format>`	Output format: `table` (default) or `json`

Use --output json when piping output to other tools or when agents parse results programmatically. Table format is human-readable with formatted columns.

Common Workflows

Setup: base + preview + record_type

rekor bases create my-app --name "My App"
rekor bases create-preview my-app --name "initial-setup"
rekor record-types upsert tasks --base my-app--initial-setup \
  --name "Tasks" \
  --schema '{"type":"object","required":["title"],"properties":{"title":{"type":"string"},"done":{"type":"boolean"}}}'
rekor bases promote my-app --from my-app--initial-setup

Write and query records

rekor records upsert tasks --base my-app \
  --data '{"title":"Ship v1","done":false}'

rekor sql "SELECT * FROM records WHERE org_id = {org_id:String} AND base_id = {base_id:String} AND record_type = 'tasks' AND data.done = false AND deleted = false" \
  --base my-app --output json

Create a scoped API key for an agent

rekor tokens create --name "agent-readonly" \
  --grants '[{"scope":{"bases":["my-app"],"environments":["production"]},"permissions":["read:records","read:record_types"]}]'

Commands

Command	Description
`rekor actions`	Manage Actions — reusable, named definitions: one record_type + one operation, or a composite of atomic write steps (--config with `steps`)
`rekor attachments`	Manage record attachments
`rekor bases`	Manage bases
`rekor batch`	Execute atomic batch operations (up to 1,000 operations)
`rekor file-types`	Manage file types (Buckets) — storage policy + optional metadata schema for files
`rekor files`	Manage files (path-addressed, versioned content) within a file type
`rekor inbound-webhooks`	Manage inbound webhook endpoints
`rekor login`	Authenticate with Rekor
`rekor logout`	Remove stored authentication credentials
`rekor providers`	Import/export tool definitions between LLM providers and Record record_types
`rekor pull`	Pull a database config into rekor-ws/ as YAML files (a preview, plus a read-only mirror of linked production)
`rekor push`	Push local config files to a preview database (creating it if new)
`rekor query-relationships`	Query related records
`rekor record-types`	Manage record_types
`rekor records`	Manage records
`rekor relationships`	Manage relationships between records
`rekor report`	File a report to the Rekor triage queue and verify the outcome
`rekor secrets`	Manage organization vault secrets
`rekor seed`	Apply, reset, or clear a seed fixture on a preview base (hermetic eval data)
`rekor sql`	Execute a read-only SQL query against database data
`rekor status`	Show auth, connectivity, and CLI version diagnostics
`rekor template`	Browse and pull ready-made data-layer templates
`rekor tokens`	Manage API tokens
`rekor toolsets`	Manage MCP Factory toolsets
`rekor triggers`	Manage triggers (outbound webhooks, internal writes, external writes)
`rekor unbind`	Clear the database binding for this worktree
`rekor update`	Update the Rekor CLI to the latest published version
`rekor use`	Bind this worktree to a database so push/pull refuse to run against a different one
`rekor whoami`	Show the authenticated identity