CLI command reference
Find the exact command for setup, capture, scans, services, identity, rules, and removal.
On this page
Run beam --help or a command's --help to inspect the installed release. This reference follows the command definitions in the current Beam CLI source. Some command descriptions still say “observe only”; connected policy behavior is documented separately in Policies.
Setup and identity
| Command | Behavior |
|---|---|
beam setup | Interactive hook setup, browser connection, and optional background service |
beam connect | Open browser pairing and wait for workspace authorization |
beam enroll --code CODE [--url URL] | Enroll with an administrator-provided code |
beam whoami | Display locally stored device enrollment |
beam account | Fetch user, workspace, and device status from the remote API |
beam sync | Fetch and cache workspace policy |
beam logout | Attempt remote revocation, then remove local identity |
beam --version | Print installed package version |
Capture and scanning
| Command | Behavior |
|---|---|
beam start [-p, --port PORT] | Start the loopback collector and attempt detected-agent hook wiring |
beam studio | Open the local activity interface with browser pairing |
beam token | Print the collector pairing token; treat stdout as sensitive |
beam import FILE | Send a JSON/NDJSON file to local ingestion |
beam hook [AGENT] | Read a hook payload from stdin; default agent is claude-code |
beam scan FILE [--mcp] [--save] | Scan offline, or persist through the collector with --save |
scan prints JSON on successful completion; findings do not automatically cause a nonzero exit. The CLI banner goes to stderr. Extraction preview includes a trailing human-readable summary, so its whole output is not a single JSON value.
Agent adapters
beam agent list
beam agent install claude-code
beam agent install-all
beam agent extract codex --limit 20
beam agent extract codex --save
agent ls aliases agent list. Extraction currently supports Claude Code and Codex. --limit applies to preview output, defaults to 200, and does not replace the scanner's source-file bounds.
Rules and background services
beam rule list
beam rule reload
beam service install --port 4319
beam service status
beam service stop
beam service start
beam service logs
beam service uninstall
rule ls aliases rule list. Rule reload requires the running collector. Services support macOS launchd and Linux user systemd; Windows uses foreground beam start.
Full removal
beam uninstall asks before removing the background service, Beam hook entries, local data, workspace registration, and global packages. --keep-package retains installed packages. --yes skips the interactive confirmation and should only be used in an already-approved offboarding workflow. Local deletion cannot remove historical data retained by a workspace.