CLI reference
Every cloudg command and the flags it takes. The tables are generated from the click definitions at build time, so they match --help.
Options that belong to the root command go before the subcommand: cloudg -c config.yaml map .... Without -c, cloudg runs on its built-in defaults and does not look for a config.yaml on its own. The flags shared by several commands have pages of their own: provider and region flags, auth flags and output flags.
Commands¶
| Command | Group | What it does |
|---|---|---|
cloudg run |
Pipeline | Run the full pipeline: collect → scan → normalise → render. |
cloudg collect |
Pipeline | Collect cloud assets from the specified provider. |
cloudg scan |
Pipeline | Run security scanners and write raw-findings.json. |
cloudg report |
Pipeline | Generate reports from existing scan data. |
cloudg map |
Inventory | Map the complete infrastructure inventory, with no scanners involved. |
cloudg deps |
Inventory | Explore interdependencies in a saved inventory map. |
cloudg ingest |
Inventory | Aggregate existing scanner outputs; no scanners are executed. |
cloudg mcp serve |
MCP | Run an MCP server exposing cloudg's tools, resources and prompts. |
cloudg mcp config |
MCP | Print a ready-to-paste MCP client configuration snippet. |
cloudg mcp tools |
MCP | List the tools the active policy exposes. |
cloudg mcp resources |
MCP | List resources and resource templates. |
cloudg mcp prompts |
MCP | List prompts. |
cloudg mcp call |
MCP | Call TOOL in-process (policies and transforms apply) and print the result. |
cloudg mcp read |
MCP | Read resource URI in-process and print its contents. |
Provider and region flags |
Shared | |
Auth flags |
Shared | |
Output flags |
Shared |
Global options¶
| Flag | Value | Default | Description |
|---|---|---|---|
--version |
flag |
off |
Show the version and exit. |
-v, --verbose |
flag |
off |
Enable debug logging |
-c, --config |
TEXT |
none |
Path to config.yaml |
--log-file |
TEXT |
none |
Path to log file |