Commands humans remember.
Contracts agents can trust.
Helvstack is explicit where production demands it: scope, plan, idempotency, operation state, and proof. Every example below is copyable and machine-friendly.
Install and orient
Verify the binary, inspect the local contract, and bind the current directory to an explicit project and environment.
npm install --global helvstackInstall with npmuv tool install helvstackInstall with uvhelvstack --json versionVerify the installed buildhelvstack capabilities --localRead the offline CLI contracthelvstack initCreate a helvstack.yml starterhelvstack linkLink this directory to a projecthelvstack --json whoamiShow the scoped identity and target without exposing its tokenhelvstack --json listList services in only the linked project and environmenthelvstack openOpen the customer consolehelvstack unlinkRemove only this directory's link
Approve scoped access
The CLI opens the SaaS console for human approval and stores a project-scoped token locally. Agents can start and poll the same flow without scraping the browser.
helvstack auth login --project <project> --environment productionOpen browser approval and waithelvstack --json auth start --project <project> --environment productionStart the device flow for an agenthelvstack --json auth poll --device-code <code> --waitWait for the approval resulthelvstack auth status --jsonInspect local auth without exposing the tokenhelvstack auth logout --revokeRevoke the token and remove local config
Describe services once
helvstack.yml is the reviewed declaration for services, volumes, domains, and links. Validate locally, then plan the remote diff before applying it.
helvstack services validate --from helvstack.ymlValidate without API accesshelvstack --json services apply --from helvstack.yml --planPreview the remote service diffhelvstack --json --idempotency-key services-<sha> services apply --from helvstack.ymlApply the reviewed declarationhelvstack services retire --planPlan retirement of undeclared services
Plan, deploy, verify
Consequential actions return operations. Keep the service explicit, use a stable retry key, and wait for a terminal state before calling the deployment complete.
helvstack --json up --service web --planUse the familiar plan-first deployment entrypointhelvstack --json deploy --service web --planReview the deployment planhelvstack --json --idempotency-key deploy-<sha> deploy --service web --no-waitQueue one idempotent deploymenthelvstack --json redeploy --service web --planPlan reuse of the latest active immutable imagehelvstack --json restart --service web --planPlan an immutable rolling restarthelvstack --json deployments list --service webInspect deployment historyhelvstack --json status webCheck runtime statehelvstack --json logs webInspect recent logshelvstack --json metrics --service web --range 1hInspect recent service metricshelvstack --json events webInspect recent service eventshelvstack rollback --service web --planReview a rollback before applying it
Variables and domains
Secret values are write-only. Domain activation is staged so ownership, routing, certificates, and rollback can be inspected independently.
helvstack --json env list --service webList key names onlyValues are never returned.helvstack env set DATABASE_URL=<value> --service web --planPlan a write-only variable changehelvstack env import --from-file .env.production --planPlan a dotenv importhelvstack --json run --service web -- npm testValidate caller-supplied local variable keys without executingWithout --json, the command executes locally; stored values are never decrypted.helvstack shell --service web --env-file .env.localOpen a local shell using caller-supplied valuesStored values remain write-only.helvstack domain add app.example.ch --service web --port 3000 --planPlan a custom domainhelvstack domain verification app.example.ch --service webRead the ownership TXT challengehelvstack domain cutover-plan app.example.ch --service webInspect DNS, TLS, blockers, and rollback
Observe and recover
Operation records are the durable receipt for remote mutations. Recovery is guarded and remains plan-first.
helvstack --json operations get <operation-id>Read one operationhelvstack --json operations wait <operation-id> --timeout 10mWait for a terminal operation statehelvstack --json operations staleList stale running operationshelvstack operations recover <operation-id> --planPlan guarded recoveryhelvstack --json doctor apiRun read-only deployment diagnosishelvstack --json db report postgresInspect database backup healthhelvstack --json cache report redisInspect Redis backup and restore healthhelvstack --json volume list webInspect persistent volumeshelvstack --json object-storage objects files --limit 50Inspect object storage
Discover before acting
The CLI exposes the same live contracts to coding agents, CI, direct API clients, and local MCP clients. Start with capabilities; do not guess endpoints or flags.
helvstack --json capabilitiesRead the live capability contracthelvstack openapiRead the live OpenAPI documenthelvstack mcp serveRun the scoped stdio MCP servercurl -fsSL https://helvstack.com/llms.txtRead the concise machine guidecurl -fsSL https://helvstack.com/llms-full.txtRead the complete agent contract