CLI: agentic-auth manifest
Author, validate, and preview-reconcile agent manifests offline. diff reuses the same
ReconcilerService and DiscoveryClient the server runs, so its output matches what
POST /v1/agents would return for the same manifest.
manifest validate FILE [--json]
Schema-validates a manifest. No network calls. Exit 0 valid, 1 invalid (findings printed or
{"valid": false, "errors": [...]} with --json).
manifest lint FILE [--json] [--strict]
Validates, then reports best-practice warnings that aren't schema errors:
| Code | Meaning |
|---|---|
DEAD_HOP_HEADROOM | hop_budget exceeds every declared max_hop_depth |
CANNOT_DELEGATE | downstream_agents declared but hop_budget is 1 |
PRIVILEGED_WRITE | A privileged tool also declares a write data class |
DUPLICATE_TOOL | The same tool ref appears twice |
UNUSED_DATA_CLASS | A declared data class is used by no tool |
--strict makes any warning exit non-zero; without it, warnings are informational (exit 0).
manifest diff FILE [--json] [--discovery-timeout SECONDS]
Previews the reconciliation diff the server would return for this manifest, against live capability discovery — needs the declared tools' discovery endpoints reachable.
manifest register-dir DIRECTORY --control-plane URL --override-reason TEXT [--timeout SECONDS]
Registers every manifest in a directory, leaf-first — for test and CI environments. Reads the
admin token from AGENTIC_AUTH_ADMIN_TOKEN only; it is never accepted as a command-line flag,
so it can't land in shell history or CI logs. Exits non-zero if any registration fails, printing
each failure's diff.