CLI reference

One binary, one command surface. Run lumen-agent <command> -h for the full flag list of any command.

Command	What it does
run	Start the daemon: loopback inspection API, and the capturing proxy when the config enables it
status	What this machine's agent is doing: daemon, policy, hooks, routed tooling, spool, last heartbeat
disable / enable	The machine-wide off switch (needs root) — see Service lifecycle
enroll	Exchange an enrollment token for the per-device cloud credential (run does this itself on startup; this is the manual/MDM flow)
inspect	One-shot inspection from the CLI
policy	validate | init | show | effective a policy file
intel	compile | check a threat-intel snapshot
classifier	show | score | train | eval the toxicity and topic models
mcp	Wrap an MCP server (stdio) behind the policy engine
nm	Native-messaging host for the browser extension (nm install writes the per-browser host manifests)
proxy	The local LLM API proxy, standalone
autoconfig	status | apply | revert — discover the AI tooling on this machine and point it at the proxy
hook	Claude Code hook guard: reads a hook event on stdin, answers with the policy decision
service	generate | install | uninstall the OS service; uninstall also un-routes what autoconfig redirected
upgrade	Replace this binary with a released version from the CDN (--check | --to vX.Y.Z | --rollback)
version	Print the version

The ones you will use daily

inspect — a verdict in one shot

lumen-agent inspect --text "the key is AKIAIOSFODNN7EXAMPLE"
lumen-agent inspect --stage output --intel feed.bloom --text "reset at https://sec-reset-login.example"
lumen-agent inspect --policy demo-policy.yaml --context '{"device":{"managed":false}}' --text "..."

--stage selects prompt (input, default) or response (output) rules; --policy points at a policy file (the CLI default is the built-in enforcing policy); --context feeds the access-rule engine.

status — the whole picture, one screen

lumen-agent status              # exit 0 answered, 3 daemon down, 1 no report
lumen-agent status --json | jq '.warnings'

Run it as the developer whose tooling you are asking about — hook and routed-tooling reporting is per-user. Under sudo the report resolves the human from SUDO_USER, the same way service uninstall does.

policy effective — what is actually in force

lumen-agent policy validate --policy /etc/lumen/policy.yaml
lumen-agent policy effective --config /etc/lumen/agent.yaml

effective resolves agent.policy exactly the way run does, so it cannot report something the daemon does not run. --json prints the same thing machine-readably.

intel compile — threat-intel snapshots

lumen-agent intel compile --list feed.txt --out feed.bloom

Compiles an entity list into the memory-mapped bloom filter the malicious-entity detector tests against. An exact list can block; a bloom candidate only logs.