Commands

This page is generated from the CLI’s own help output (quox 0.1.0). For anything below, quox <group> <command> --help shows full options.

Many groups need a QuoxCORE and a signed-in profile. Groups for enterprise features say so in their description.

Global options

These work on every command.

Option	What it does
-o, --output <format>	output format: table, json, csv, quiet (default: “table”)
--json	shorthand for --output json
-q, --quiet	suppress output, show IDs only
--org <slug>	override active organization
-p, --profile <name>	use a specific config profile
--no-color	disable colored output
-v, --verbose	show detailed output
--debug	show HTTP request/response details
--dry-run	show what would happen without executing
-y, --yes	skip confirmation prompts
--insecure	allow self-signed SSL certificates

Command groups

• quox login: Authenticate with QuoxCORE
• quox logout: End current session
• quox whoami: Show current user and session info
• quox signup: Create a new user account
• quox mfa: Manage multi-factor authentication
• quox account: Your own account (password, session)
• quox service: Check service health and status
• quox health: Check health of all QuoxCORE services (alias for service health)
• quox status: Show platform health and status overview
• quox doctor: Run platform health diagnostics
• quox open: Open a quox:// URI in the dashboard or show CLI equivalent
• quox config: Manage CLI configuration and profiles
• quox org: Manage organizations
• quox invites: Your pending organization invitations
• quox team: Manage teams
• quox department: Manage departments within divisions
• quox agent: Manage agents
• quox tool: Manage tools and tool catalog
• quox workflow: Manage workflows
• quox objective: Manage objectives (autonomous multi-step goals)
• quox assistant: Manage assistants
• quox fleet: Fleet monitoring and management
• quox chat: Chat with CommanderQ or any agent, streaming by default
• quox chat-status: Check chat service status
• quox memory: Manage memories
• quox brain: Query Quox Qortex (vaults, notes, semantic search)
• quox entity: Manage entities in the knowledge graph
• quox backup: Manage backups
• quox inbox: Manage inbox and approval requests
• quox approvals: Tool approvals (held actions awaiting or past a human decision)
• quox mail: InboxQ: connected mail accounts, triaged messages, zones, sync, reports, watches, proposals
• quox calendar: Calendar-Q: connected calendars, agenda, coverage, sync
• quox notes: NotesQ: governed markdown notes (list, read, write, history, restore)
• quox contacts: ContactsQ: governed contacts (add, find, resolve caller-ID, suppress)
• quox licence|license: Instance licence status, lease refresh and seat bands
• quox run: Manage workflow runs
• quox file: Manage files
• quox admin: Platform administration
• quox aee: Agent Envelope Exchange protocol
• quox integration: DEPRECATED: alias of quox vault: kept for existing scripts
• quox consent: Manage data processing consent
• quox setup: First-time setup and configuration
• quox watch: Real-time monitoring dashboards
• quox tag: Manage tags
• quox scope: View scopes (read-only: use quox org/quox division/quox team to manage)
• quox notification: Manage notification settings
• quox prompt: Manage the user-owned prompts library
• quox plugin: Manage org-installed plugins
• quox powers: Deploy and manage POWERS (MCP endpoint / hosted-repo tools)
• quox conversation: Manage conversations
• quox vault: Manage QuoxVault credentials
• quox volt: VOLT evidence bundle verification and inspection
• quox governance: Governance: policies, WARD chain, VOLT evidence + certification
• quox skills: Manage the quoxflow skill library (QSKL Crystals): query, run, review, promote, and your saved library
• quox claude: Run Claude Code (same arguments as claude) in a tmux session that survives sleep and drops
• quox codex: Run Codex (same arguments as codex) in a tmux session that survives sleep and drops
• quox gemini: Run Gemini CLI (same arguments as gemini) in a tmux session that survives sleep and drops
• quox wrap: Run any program in a governed tmux session: quox wrap <program> [args…]
• quox sessions: Manage Quox tmux sessions (ls, attach, kill)
• quox monitoring: Platform health and governance incidents
• quox trigger: View quoxflow trigger subscriptions (webhooks, schedules, events) and activate/deactivate workflows
• quox webhook: Manage org webhook subscribers (enterprise: team_event fan-out)
• quox sso: Manage org SSO providers (enterprise: OIDC/SAML admin)
• quox role: Manage org custom roles (enterprise: RBAC)
• quox domain: Manage org domain verification (team+: DNS ownership proof)
• quox security: Manage org security policy (enterprise: session, IP allowlist, MFA)
• quox safety: Kill switch (per-agent E-STOP) and instance DEFCON (human-admin gated mutations)
• quox scim: Manage org SCIM bearer tokens (enterprise: IdP directory sync)
• quox llm-policy: View, set, and dry-run-validate the org LLM routing policy
• quox hat: QuoxHat: read the org hats (tools, mode, revision, enforcement); reset a built-in to its template
• quox settings: View and change org platform settings (feature flags)
• quox llm: LLM provider status and failover
• quox quoxchat: Manage QuoxChat website widgets
• quox budget: Manage quoxflow spend/usage budgets (org, objective, execution, iteration scope)
• quox trace: Trace Replay & Visualization: assembled traces, simulation, comparison, replay sessions
• quox mon: Monitoring: Docker fleet, Wazuh security, AGH-chain leaderboard, metrics
• quox quoxbox: QuoxBox governed Mac-mini agent: status, workflows, tasks, HITL approvals
• quox plan: QuoxPlan: roadmaps, streams, phases, plans, timeline (governed proxy to the QuoxPlan server)
• quox engagement: QUOX-SECURITY: engagements + scope targets, live capability scanners (run via scan/scan-async; see “engagement tools” for the list), and findings (report/verify/regrade/resolve)
• quox done: Quox DoneEngine: is this actually done, and what is the evidence?
• quox discord: Quox Discord Pro daemon: status | instances | bindings | bind | unbind | gaps | health
• quox qlarity: Qlarity: open a page, ask it a question, keep the receipt
• quox reach: An agent’s governed blast radius: what it may touch, may not, and what cannot be statically known
• quox inventory: Org agent inventory (the agent CMDB): agents, models, tool/credential grants, delegation, unused-grant drift
• quox policy: Governance compiler: plain-language rule -> reviewed, armable policy (OPGOV)
• quox seo: QuoxSEO: the URL warehouse with a witnessed history
• quox voice: QuoxVoice telephony
• quox awareness: QuoxAwareness: cross-surface situational-awareness ledger
• quox lucid|aware: LUCID: what needs you, what changed since you last looked, what is in motion, what I cannot see
• quox sitrep: LUCID situation report: what needs you, every area, what changed, what LUCID cannot see
• quox tg: Manage Telegram Pro: onboarding status, owner binding, session leases, webhook admin
• quox dev: Manage dev-mode (DEVSUITE) fleet hosts
• quox build: QuoxBuild: dispatch and inspect governed builds on dev servers
• quox slot: Manage DEVSUITE-SLOTS: checkout/release the fixed session addresses, say/read into a slot room
• quox gripe: File a one-liner complaint as a GitHub issue (via the GRIPE agent)
• quox nucleus: Ask the codebase a question (RepoBrain, governed and audited)
• quox onboard: Guided, idempotent, resumable wizard to onboard a customer site as a governed Quox tenant
• quox x: X (Twitter) posting: governed, HITL-approved via HITL Inbox
• quox linkedin: LinkedIn publishing: governed, HITL-approved via HITL Inbox
• quox facebook: Facebook Pages publishing (organic): governed, HITL-approved via HITL Inbox
• quox instagram: Instagram publishing and monitoring (organic): governed, HITL-approved via HITL Inbox, on the shared Meta credential
• quox tiktok: TikTok video publishing and draft uploads: governed, HITL-approved via HITL Inbox, on your own dedicated TikTok credential
• quox tui: Launch interactive TUI
• quox completion: Generate shell completions (bash, zsh, fish)

quox login

Authenticate with QuoxCORE

Usage: quox login [options]

Option	What it does
--email <email>	email address
--password <password>	password (prefer --password-stdin: argv is visible in process lists)
--password-stdin	read the password from stdin (one line): no secret in argv or shell history
--mfa-code <code>	TOTP code for MFA
--org <orgId>	organization to log into
--resident	authenticate as a resident agent using the on-disk Ed25519 identity, no password, no human
--resident-profile <path>	path to the resident bootstrap profile (default: ~/.config/quox/resident-profile.json)

quox logout

End current session

Usage: quox logout [options]

quox whoami

Show current user and session info

Usage: quox whoami [options]

quox signup

Create a new user account

Usage: quox signup [options]

Option	What it does
--email <email>	email address
--password <password>	password
--name <name>	display name

quox mfa

Manage multi-factor authentication

Command	What it does
quox mfa setup	Enable MFA for your account
quox mfa verify [options]	Verify MFA setup with a code
quox mfa disable [options]	Disable MFA for your account
quox mfa backup-codes	View MFA backup codes

quox account

Your own account (password, session)

Command	What it does
quox account password [options]	Change your password

quox service

Check service health and status

Command	What it does
quox service health [name]	Check health of all QuoxCORE services

quox health

Check health of all QuoxCORE services (alias for service health)

Usage: quox health [options] [name]

quox status

Show platform health and status overview

Usage: quox status [options]

quox doctor

Run platform health diagnostics

Usage: quox doctor [options]

quox open

Open a quox:// URI in the dashboard or show CLI equivalent

Usage: quox open [options] <uri>

Option	What it does
--cli	show CLI command instead of opening browser

quox config

Manage CLI configuration and profiles

Command	What it does
quox config profile	Manage connection profiles
quox config get [key]	Get a config value
quox config set <key> <value>	Set a config value

quox org

Manage organizations

Command	What it does
quox org list	List organizations
quox org get <orgId>	Get organization details
quox org create [options]	Create a new organization
quox org update [options] <orgId>	Update an organization
quox org delete <orgId>	Delete an organization
quox org switch <orgId>	Switch active organization context
quox org members	Manage organization members
quox org divisions	Manage divisions within the organization
quox org audit [options]	View organization audit log

quox invites

Your pending organization invitations

Command	What it does
quox invites list	List pending invitations addressed to your verified email
quox invites accept <id>	Accept a pending invitation by id (no emailed token needed)

quox team

Manage teams

Command	What it does
quox team list [options]	List teams
quox team get <teamId>	Get team details
quox team create [options]	Create a team
quox team update [options] <teamId>	Update a team
quox team delete <teamId>	Delete a team
quox team provision-room <teamId>	Provision (or adopt) the governed Matrix room for a team
quox team members	Manage team members

quox department

Manage departments within divisions

Command	What it does
quox department list [options]	List departments
quox department create [options]	Create a department
quox department update [options] <deptId>	Update a department
quox department delete [options] <deptId>	Delete a department

quox agent

Manage agents

Command	What it does
quox agent list [options]	List agents
quox agent get <agentId>	Get agent details
quox agent create [options]	Create a new agent
quox agent update [options] <agentId>	Update an agent
quox agent delete <agentId>	Delete an agent
quox agent activate <agentId>	Activate an agent
quox agent deactivate <agentId>	Deactivate an agent
quox agent tool	Manage agent tool assignments
quox agent attach [options] <agentId>	Attach this session as an agent: lease it, fetch its attach kit, and install it locally
quox agent detach [options] <agentId>	Detach this session from an agent: release its lease and remove the local attach kit
quox agent attach-status <agentId>	Show the current attach lease status for an agent
quox agent attach-heartbeat <agentId>	Heartbeat this session’s attach lease, rotating the stored token if one is issued
quox agent exec [options] <agentId>	Execute a tool as the attached agent (witnessed, uses the stored attach token)
quox agent bind-slot <agentId> <slotName>	Bind an agent identity to a durable slot address (org admin only)
quox agent unbind-slot <agentId>	Remove an agent identity’s slot binding (org admin only)
quox agent grant-attach <agentId> <userId>	Grant a user permission to attach as an agent (org admin only)
quox agent grant-attach-all <userId>	Grant a user permission to attach as ANY agent in the org, present and future (org admin only)
quox agent revoke-attach-all <userId>	Revoke a user’s roster-wide (attach-any) grant (org admin only)
quox agent revoke-attach <agentId> <userId>	Revoke a user’s attach grant for an agent (org admin only)
quox agent list-grants <agentId>	List attach grants for an agent (org admin only)

quox tool

Manage tools and tool catalog

Command	What it does
quox tool list [options]	List tools in the organization
quox tool get <toolId>	Get tool details
quox tool create [options]	Create a new tool
quox tool update [options] <toolId>	Update a tool
quox tool delete <toolId>	Delete a tool
quox tool publish <toolId>	Publish a tool
quox tool catalog [options]	Browse the tool catalog
quox tool exec [options] <name>	Execute a governed tool via the collector (POST /api/v1/tools/execute)
quox tool install <toolId>	Install a tool from the catalog

quox workflow

Manage workflows

Command	What it does
quox workflow list [options]	List workflows
quox workflow get <workflowId>	Get workflow details
quox workflow create [options]	Create a new workflow
quox workflow update [options] <workflowId>	Update a workflow
quox workflow delete <workflowId>	Delete a workflow
quox workflow run [options] <workflowId>	Execute a workflow (must be published/active: see workflow publish)
quox workflow publish <workflowId>	Publish a workflow
quox workflow steps	Manage workflow steps
quox workflow apply [options]	Create or update a workflow declaratively from a YAML/JSON file (quoxflow-direct: POST if the file has no id, PUT with a diff-preview if it does)
quox workflow validate [options] [workflowId]	Validate a workflow (quoxflow-direct). Give a stored workflow id to fetch and validate it (the same read path as workflow get), or -f <file> to validate the workflow stored under that file’s “id” field. NOTE: this validates the STORED workflow, not local file content; run workflow apply -f &lt;file&gt; first to validate your latest edits.
quox workflow import-n8n [options]	Import an n8n workflow export as a quoxflow workflow
quox workflow import-objective [options]	Import an objective template as a quoxflow workflow

quox objective

Manage objectives (autonomous multi-step goals)

Command	What it does
quox objective create [options] <goal>	Create a new objective (DAG plan by default, or a QLoop loop with --execution-mode loop)
quox objective list [options]	List objectives
quox objective get <id>	Get objective details (tasks, checkpoints, DAG)
quox objective start [options] <id>	Start an objective (decompose into tasks)
quox objective approve <id>	Approve a decomposed objective’s plan (starts execution)
quox objective checkpoints [options]	List pending HITL checkpoints across the org (approval queue)
quox objective approve-checkpoint [options] <objectiveId> <checkpointId>	Approve one HITL checkpoint (not the DAG plan, see approve)
quox objective deny-checkpoint [options] <objectiveId> <checkpointId>	Reject one HITL checkpoint (not the DAG plan, see approve)
quox objective halt [options] <objectiveId>	Halt a running QLoop loop ON DEMAND (unconditional human stop; no pending gate needed). Fires the same signed-kill as a gate deny.

quox assistant

Manage assistants

Command	What it does
quox assistant list	List assistants
quox assistant get <assistantId>	Get assistant details
quox assistant create [options]	Create an assistant
quox assistant update [options] <assistantId>	Update an assistant
quox assistant delete <assistantId>	Delete an assistant
quox assistant deploy [options] <assistantId>	Deploy an assistant
quox assistant fork [options] <assistantId>	Fork an assistant

quox fleet

Fleet monitoring and management

Command	What it does
quox fleet status|health	Show fleet status (connection counts plus per-host state)
quox fleet summary	Show fleet summary
quox fleet agents	List fleet agents
quox fleet hosts	List hosts known to the Bastion registry (quox#460): the full inventory, not just heartbeating agents
quox fleet gpu	List the durable GPU fleet
quox fleet tools	List available fleet tools
quox fleet exec [options]	Execute a fleet tool
quox fleet host-update [options] <hostId>	Update a host in the Bastion registry (link/clear its bootstrap credential)
quox fleet codex-provision [options] <hostId>	Provision Codex on a fleet host (npm install, AppArmor userns profile, model config) up to the manual device-auth login
quox fleet rehome-agent [options] <hostId>	Re-enrol a host’s QuoxAgent against a different collector by clean reinstall from that collector
quox fleet watch	Watch fleet status in real-time

quox chat

Chat with CommanderQ or any agent, streaming by default

Usage: quox chat [options] [message]

Option	What it does
--agent <name>	route to a specific agent (e.g. sentinel, cipher, nova)
--no-stream	disable streaming output (one-shot request/response)
--conversation <id>	continue a conversation (session id)

quox chat-status

Check chat service status

Usage: quox chat-status [options]

quox memory

Manage memories

Command	What it does
quox memory list [options]	List memories
quox memory get <id>	Get memory details
quox memory timeline [options] [query]	Decisions that changed over time (newest change first)
quox memory history <id>	Full change history of one belief, oldest first, with reasons
quox memory reinstate <id>	Undo a wrong correction: make a replaced belief current again
quox memory create [options]	Save a new memory
quox memory update [options] <id>	Update a memory
quox memory delete [options] <id>	Delete a memory
quox memory forget [options] <id>	Forget one of your memories (soft delete). Requires --yes. --permanent erases it for good (irreversible).
quox memory search [options] [query]	Search memories
quox memory stats	Show memory statistics
quox memory export [options]	Export all memories

quox brain

Query Quox Qortex (vaults, notes, semantic search)

Command	What it does
quox brain search [options] <query>	Search the brain
quox brain suggest	Suggest questions to ask the brain, generated from your own notes
quox brain brief [options]	What is new in your brain (counts by source, top new notes, open questions)
quox brain add [options] [text]	Save text (or clip a URL) into your brain as a note
quox brain decide [options] <what>	Record a decision (what, why, rejected alternatives, provenance). Checks the brain for an existing match first
quox brain distill [options] [file]	Write session learnings as notes from JSONL ({key,title,text,tags?} per line, max 50). Re-running skips existing keys; --undo removes a batch
quox brain status	Show brain status (note count + milestone)
quox brain citations [options]	Show persisted agent citations (what was cited, and whether it was supported)
quox brain usage	Show brain usage (queries per surface, this week and total)
quox brain vaults	List brain vaults
quox brain note <id>	Get note details
quox brain read [options] <noteId>	Read one note in full (markdown + content hash for a later update)
quox brain update [options] <noteId>	Replace a note’s markdown from a file. A stale --base-hash is a conflict (409), nothing is written.
quox brain delete [options] <noteId>	Delete a note (recorded as a revision, restorable in NotesQ). Requires --yes.
quox brain related [options] <noteId>	Notes related to one note (by similarity)
quox brain neighbours|neighbors <noteId>	Notes this note links to and notes that link to it (graph neighbours)
quox brain context [options] <query>	Token-budgeted pack of the most relevant cited passages on a topic (what the Cortex brain_context tool returns)
quox brain check <claim>	Check whether the knowledge brain supports, contradicts or says nothing about a claim (what the Cortex brain_check tool returns)
quox brain why <queryOrTarget> [noteId]	Two modes. why &lt;target&gt;: the commits, dev sessions and decisions behind a commit sha or file path. why "&lt;query&gt;" &lt;noteId&gt;: why a note ranked where it did, or why it is missing (Cortex brain_why tool)
quox brain history [options] <noteId>	A note’s revision history, or with --rev the text of that revision
quox brain restore [options] <noteId> <rev>	Restore a note to an earlier revision (recorded as a new revision). --expected-hash must be the note’s current content_hash (see quox brain read).
quox brain judge [options] <query> [noteId]	Label a query: a note is relevant/irrelevant for it, or the query should abstain
quox brain judgements [options]	List your relevance judgements (the eval set)
quox brain subscribe [options] <topic>	Tell a slot when new notes about a topic land in your brain
quox brain subscriptions	List your topic subscriptions
quox brain unsubscribe <id>	Remove a topic subscription
quox brain sources	List the Feed sources that fill your brain (state and last sync)
quox brain source [options] <type>	Turn a Feed source on or off and set its config (host paths need an org admin and the instance allow-list)
quox brain eval [options]	Replay your judged queries against live search and score retrieval (hit@1/3/k, MRR, abstention)
quox brain export [options]	Export your visible notes (jsonl to stdout/--out file, or markdown files into --out dir)

quox entity

Manage entities in the knowledge graph

Command	What it does
quox entity list [options]	List entities
quox entity get <id>	Get entity details
quox entity create [options]	Create an entity
quox entity delete [options] <id>	Delete an entity, soft by default (also removes its relations)
quox entity search [options]	Search entities
quox entity relate [options] <fromId> <toId>	Create a relation between entities
quox entity unrelate [options] <relationId>	Delete a relation between entities, soft by default

quox backup

Manage backups

Command	What it does
quox backup list [options]	List backups
quox backup get <backupId>	Get backup details
quox backup create [options]	Create a backup
quox backup delete <backupId>	Delete a backup
quox backup verify <backupId>	Verify backup integrity
quox backup restore [options] <backupId>	Restore from a backup
quox backup schedule	Manage backup schedules
quox backup server	Server-wide backup/restore (whole box, every org; instance admin only)

quox inbox

Manage inbox and approval requests

Command	What it does
quox inbox list [options]	List inbox items
quox inbox get|show <itemId>	Get inbox item details (alias: show), including the approval context: source, on behalf of, reason, method, why approval
quox inbox respond [options] <itemId>	Respond to an inbox item
quox inbox stats	Show inbox statistics

quox approvals

Tool approvals (held actions awaiting or past a human decision)

Command	What it does
quox approvals result [options] <approvalId>	Show the status and stored output of an approved tool call

quox mail

InboxQ: connected mail accounts, triaged messages, zones, sync, reports, watches, proposals

Command	What it does
quox mail accounts	List connected mail accounts
quox mail connect [options]	Connect a mailbox. Reuse a stored credential (--credential), or create one inline from IMAP settings (--imap-host with --password-env, or --provider gmail|icloud|outlook to pre-fill host/port). Creating a credential needs a human/admin profile, e.g. quox -p moo mail connect …
quox mail import [options] <csvFile>	Batch-import mailboxes from a CSV. Header columns (case-insensitive): email (required), imap_host (required), imap_port, smtp_host, smtp_port, username, password_env OR password, label, name, folders (semicolon-separated). One credential + account is created per row. Needs a SECRETS_WRITE profile, e.g. quox -p moo mail import boxes.csv. A file with a password column is a secret: chmod 600 it.
quox mail disconnect <accountId>	Disconnect a mail account
quox mail sync <accountId>	Sync a mail account now (fetch new messages, run triage)
quox mail list [options]	List triaged messages
quox mail zones [options]	Show zone counts (focus, fyi, auto, screened)
quox mail report [options] <accountId>	Show the latest triage report, or generate a fresh one
quox mail watch	Manage standing watches (label + match rules)
quox mail propose [options]	Create a proposal (file, block or draft) for an account
quox mail proposals [options]	List proposals
quox mail resolve [options] <proposalId>	Approve or deny a proposal
quox mail moves [options]	List recent undoable moves (most recent first)
quox mail undo <moveId>	Undo a recorded move: reverse the IMAP move back to its source folder

quox calendar

Calendar-Q: connected calendars, agenda, coverage, sync

Command	What it does
quox calendar status	Show connected Calendar-Q connections and their sync watermark
quox calendar layers	List Calendar-Q layers
quox calendar agenda [options]	Show a connection’s agenda: occurrences plus coverage state
quox calendar coverage [options]	Show just the coverage/freshness state for a connection
quox calendar sync [options]	Trigger a manual sync for a connection (respects retired/backoff eligibility)
quox calendar propose [options]	Propose creating a single, non-recurring event (no external effect: nothing is created yet)
quox calendar receipts	Show Calendar-Q write-path receipts (newest first), each with its full state timeline
quox calendar reconcile <opId>	Resolve an ‘attempted’ or ‘outcome_unknown’ create against provider evidence (read-only: never creates/updates/deletes)

quox notes

NotesQ: governed markdown notes (list, read, write, history, restore)

Command	What it does
quox notes ls [options]	List notes
quox notes search [options] <text>	Search notes (same as ls --q)
quox notes show [options] <id>	Show a note: title, properties, markdown (--raw: full body incl. frontmatter)
quox notes new [options]	Create a note. Markdown from --file or --stdin, else ”# <title>”
quox notes edit [options] <id>	Replace a note’s markdown (--file or --stdin). Fails with a conflict if the note changed since it was read.
quox notes facets [options]	Collections and tags with counts
quox notes history <id>	Revision history of a note
quox notes restore [options] <id>	Restore a note to an earlier revision (writes a new revision)
quox notes rm [options] <id>	Delete a note (author or org admin only). Requires --yes. --purge permanently erases the note and every revision (human only, irreversible).
quox notes related [options] <id>	Notes related to this one (lexical until embeddings are backfilled, then hybrid)
quox notes suggest [options] <id>	Link suggestions for a note: other notes whose title appears as plain text, then related notes. --link <targetId> turns the first mention into a [[wikilink]]
quox notes health [options]	Notebook health: duplicate groups, stale notes others rely on, and broken [[links]]
quox notes import [options] <file>	Import notes from an Evernote export (.enex), an Obsidian vault (.zip) or markdown (.md/.zip)
quox notes tag [options] <id>	Change a note’s tags, collection, pinned or archived state without touching its text
quox notes append [options] <id> [text]	Append text to the end of a note (blank line between). Text from the argument, --stdin or --file.
quox notes duplicate <id>	Copy a note in the same scope as “<title> (copy)” (pinned, source and import_ref are not copied)
quox notes attach <id> <file>	Upload a file (max 25 MB) to the org file store and append a reference to the note
quox notes attachments <id>	List the org files a note references (name, file id, url)
quox notes download [options] <fileId>	Download an org file (by file id, see quox notes attachments). Never overwrites without --force.
quox notes export [options]	Export notes as a zip of <collection or Unfiled>/<title> <id8>.md with frontmatter intact (archived notes included)
quox notes import-status <jobId>	Show an import job: status, counts and errors. Exits non-zero if the job or any note failed.
quox notes templates	List note templates: built-ins (daily, weekly, meeting, decision) and your notes marked as templates (property template: true)
quox notes schedule	Scheduled notes: create a note from a template every day or week (runs server-side, your time zone)
quox notes from-email [options] <messageId>	Save an InboxQ email as a note (subject as title, sender and date, body quoted). Defaults to your personal notes
quox notes actions [options] <id>	Send a note’s unchecked tasks (- [ ] …) to Action-Q, each linking back to the note. Shows them unless --yes; tasks already sent are skipped
quox notes promote [options] <id>	Promote a note to a QuoxPlan stream: appends a stream note with the title, link and an excerpt
quox notes batch [options] <source>	Create many notes in one governed job (max 200) from a folder of markdown, a .jsonl file, or JSONL on stdin. Dry run unless --yes. Every note is tagged with the batch, so quox notes batch-undo removes the lot
quox notes batch-undo [options] <batchId>	Soft-delete every note one batch created (revisions kept, each note restorable). Shows what it would remove unless --yes
quox notes propose-skill [options] <id>	Propose a note (an SOP) as a skill. It always lands pending human review, never runs until approved. Shows the derived skill unless --yes
quox notes split [options] <id>	Split a note at its headings into child notes (one batch), and turn the original into an index linking to them. Dry run unless --yes
quox notes settings	NotesQ platform settings (alias over quox settings, NOTESQ_ keys only). Changing one needs a human org admin.
quox notes scorecard [options]	Run the NotesQ scorecard (scripts/notesq-scorecard.mjs in the dashboard repo), streaming its output

quox contacts

ContactsQ: governed contacts (add, find, resolve caller-ID, suppress)

Command	What it does
quox contacts add [options] [name]	Create a contact (repeat --phone/--email for several identifiers). Name: positional <name> (split into given/family) or --given/--family/…
quox contacts edit [options] <id>	Edit a contact name (partial: only the parts you pass change; --given ” clears one)
quox contacts list [options]	List contacts
quox contacts find [options] <text>	Find contacts by name (same as list --q)
quox contacts show [options] <id>	Show a contact card (masked). --greeting: safe greeting projection. --full: raw identifiers, human only
quox contacts resolve [options] <value>	Caller-ID: resolve a phone number or email to a contact (reports suppression)
quox contacts add-id [options] <id>	Add an identifier to a contact
quox contacts archive <id>	Archive a contact (not erasure)
quox contacts suppress [options] <value>	Add a number or email to the suppression list (blind index only)
quox contacts suppressed [options] <value>	Check whether a number or email is suppressed
quox contacts search [options] <text>	Ranked name search (phonetic: Sean/Shawn/Shaun); flags ambiguity instead of guessing
quox contacts brief	Morning brief: candidates to review, consents expiring, overdue notices, duplicates, sync health, recent do-not-call additions
quox contacts selftest [options]	Drive the read path (search, find, resolve, best channel, timeline, touchpoint, brief) against a demo contact. Never dials or sends. --agent runs it through the attached agent tool scope
quox contacts handoff <id> <note>	Leave a handoff note on a contact with an open thread (stored encrypted, humans read it)
quox contacts handoffs [options] <id>	Open handoff notes on a contact, newest first
quox contacts focus	Show the contact currently open in the ContactsQ dashboard (the one an agent means by “this person”); expires after 30 minutes
quox contacts call [options] <id>	Dial a contact by id through the phone bridge; you never see or type the number
quox contacts leases <id>	Lease + use ledger for a contact (who was given access, when, why; never the values)
quox contacts grant	Standing grants: let an agent reach contacts without asking each time (admin)
quox contacts dsar [options] <id>	Data subject access request: the full record, provenance, consents, touchpoints, edges and the lease use ledger as one JSON bundle (org admin)
quox contacts erase [options] <id>	Erase a contact (org admin, irreversible). full = crypto-shred + tombstone; identifiers_only keeps the record
quox contacts certificate <erasure-id>	Print an erasure certificate (org admin)
quox contacts compliance	Compliance bands: Article 14 notices overdue, candidates expiring, no lawful basis, consents expiring
quox contacts notice-sent [options] <id>	Record that the Article 14 notice was sent to a contact
quox contacts processing-record [options]	Article 30 record of processing for this org (no personal data; org admin)
quox contacts retention	Retention reaper: erases candidates past their retention date (kill switch: contacts settings --reaper off)
quox contacts import [options] <file>	Import contacts from a CSV (incl. Google Contacts export) or vCard file. Dry run unless --commit. Org admin
quox contacts sync	Link an address book (iCloud or any CardDAV) and pull it into ContactsQ, one way. Org admin
quox contacts merge [options] <survivor> <loser>	Merge LOSER into SURVIVOR (org admin, undoable for 30 days with contacts unmerge)
quox contacts unmerge <merge-id>	Undo a merge (org admin, within 30 days): both contacts are restored exactly
quox contacts duplicates	Suggest duplicate pairs (same identifier, or same name at the same organisation)
quox contacts facts [options] <id>	List a contact’s facts (human). --confirm / --reject <fact-id> reviews an agent proposal
quox contacts settings [options]	Show or update ContactsQ settings (updates are admin only)
quox contacts unblock [options] <identifier>	Lift an erasure tombstone so a returning person can be re-added (org admin; witnessed)
quox contacts rewrap	Re-wrap every contact key under the current master key and upgrade old ciphertexts (org admin)
quox contacts reindex	Re-key every blind index under the current master key (master-key rotation step; org admin)
quox contacts strict-names <action>	Apply the org strict_names setting to existing contacts, both directions (org admin)

quox licence

Instance licence status, lease refresh and seat bands

Command	What it does
quox licence status [options]	Licence id, plan, lease timestamps, governed count, entitled list with seat usage
quox licence refresh	Renew the licence lease now; prints old to new lease timestamps and entitlement diff
quox licence seats [options] <pluginId>	List a plugin band holders; --release-dead frees non-live holders (dry run unless --yes)
quox licence website-login [options]	Log in to the quox.ai website admin API for reissue/catalogue-sign (stores the session cookie only, 0600)
quox licence website-logout [options]	End the website admin session and delete the stored cookie
quox licence reissue [options] <licenseId>	Owner-only: band bare paid ids and add ids on a licence record, re-signed on the website (dry run unless --apply)
quox licence catalogue-sign|catalog-sign [options]	Owner-only: re-sign the product catalogue with the live key on the website (dry run unless --apply)
quox licence website-login	log in to the quox.ai admin API once (password is not stored)
quox licence reissue <licenseId> band bare paid ids / add ids, re-signed on the website VM
quox licence catalogue-sign	re-sign the product catalogue with the live key

quox run

Manage workflow runs

Command	What it does
quox run list [options]	List runs
quox run get <runId>	Get run details
quox run create [options]	Start a new workflow run
quox run cancel [options] <runId>	Cancel a running workflow
quox run resume [options] <runId>	Resume a paused run

quox file

Manage files

Command	What it does
quox file list	List files
quox file upload [options] <path>	Upload a file
quox file download [options] <fileId>	Download a file
quox file delete <fileId>	Delete a file
quox file stats	Show file storage stats

quox admin

Platform administration

Command	What it does
quox admin config	Manage platform configuration
quox admin enforcement	Security enforcement posture and break-glass windows
quox admin agent-identity	Manage governed agent identities (agent-typed user + bound mcp token)
quox admin email	Instance email delivery (SMTP)
quox admin key	Manage API keys
quox admin service	Manage platform services
quox admin logs [options]	View admin audit logs
quox admin stats	Show platform statistics
quox admin retention	Manage data retention

quox aee

Agent Envelope Exchange protocol

Command	What it does
quox aee store [options]	Store an AEE envelope
quox aee get <id>	Get an envelope by ID
quox aee query [options]	Query envelopes
quox aee conversations [options]	List AEE conversations
quox aee stats	AEE statistics

quox integration

DEPRECATED: alias of quox vault: kept for existing scripts

Command	What it does
quox integration list [options]	DEPRECATED: alias of quox vault list
quox integration get <integrationId>	DEPRECATED: alias of quox vault get
quox integration create [options]	DEPRECATED: alias of quox vault create
quox integration update [options] <integrationId>	DEPRECATED: alias of quox vault update
quox integration delete [options] <integrationId>	DEPRECATED: alias of quox vault delete
quox integration test <integrationId>	DEPRECATED: alias of quox vault test

quox consent

Manage data processing consent

Command	What it does
quox consent list	List consent records
quox consent grant [options]	Grant consent for a provider
quox consent history	View consent change history

quox setup

First-time setup and configuration

Command	What it does
quox setup status	Check setup status
quox setup admin [options]	Create the initial admin account
quox setup config [options]	Configure platform settings
quox setup license	Activate, inspect and release this instance licence

quox watch

Real-time monitoring dashboards

Command	What it does
quox watch fleet [options]	Live fleet status dashboard
quox watch services [options]	Live service health dashboard

quox tag

Manage tags

Command	What it does
quox tag list	List tags
quox tag create [options]	Create a tag
quox tag update [options] <tagId>	Update a tag
quox tag delete [options] <tagId>	Delete a tag

quox scope

View scopes (read-only: use quox org/quox division/quox team to manage)

Command	What it does
quox scope list	List scopes

quox notification

Manage notification settings

Command	What it does
quox notification channels	Notification channel management

quox prompt

Manage the user-owned prompts library

Command	What it does
quox prompt list [options]	List prompts (own + org-visible)
quox prompt get <id>	Show prompt details
quox prompt create [options]	Create a prompt
quox prompt update [options] <id>	Update a prompt (bumps version)
quox prompt delete [options] <id>	Delete a prompt (soft-delete)
quox prompt versions <id>	Show version history for a prompt
quox prompt restore <id> <version>	Restore a prompt to a previous version
quox prompt export	Export all of the caller’s prompts as JSON
quox prompt import <file>	Bulk-import prompts from a JSON file (as produced by quox prompt export)

quox plugin

Manage org-installed plugins

Command	What it does
quox plugin doctor [options] <name>	Check a plugin against the dev-bundle DoD: 13-point chain + the five prohibitions. Machine evidence only; exit 0 green, 1 findings, 2 cannot evaluate.
quox plugin licence|license <pluginId>	Show whether a plugin is licence governed and entitled for this org (band, org id, entitlement errors)
quox plugin list	List installed plugins for the active org
quox plugin get <pluginId>	Show plugin install details
quox plugin install [options]	Install a plugin (admin only)
quox plugin update [options] <pluginId>	Upgrade a plugin bundle and/or toggle its enabled state (admin only)
quox plugin uninstall [options] <pluginId>	Uninstall a plugin (admin only)
quox plugin mine	List plugins visible to the current user (respects assignments)
quox plugin data	Manage plugin-scoped durable data (KV)
quox plugin secrets	Manage plugin-scoped encrypted secrets
quox plugin assign	Manage plugin visibility assignments (admin only)
quox plugin trusted-keys	Manage per-org trusted Ed25519 signing keys (admin only)

quox powers

Deploy and manage POWERS (MCP endpoint / hosted-repo tools)

Command	What it does
quox powers detect [options]	Probe an MCP URL to see what kind of server it is and what tools it exposes
quox powers deploy [options]	Deploy a live MCP endpoint as a governed agent (one-shot, no build)
quox powers deploy-repo [options]	Deploy a public GitHub repo as a hosted MCP power (builds a container; async)
quox powers status <toolDefId>	Check a hosted-repo power’s build status
quox powers finalize [options] <toolDefId>	Activate the agent for a completed hosted-repo build
quox powers update [options] <toolDefId>	Redeploy a hosted-repo power at a new git ref (branch/tag/commit)
quox powers archive <toolDefId>	Archive a hosted-repo power (disables it without deleting any rows)
quox powers restore <toolDefId>	Restore a previously archived hosted-repo power
quox powers config [options] <toolDefId>	Update env vars and/or agent persona for a hosted-repo power without rebuilding
quox powers delete [options] <toolDefId>	Permanently destroy a hosted-repo power (revokes agent, deletes credentials)

quox conversation

Manage conversations

Command	What it does
quox conversation list [options]	List conversations
quox conversation get <id>	Get conversation details
quox conversation search [options]	Search conversations
quox conversation stats	Conversation statistics

quox vault

Manage QuoxVault credentials

Command	What it does
quox vault list [options]	List credentials (masked)
quox vault get <id>	Show credential details
quox vault create [options]	Create a credential (interactive, or headless via --credentials-file/--credentials-stdin)
quox vault update [options] <id>	Update a credential (interactive label/description fields, or headless credential field values via --credentials-file/--credentials-stdin)
quox vault repos [options] <id>	Show or set which repositories a credential covers (GitHub and similar)
quox vault delete [options] <id>	Delete a credential
quox vault set-default <id>	Set a credential as the default for its type
quox vault test <id>	Test a credential connection
quox vault test-new [options]	Test credential field values before saving (nothing is persisted)
quox vault test-all	Test all credentials sequentially
quox vault stats	Show vault health dashboard
quox vault scan	Run a health scan and show issues
quox vault activity [options]	Show vault audit trail
quox vault types	List available integration types
quox vault rotate [options] <id>	Rotate a credential with new values
quox vault expiring [options]	List credentials expiring soon
quox vault folder	Organize credentials into folders
quox vault assign [options]	Assign a credential to an agent for a tool type
quox vault unassign <assignmentId>	Remove an agent credential assignment
quox vault assignments [options]	List agent credential assignments
quox vault lease	Just-in-time credential leases for agent access
quox vault cross-org [options]	Find credentials of a type across every org you belong to (no secrets returned)
quox vault health [options]	Lightweight vault health summary (requires QUOX_SERVICE_KEY, not a user session)
quox vault migrate [options]	Migrate legacy instance_config keys to QuoxVault

quox volt

VOLT evidence bundle verification and inspection

Command	What it does
quox volt verify [options] <file>	Verify an evidence bundle or NDJSON chain file
quox volt inspect [options] <file>	Inspect events inside a bundle or NDJSON file
quox volt export [options] <file>	Re-export a bundle in a different format
quox volt fetch [options] <runId>	Download a run’s evidence bundle so quox volt verify can check it
quox volt summary <file>	Quick summary of a bundle (no verification)
quox volt accept [options] <runId>	Attest a terminal run’s outcome: did it achieve its intent?
quox volt acceptance <runId>	Show a run’s acceptance verdict history (latest is the standing verdict)

quox governance

Governance: policies, WARD chain, VOLT evidence + certification

Command	What it does
quox governance policy	Manage governance policies
quox governance template	Governance policy template packs
quox governance approval	Second-approver sign-off on staged policy changes
quox governance ward	WARD tamper-evident chain
quox governance evidence [options]	Query VOLT/quoxflow evidence records
quox governance traces [options]	Query quoxflow execution traces (observations)
quox governance certify [options] <runId>	Run VOLT certification against a run (WRITE: creates a certification record)
quox governance cert	Inspect VOLT certifications

quox skills

Manage the quoxflow skill library (QSKL Crystals): query, run, review, promote, and your saved library

Command	What it does
quox skills list [options]	List skills in the library
quox skills show [options] <id>	Show skill details
quox skills run [options] <id>	Execute a skill/crystal (its underlying workflow)
quox skills review	Manage the QSKL-SAFETY skill review queue
quox skills library	Manage your saved workflow library
quox skills from-execution [options] <workflowId>	Crystallise a workflow into a skill (idempotent: returns the existing skill if one already exists)
quox skills promote-draft [options] <executionId>	Promote an in-flight task-time draft Crystal to the skill library (requires tier_b)
quox skills rollback-to-version <sourceWorkflowId> <targetVersion>	Roll a skill back to a prior version (writes a NEW version copying the target’s content)
quox skills protect [options] [dir]	Sign a skill with the org identity, register it in the open SkillRights registry, and keep the receipt in the org evidence chain
quox skills disclosures	Org rights disclosure ledger: distributions + protections under declared rights, policy in force, evidence counts
quox skills protections	List this org’s protected skills (SRID, licence, org key, evidence envelope)
quox skills sealed	Manage sealed-execution skills: methodology runs on org infrastructure, callers get inputs/outputs only (pilot)

quox claude

Run Claude Code (same arguments as claude) in a tmux session that survives sleep and drops

Usage: quox claude [options] [-- claude-args...]

quox codex

Run Codex (same arguments as codex) in a tmux session that survives sleep and drops

Run quox codex --help for usage.

quox gemini

Run Gemini CLI (same arguments as gemini) in a tmux session that survives sleep and drops

Run quox gemini --help for usage.

quox wrap

Run any program in a governed tmux session: quox wrap <program> [args…]

Usage: quox wrap <program> [args...]

quox sessions

Manage Quox tmux sessions (ls, attach, kill)

Command	What it does
quox sessions ls [options]	List Quox sessions (--all: the org-wide live register)
quox sessions report	Report this host’s tmux sessions to the org live-session register
quox sessions attach <name>	Reattach to a running Quox session
quox sessions kill <name>	Kill a Quox session

quox monitoring

Platform health and governance incidents

Command	What it does
quox monitoring health	Show aggregate platform health (services, fleet, sessions)
quox monitoring incidents	Governance incidents

quox trigger

View quoxflow trigger subscriptions (webhooks, schedules, events) and activate/deactivate workflows

Command	What it does
quox trigger webhooks	List registered inbound webhook trigger paths (from active workflow nodes)
quox trigger schedules	List active cron schedule triggers owned by quoxflow (empty when tasks-service-owned)
quox trigger events	List active EventBus subscriptions
quox trigger workflow-activate <id>	Activate a workflow: registers its webhook/schedule/event triggers
quox trigger workflow-deactivate <id>	Deactivate a workflow: unregisters its webhook/schedule/event triggers

quox webhook

Manage org webhook subscribers (enterprise: team_event fan-out)

Command	What it does
quox webhook list	List org webhook subscriptions
quox webhook create [options]	Create an org webhook subscription
quox webhook rotate <id>	Rotate a webhook’s signing secret
quox webhook delete [options] <id>	Delete an org webhook subscription

quox sso

Manage org SSO providers (enterprise: OIDC/SAML admin)

Command	What it does
quox sso providers	Manage SSO provider configurations

quox role

Manage org custom roles (enterprise: RBAC)

Command	What it does
quox role list	List custom roles for the active org
quox role get <roleId>	Show a custom role and its granted capabilities
quox role create [options]	Create a custom role
quox role delete [options] <roleId>	Delete a custom role
quox role capability	Manage capability grants on a role
quox role agent	Manage agent access rules on a role
quox role tool	Manage tool access rules on a role

quox domain

Manage org domain verification (team+: DNS ownership proof)

Command	What it does
quox domain list	List domains claimed by the active org
quox domain add <domain>	Claim a domain and get its DNS verification instructions
quox domain verify <domainId>	Re-check DNS for a claimed domain
quox domain remove [options] <domainId>	Remove a claimed domain

quox security

Manage org security policy (enterprise: session, IP allowlist, MFA)

Command	What it does
quox security session-policy	Manage the org session timeout policy
quox security ip-allowlist	Manage the org IP allowlist (empty list = allow all)
quox security mfa	Manage the org-wide MFA policy mode

quox safety

Kill switch (per-agent E-STOP) and instance DEFCON (human-admin gated mutations)

Command	What it does
quox safety status	Org halt state: DEFCON level + active per-agent E-STOPs
quox safety gate <agentId>	The enforcement verdict a dispatcher gets for this agent right now
quox safety estop [options] <agentId>	Activate the per-agent kill switch (HUMAN admin only, enforced server-side)
quox safety release <agentId>	Release a per-agent kill switch (HUMAN admin only, enforced server-side)
quox safety defcon [options] <level>	Set instance DEFCON: GREEN | BLUE | AMBER | ORANGE (escalate) | RED (full halt)
quox safety history [options]	Append-only audit trail of every E-STOP and DEFCON change

quox scim

Manage org SCIM bearer tokens (enterprise: IdP directory sync)

Command	What it does
quox scim tokens	Manage SCIM bearer tokens

quox llm-policy

View, set, and dry-run-validate the org LLM routing policy

Command	What it does
quox llm-policy get	Show the effective LLM routing policy for the active org
quox llm-policy set [options]	Save a new LLM routing policy for the active org (requires ORG_MANAGE_SETTINGS)
quox llm-policy test [options]	Dry-run validate a policy without saving it

quox hat

QuoxHat: read the org hats (tools, mode, revision, enforcement); reset a built-in to its template

Command	What it does
quox hat list	List the org hats with revision, template status, mode and tool counts
quox hat show [options] <hat>	Show one hat (id or key): tools, bundles, mode, revision history, enforcement
quox hat reset [options] <hat>	Reset an org-edited built-in hat to its current template (drops the org edits; audited)

quox settings

View and change org platform settings (feature flags)

Command	What it does
quox settings list	List effective platform settings for the active org
quox settings get <key>	Show one platform setting
quox settings set <key> <value>	Change a platform setting for the active org (human org admin)
quox settings history [options]	Show the platform settings change history (admin)

quox llm

LLM provider status and failover

Command	What it does
quox llm status	Show LLM provider status, degraded state, and the failover target

quox quoxchat

Manage QuoxChat website widgets

Command	What it does
quox quoxchat widgets	List QuoxChat widgets for the active org
quox quoxchat availability [options] <widgetId>	Show or set operator availability for a widget (QuoxChat Pro)
quox quoxchat conversations [options] <widgetId>	List conversations for a QuoxChat widget (live-support desk)
quox quoxchat transcript <widgetId> <conversationId>	Print a conversation transcript in chronological order
quox quoxchat reply <widgetId> <conversationId> <message...>	Send an operator reply in a handed-off QuoxChat conversation

quox budget

Manage quoxflow spend/usage budgets (org, objective, execution, iteration scope)

Command	What it does
quox budget list [options]	List budgets for the active org
quox budget get <id>	Show budget details
quox budget create [options]	Create a budget
quox budget update [options] <id>	Update a budget
quox budget delete [options] <id>	Delete a budget
quox budget usage [options] <id>	Show rolled-up usage + daily breakdown for a budget

quox trace

Trace Replay & Visualization: assembled traces, simulation, comparison, replay sessions

Command	What it does
quox trace list [options]	List assembled trace summaries
quox trace get [options] <identifier>	Assemble and show a single trace (narrative + per-layer waterfall)
quox trace simulate [options] <identifier>	Run a what-if policy simulation against a trace (TRV-5)
quox trace compare [options]	Compare two traces with layer-aligned diffs (TRV-6)
quox trace replay	Manage persisted trace replay sessions
quox trace comparison	Manage persisted trace comparisons
quox trace correlation	Manage the cross-agent trace correlation cache

quox mon

Monitoring: Docker fleet, Wazuh security, AGH-chain leaderboard, metrics

Command	What it does
quox mon docker	Docker fleet: hosts, containers, stacks, disk usage
quox mon wazuh	Wazuh security monitoring: manager status, agents, alerts, vulnerabilities
quox mon agh-chain	AGH-chain: per-agent honesty leaderboard (org-scoped)
quox mon metrics [options]	Show Prometheus scrape metrics (collector fleet gauges)
quox mon config	Monitoring service config (Prometheus/Uptime Kuma/Proxmox/Grafana)

quox quoxbox

QuoxBox governed Mac-mini agent: status, workflows, tasks, HITL approvals

Command	What it does
quox quoxbox status	Show QuoxBox live status: mode, halt, breaker, pending approvals, recent tasks
quox quoxbox workflows	List available governed workflows
quox quoxbox run [options] <workflow>	Start a governed workflow task
quox quoxbox task <taskId>	Show full task detail, including step states
quox quoxbox tasks	List recent tasks (from live status)
quox quoxbox approve <approvalId>	Approve a pending HITL action
quox quoxbox deny <approvalId>	Deny a pending HITL action
quox quoxbox mode <mode>	Set the QuoxBox gateway mode (readonly|propose|actuate)

quox plan

QuoxPlan: roadmaps, streams, phases, plans, timeline (governed proxy to the QuoxPlan server)

Command	What it does
quox plan roadmaps	List roadmaps with status counts
quox plan roadmap	Roadmap-level operations (create a roadmap)
quox plan list [options] [roadmap]	Tier-grouped stream list (default roadmap: first by name)
quox plan focus [roadmap]	The focus lens: what matters now (P0, blocked, decision needed, in-flight, stale)
quox plan show <streamId>	Full stream detail: header, phases checklist, plan, notes timeline, deps
quox plan timeline [options] [roadmap]	ASCII Gantt: dependency-sequenced schedule, critical path bold, blocked edges marked
quox plan status [options] <id> <status>	PATCH a stream status (COMPLETE requires --confirm-owner; never auto-confirmed)
quox plan note <id> <text...>	Append a note to a stream’s timeline (append-only, never replaced)
quox plan phase <streamId> <verb> [rest...]	Phase ops: “tick <seq>”, “untick <seq>”, “add <title>”, “rename <seq> <title>”, “remove <seq>”
quox plan plan [options] <id>	Print raw plan markdown; --edit opens $EDITOR (PUT on save if changed); --history lists versions
quox plan move <roadmap> <id> <position>	Reprioritise a top-level stream to a 1-based position
quox plan add [options] <json>	Create a new stream from a JSON object (id, name required)
quox plan update <id> <field> <value>	Update a stream field (notes append; priority use move instead)
quox plan rename <oldId> <newId>	Rename a stream id, cascading to depends_on/parent_id references
quox plan stats [roadmap]	Roadmap statistics (streams, phase progress, tests shipped)
quox plan completed [roadmap]	List completed streams

quox engagement

QUOX-SECURITY: engagements + scope targets, live capability scanners (run via scan/scan-async; see “engagement tools” for the list), and findings (report/verify/regrade/resolve)

Command	What it does
quox engagement create [options] <name>	Create a new security engagement
quox engagement list	List engagements for the current org
quox engagement show <id>	Show an engagement and its targets
quox engagement set-gripe-target [options] <id>	Set which repo a finding filed from this engagement goes to, and which org GitHub connector token files it. Lets a customer-site engagement file into the customer repo with the customer org token. Pass --clear (or --repo "") to fall back to the platform default (quoxai/quox) and the engagement own org.
quox engagement add-target [options] <id> <type> <value>	Add a target (type: domain | cidr | repo | cloud_account | url) to an engagement
quox engagement verify-target <id> <targetId>	Run the domain-verification challenge for a target
quox engagement check-policy <id> <targetValue> <capabilityRisk>	Check whether a capability of the given risk tier is currently allowed against a target (passive|discovery|safe_active|intrusive|credential_sensitive|exploit_emulation)
quox engagement scan <id> <target> <tool>	Attempt a Phase 1 capability tool against a verified, in-scope target (tool: discover_hosts | probe_http | discover_app_ports | vuln_scan). Policy-gated; honestly fails if no scan host is configured.
quox engagement discover-ports [options] <id> <hostTarget>	Discover which app ports on a verified, in-scope host actually serve HTTP(S) (httpx over a curated port set), so a scan hits the real surface instead of only :80/:443. With --add, register each discovered endpoint as a verified url target (control re-proven via fleet membership).
quox engagement tools	List the real capability tools (name, risk tier, binary). Quoxcli-parity fix: this catalog backed the dashboard Tools tab but had no CLI verb.
quox engagement scan-async <id> <target> <tool>	Start a capability tool as a background job and return immediately (job_id). Use for tools that can outrun a single request, e.g. vuln_scan/nuclei or discover_app_ports over a wide host set. Poll with quox engagement job &lt;jobId&gt;.
quox engagement job <jobId>	Check the status/result of an async scan job (queued | running | succeeded | failed)
quox engagement jobs <id>	List async scan jobs for an engagement
quox engagement report-finding [options] <id> <targetValue> <title> <description>	Report a candidate finding against a target within an engagement. Always starts as status “candidate”
quox engagement findings <id>	List findings for an engagement
quox engagement verify-finding [options] <findingId> <verdict>	Confirm or refute a candidate finding (verdict: confirmed | refuted). A reason is required, a bare verdict is refused
quox engagement resolve-finding <findingId>	Mark a finding remediated (status: resolved). Refuses a refuted finding
quox engagement regrade-finding [options] <findingId> <severity>	Re-grade a reported finding’s severity (info | low | medium | high | critical). A reason is required, the same discipline as verify-finding, because severity is a published field
quox engagement report [options] <id>	Download the engagement report (targets, tools run, findings) as a PDF
quox engagement issue <findingId>	Raise a finding as a GitHub issue. Honest no-op if GitHub is not configured or the stored token is rejected, never a fake success. Skips re-filing if already raised.
quox engagement propose [options] <findingId>	Propose a finding as a QuoxPlan note (default stream: QUOX-SECURITY, #438)
quox engagement schedule	Recurring scan schedules (re-run a tool on a fixed cadence)
quox engagement sync-issues <id>	Reconcile this engagement’s filed findings against their GitHub issue state. A closed issue auto-resolves its finding. Honest no-op if GitHub is not configured

quox done

Quox DoneEngine: is this actually done, and what is the evidence?

Command	What it does
quox done check [options] [subject]	Can this ship? exit 0 clear, 1 refused with reasons, 2 unknown. Advisory: never blocks.
quox done checklist [options] [pack]	The builder checklist GENERATED from a pack (every gate the engine judges); --check verifies a doc that embeds it
quox done board [options]	Estate scoreboard: every surface, score, attested gates, deploy state
quox done bar [options] [pack]	One rule pack against its subjects: BOTH finish lines, build and deployed
quox done history [pack]	Movement between snapshots, regressions listed first
quox done packs	List available rule packs
quox done fetch [options]	Self-fetch the DoneEngine bundle, no human in the loop (quox#456 follow-on)

quox discord

Quox Discord Pro daemon: status | instances | bindings | bind | unbind | gaps | health

Usage: quox discord <verb> [args...]

quox qlarity

Qlarity: open a page, ask it a question, keep the receipt

Command	What it does
quox qlarity health	Service health through the governed proxy
quox qlarity allowlist	Which origins this deployment may inspect
quox qlarity origins	The origins THIS org may inspect (add/remove without touching the host)
quox qlarity inspectors	The named reads available (data in, never code)
quox qlarity sessions	Open sessions for this org
quox qlarity close <sessionId>	Close a session and free its browser context
quox qlarity read [options] <url>	One-shot: open a page, run an inspector, print the result, close
quox qlarity console [options] <url>	One-shot: open a page, print its console log, close
quox qlarity network [options] <url>	One-shot: open a page, print its network log, close
quox qlarity screenshot [options] <url>	One-shot: open a page, capture a screenshot, save it to a file, close
quox qlarity eval <url> <script>	Request approval to run arbitrary JS. Files an inbox item and exits; never runs inline.
quox qlarity login [options] <origin>	Log in to <origin> via a stored browser_login vault credential, leaving the session open for other qlarity verbs to reuse

quox reach

An agent’s governed blast radius: what it may touch, may not, and what cannot be statically known

Command	What it does
quox reach agent <agentId>	Compute an agent’s reach: tools, credentials, hosts, egress origins, delegation
quox reach unused [options] <agentId>	Predicted-vs-actual least-privilege report: which granted tools/credentials show zero observed use

quox inventory

Org agent inventory (the agent CMDB): agents, models, tool/credential grants, delegation, unused-grant drift

Usage: quox inventory [options]

Option	What it does
--days <n>	observed-usage window for the unused-grant column (default 30)
--unused	ALSO compute the org-wide unused-grant pass (SLOW: minutes at org scale; for one agent use quox reach unused <agentId>)
--drift	diff against the last stored snapshot and store this rollup as the new baseline (witnessed as quox.reach.inventory_drift)

quox policy

Governance compiler: plain-language rule -> reviewed, armable policy (OPGOV)

Command	What it does
quox policy compile <rule>	Compile a plain-language rule to a quox-policy.v1 draft (deterministic grammar; out-of-grammar rules are refused, never approximated)
quox policy list [options]	List compiled policies for this org
quox policy arm <id>	Arm a reviewed draft (requires a logged-in human; service keys are refused by design)

quox seo

QuoxSEO: the URL warehouse with a witnessed history

Command	What it does
quox seo status	Latest crawl summary: health, coverage, orphans, witness state
quox seo sites	The org’s registered properties
quox seo add-site [options] <origin>	Register a site for this org (governed write, witnessed at the collector boundary)
quox seo urls [options]	Warehouse rows for the latest crawl
quox seo url <path>	Full latest warehouse record for one URL path
quox seo crawls	Ingest runs with root hashes and witness sequence
quox seo changes [options]	Signed change events (the witnessed change log)
quox seo trends [options]	GSC winners & losers over time (period compare: last 28d vs prior 28d)
quox seo coverage [options]	Google index coverage: what’s indexed, and where Google disagrees with the page
quox seo verify	Re-verify the WARD chain, signatures and root hashes server-side
quox seo keywords [options]	Stored keyword universe for the org’s primary property (DataForSEO)
quox seo gaps [competitor]	Competitor keyword and page gaps against the latest witnessed crawl (no argument lists known competitors)
quox seo backlinks [competitor]	Referring-domain profile, or the link gap against a competitor (no argument shows our own profile)
quox seo report	QuoxSEO reports
quox seo health	Backend health through the governed proxy

quox voice

QuoxVoice telephony

Command	What it does
quox voice numbers	Bind phone numbers to this org
quox voice identities	Map caller numbers to users (voice on-behalf-of identity)
quox voice calls [options]	List recent calls for the active org (summary + turn count)
quox voice insights	Show aggregate call insights for the active org

quox awareness

QuoxAwareness: cross-surface situational-awareness ledger

Command	What it does
quox awareness post [options] <key> <state>	Post or update an awareness entry (upsert by key)
quox awareness list [options]	List awareness entries for the active org
quox awareness summary	Current-state briefing (what a reader like the voice receptionist sees)
quox awareness remove <key>	Remove an awareness entry

quox lucid

LUCID: what needs you, what changed since you last looked, what is in motion, what I cannot see

Command	What it does
quox lucid sitrep [options]	One-shot formatted snapshot (areas, what needs you, what changed, what I cannot see)
quox lucid deck [options]	Live full-screen LUCID deck (refreshes every 10s; m marks seen)
quox lucid since-last [options]	Situation since you last looked (advances the cursor unless --no-advance)
quox lucid since [options] <window>	Situation since a window (3h, 30m, 2d) or journal seq; never advances the cursor
quox lucid subjects [options]	Open subjects the journal is tracking
quox lucid feeds [options]	Which feeds are speaking, and which are expected but silent
quox lucid blind [options]	What I can and cannot hear (live / silent / failing / never heard) and what doesn’t add up
quox lucid ask [options] <question...>	Ask LUCID anything about your situation, in plain words (routed to the LUCID agent)
quox lucid replay [options]	What LUCID knew at a past moment (rebuilt from the journal)
quox lucid told [options]	What LUCID told you (herald steps and briefings), with witness ids
quox lucid journal [options]	Raw journal entries
quox lucid ack <seq>	Advance your cursor to a journal seq
quox lucid why [options] <ref>	Why is this on the list: who, what, why, when, what it affects, and what you can do
quox lucid do [options] <ref> <measure_id>	Carry out one of the measures offered by lucid why
quox lucid teach [options] <target> <assignment>	Teach LUCID a rule, e.g. quox lucid teach hitl:abc urgency=fyi --scope subject
quox lucid lessons [options]	What you have taught LUCID
quox lucid forget <id>	Forget a lesson
quox lucid area [options] <name>	One area of the situation: headline, what needs you, measures, last outcome
quox lucid herald [options]	When LUCID speaks first: your herald settings and what it has escalated

quox sitrep

LUCID situation report: what needs you, every area, what changed, what LUCID cannot see

Usage: quox sitrep [options]

Option	What it does
--agent	compact, id-rich form for agents
--json	the full structured situation
--spoken	sentences only, as read on the phone

quox tg

Manage Telegram Pro: onboarding status, owner binding, session leases, webhook admin

Command	What it does
quox tg status [options]	Show Telegram Pro onboarding status: bot, webhook, seen chats, owner binding
quox tg bind-owner [options] <tg_chat_id>	Bind a Telegram chat as the owner target (the chat must have messaged the bot first)
quox tg leases	List session leases for parallel terminal identities (T1-T8)
quox tg webhook-info [options]	Show current Telegram webhook status (per-bot info is pending backend support; --bot is a no-op today)
quox tg setup [options] <webhook_url>	Register the Telegram webhook URL for the bot

quox dev

Manage dev-mode (DEVSUITE) fleet hosts

Command	What it does
quox dev enable [options] <hostId>	Register a fleet host as a dev server (signs + delivers a quoxagent capability profile)
quox dev skills	Dev skill-pack delivery (signed core dev pack)
quox dev sessions	Interactive tmux sessions on a dev host (survive detach; drive with send/pane)
quox dev doctor [hostId]	Check whether a host is really working as a dev server
quox dev supervisor	Headless runner: answer a resident’s slot channel with no interactive session open
quox dev resident	Deploy/reboot a full interactive claude session as a dev host’s resident (governed tmux + slots, no ssh)

quox build

QuoxBuild: dispatch and inspect governed builds on dev servers

Command	What it does
quox build dispatch [options] <target>	Queue a build of a pre-registered target on a dev server
quox build status [options]	Live executor state on a dev server: readiness, prereqs, building-now, last outcomes
quox build targets [options]	List a dev server’s pre-registered build targets
quox build history [options]	Durable build receipts (the witnessed mirror), newest first
quox build latest	Latest receipt per target (the build-status board)

quox slot

Manage DEVSUITE-SLOTS: checkout/release the fixed session addresses, say/read into a slot room

Command	What it does
quox slot list	List slots for the active org
quox slot create <name>	Create a new slot
quox slot retire [options] <name>	Retire (delete) a slot
quox slot prune [options]	Retire old unused slots (free, idle longer than --older-than days). Dry run unless --yes
quox slot checkout [options] <name>	Check out a slot for this session
quox slot release [options] <name>	Release a slot
quox slot control [options] <name> <command>	Send a control command to the session holding a slot (owner/admin only). Commands: compact, status
quox slot heartbeat [options] <name>	Send a heartbeat for a held slot
quox slot assign [options] <name> [session]	Assign a slot to an expected holder (session name); slot stays free until claimed
quox slot claim [options] [name] [messageId]	Claim every free slot assigned to this session
quox slot say [options] <name> <text...>	Say something into a slot’s Matrix room (use - to read a multi-line, Markdown message from stdin)
quox slot read [options] <name>	Read a slot’s recent room messages (cached; see quox slot peek for the last few)
quox slot peek [options] <name>	Alias of quox slot read &lt;name&gt; --limit 10
quox slot wait [options] <name>	Block until someone speaks into the slot (long-poll; heartbeats your hold while waiting)
quox slot bridge	Manage the Telegram/Discord rooms a slot say renders into

quox gripe

File a one-liner complaint as a GitHub issue (via the GRIPE agent)

Usage: quox gripe [options] <complaint...>

Option	What it does
--repo <owner/name>	target repo (GRIPE defaults sensibly when omitted)
--label <label>	issue label, e.g. bug, idea, fleet
--yes	skip the confirmation step and let GRIPE file it directly

quox nucleus

Ask the codebase a question (RepoBrain, governed and audited)

Command	What it does
quox nucleus query [options] <question...>	Query the codebase and get cited file:line snippets

quox onboard

Guided, idempotent, resumable wizard to onboard a customer site as a governed Quox tenant

Usage: quox onboard [options] <host>

Option	What it does
--name <customerName>	the org display name
--repo <owner/name>	the customer GitHub repo for auto-filed security issues
--target <hostOrIp>	the scan target (defaults to <host>)
--environment-tier <tier>	dev | staging | production (default: “dev”)
--schedule-cron <expr>	cron cadence for the recurring scan (default: “0 2 * * 3”)
--tool <name>	capability tool to schedule (default: “vuln_scan”)
--yes	run non-interactively: do every automatable step and print gate instructions without pausing

quox x

X (Twitter) posting: governed, HITL-approved via HITL Inbox

Command	What it does
quox x post [options] <text>	Draft a post to X. Files an owner approval card and returns immediately; never posts directly.
quox x thread <file>	Draft a thread from a file, split on blank-line-separated blocks. Files one owner approval card for the whole thread. A line of the form “!image: <path>” inside a block attaches that image (up to 4 per block, consumed: never posted as text); the path must live under the X media root (run quox x media-root) inside your org’s subdirectory.
quox x delete <tweet_id>	Delete an existing X post. Files an owner approval card and returns immediately; never deletes directly.
quox x like <tweet_id>	Like a tweet as the org account. Files an owner approval card and returns immediately; never likes directly. Capped by the daily engagement budget.
quox x repost <tweet_id>	Repost (retweet) a tweet as the org account. Files an owner approval card and returns immediately; never reposts directly. Capped by the daily engagement budget.
quox x read <tweet_id>	Read one tweet by id, with public metrics. One paid X API read per run (roughly $0.005).
quox x timeline [options]	Read recent posts from the connected account’s timeline. One paid X API read per run (roughly $0.005).
quox x search [options] <query>	Search recent tweets (last ~7 days, X search operators supported). One paid X API read per run (roughly $0.005).
quox x mentions [options]	Read recent mentions of the connected account. One paid X API read per run (roughly $0.005). The mentions poller already covers this on a schedule when an org opts in; this verb is the on-demand check.
quox x status	Show current posting budget usage and X credential health
quox x media-root	Print the X media root directory. Image files for x post --image / thread !image: lines must live under here, in your org’s own subdirectory.
quox x media	X media files for post attachments

quox linkedin

LinkedIn publishing: governed, HITL-approved via HITL Inbox

Command	What it does
quox linkedin post [options] <text>	Draft a LinkedIn post. Files an owner approval card and returns immediately; never posts directly.
quox linkedin comment [options] <post_urn> <text>	Draft a comment on a LinkedIn post. Files an owner approval card and returns immediately; never comments directly.
quox linkedin posts [options] <author_urn>	List recent posts for a member or organisation (read-only, no approval needed).
quox linkedin org <org_id>	Show a LinkedIn organisation page: name, follower count, website (read-only). Also the cheapest live credential check.

quox facebook

Facebook Pages publishing (organic): governed, HITL-approved via HITL Inbox

Command	What it does
quox facebook post [options] <message>	Draft a Facebook Page post. Files an owner approval card and returns immediately; never posts directly.
quox facebook pages [options]	List the Facebook Pages this token can manage (read-only, no approval needed).
quox facebook posts [options]	List recent posts on a Facebook Page (read-only, no approval needed).
quox facebook insights [options]	Show organic Page Insights (impressions, engagement, fans) for a Facebook Page.
quox facebook lead-forms [options]	List the Lead Ads forms attached to a Facebook Page.
quox facebook leads [options]	Retrieve submitted leads for a Lead Ads form.

quox instagram

Instagram publishing and monitoring (organic): governed, HITL-approved via HITL Inbox, on the shared Meta credential

Command	What it does
quox instagram publish [options] [caption]	Publish a single image, video, or reel to an Instagram account. Files an owner approval card and returns immediately; never publishes directly.
quox instagram accounts [options]	Discover the Instagram professional account linked to a Facebook Page (read-only, no approval needed).
quox instagram media [options]	List recent media on an Instagram account (read-only, no approval needed).
quox instagram insights [options]	Show media or account insights (reach, saved, likes, comments, shares, views, follower_count).
quox instagram comments [options]	List comments on an Instagram media item.
quox instagram reply <comment_id> <message>	Reply to a comment on an Instagram media item. Files an owner approval card and returns immediately; never replies directly.
quox instagram quota [options]	Show the rolling 24-hour publishing quota for an Instagram account (hard cap: 100 API-published posts).

quox tiktok

TikTok video publishing and draft uploads: governed, HITL-approved via HITL Inbox, on your own dedicated TikTok credential

Command	What it does
quox tiktok publish [options] <title>	Publish a video from a file under the org TikTok media root. Files an owner approval card and returns immediately; never publishes directly.
quox tiktok draft [options] <title>	Upload a video to the account’s TikTok inbox as a draft, finished manually in the TikTok app. Files an owner approval card and returns immediately; never uploads directly.
quox tiktok profile	Show the connected TikTok profile (also the cheapest live credential check).
quox tiktok videos [options]	List the connected account’s recent videos (read-only, no approval needed).
quox tiktok stats [options]	Show engagement stats for specific videos by id.
quox tiktok status [options]	Check the status of a video publish or draft upload by publish_id.

quox tui

Launch interactive TUI

Usage: quox tui [options] [screen]

Option	What it does
--governed	Run the TUI in a Quox governed tmux session (survives sleep and drops)
--name <name>	Session name for --governed (reattaches if it is already running)
--no-tmux	With --governed: skip tmux

quox completion

Generate shell completions (bash, zsh, fish)

Usage: quox completion [options] <shell>