api
    New
    2026-06-18

    CLI Reference (oss)

    The `oss` command-line client for Aegis Sovereign — AI-safety enforcement, red-team certification, model clearance, approvals, SLOs, regulatory reports, and audit-chain anchoring, all from your terminal or CI pipeline.

    cli
    oss
    ci-cd
    safety
    automation
    developer

    Overview

    The oss CLI ships with the Aegis Sovereign Python SDK and talks to the platform API. It is the fastest way to wire AI-safety gates into CI/CD: most commands exit non-zero on a blocking condition, so they double as pipeline gates. Two command groups are covered here — oss safety (the AI Safety Platform) and oss audit (audit log + immutable-ledger anchoring).

    bash
    1# The CLI is installed with the Python SDK
2pip install aegissovereign
3
4# Configure endpoint + token (or use OSS_API_URL / OSS_API_TOKEN env vars)
5oss login --api-url https://sovereign.yourcompany.com --token $OSS_PAT
6
7oss --help
8oss safety --help

    oss safety — AI Safety Platform

    Every safety capability is reachable from the CLI. Validation, clearance, and agentic checks exit 1 when blocked so they can gate a build.

    bash
    1# Block the build if a prompt template trips the safety engine
2oss safety validate "$(cat prompt-template.txt)" --target input
3
4# Gate deployment on model clearance (exit 2 = not deployable)
5oss safety clearance gate my-fine-tune --workspace ws-prod
6
7# Run red-team certification with a domain library, fail on any miss
8oss safety redteam run --domain financial --strict --output json --output-file cert.json
    CommandWhat it does
    `oss safety validate "<text>"`Run text through the Safety Policy Engine (regex + ML ensemble). Exits 1 if blocked. `--target output`, `--dry-run`, `--output json`
    `oss safety rules`List active safety rules. Filter with `--category` / `--severity`
    `oss safety classifier status`Show the active ML classifier ensemble; warns if NullClassifier (regex-only) is active
    `oss safety classifier test "<text>"`Run text through the classifier locally
    `oss safety mask "<text>"`Redact PII in place (email, SSN, card, secrets). `--engine presidio`
    `oss safety image <file>`Scan an image for unsafe content (multimodal). Exits 1 if blocked
    `oss safety conversation <file.json>`Detect crescendo / persistence / refusal-bypass across a multi-turn conversation
    `oss safety redteam run`Run the red-team certification suite. `--domain medical|financial|legal`, `--strict`, `--output json`
    `oss safety redteam multi-turn`Run the built-in multi-turn attack chains
    `oss safety clearance gate <model>`Pre-deployment clearance gate (bias + robustness + safety). Exits 2 if NOT deployable
    `oss safety clearance evaluate|list`Recompute/persist or list ModelSafetyRegistry clearance verdicts
    `oss safety agentic tools`List registered tool-call safety policies (risk tier, approval, allow-list)
    `oss safety agentic validate <tool> --args '{…}'`Validate a tool call through the agentic guard. Exits 1 if blocked
    `oss safety agentic delegation <from> <to>`Validate an agent→agent delegation against the trust boundary
    `oss safety slo list|status <id>`List safety SLOs or show burn-rate + error budget for one
    `oss safety review list|decide`List pending approvals or record an approve/reject decision (audit-logged)
    `oss safety integrations list|test <provider>`List configured integrations or send a test event
    `oss safety report generate <framework>`Generate a safety report (eu_ai_act, nist_ai_rmf, fedramp_poam, sr_11_7)

    oss audit — Audit log & ledger anchoring

    The oss audit group reads the tamper-evident per-workspace audit chain and manages external anchoring (see the Audit-Chain Anchoring doc). verify-anchor exits 2 if the live chain head no longer matches the latest external anchor — i.e. tampering.

    bash
    oss audit anchor ws-prod                 # publish the current chain head
oss audit anchors ws-prod --limit 20     # list past anchors + receipts
oss audit verify-anchor ws-prod          # exits 2 if the chain was altered after anchoring
    CommandWhat it does
    `oss audit tail`Show recent audit entries (`--follow` to stream)
    `oss audit export`Export audit entries to CSV
    `oss audit anchor <workspace>`Publish the current chain head to the external immutable ledger
    `oss audit anchors <workspace>`List past anchors and their ledger receipts
    `oss audit verify-anchor <workspace>`Recompute the live head and compare to the latest anchor. Exits 2 on mismatch

    Exit Codes

    Commands are designed to gate pipelines. 0 always means pass/allowed.

    CodeMeaning
    `0`Pass / allowed / consistent
    `1`Blocked — validation, agentic, image, or red-team failure
    `2`Gate not met — clearance not deployable, or anchor mismatch (tampering)
    Edit this page on GitHub