§07 — SDKs & tooling

The exo CLI

Headless ops from the terminal. Drive your cluster's agents and tools, manage dashboard resources, replay sessions, and sync skills — without opening the browser.

5 min read·Set by Exo Editorial·v0.3.0 Beta

The exo CLI is a single static binary with no runtime dependencies. It talks to two places at once: the Exo dashboard API (for tenant resources like deployments, roles, and skills) and your cluster's Exo Operator (for the in-cluster Agent and Tool custom resources). It caches its session to a file on disk and is the right tool for incident response — when the UI is the wrong shape, the CLI is the right shape.

Install

Download the binary, put it on your $PATH, and confirm the version. Builds ship for macOS (Intel and Apple Silicon), Linux (amd64 and arm64), and Windows.

●terminal· bash

1# macOS / Linux
2chmod +x exo
3sudo mv exo /usr/local/bin/
4 
5exo version

exo login opens a browser against your Exo endpoint, runs the tenant's sign-in flow (password, OAuth, or SSO), and writes the resulting token to ~/.config/exo/credentials.json (mode 0600). Subsequent commands pick the cached session up automatically.

●terminal· bash

1exo login --endpoint https://exo.example.com
2# Opening browser to https://exo.example.com/login?cli_callback=...
3# ✓ Authenticated as ada@example.com

Two surfaces, one binary

Commands fall into two families, and it helps to know which is which when a call fails:

Cluster commands (agent, tool, invocation) reach your cluster through its kubeconfig — they proxy to the agentkube-manager service in the agentkube-system namespace. Point them with --kubeconfig, --context, or --manager-url.
Dashboard commands (deployment, session, audit, skill, role, team, idp, and the other resource verbs) call the Exo API directly with your bearer token from exo login.

Command reference

●exo help· text

1# Session
2exo login            Authenticate (browser, or --email/--password for CI)
3exo logout           Delete cached credentials
4exo whoami           Show the authenticated user
5exo me identity      Show identity; "exo me permissions" shows effective perms
6exo version          Print the CLI version
7exo tui | exo ui     Launch the interactive terminal UI
8 
9# Cluster resources (via kubeconfig → Exo Operator)
10exo agent            list | get | create -f | delete | invoke | connect
11exo tool             list | get | create -f | delete | connect | exec | pause | status | test
12exo invocation       list | get        # agent invocation CRs
13 
14# Dashboard resources (via Exo API, requires exo login)
15exo deployment       list | get | delete | rotate-token | retention | resources |
16                     sessions | invoke-agent | audit | casts
17exo session          list | get | tool-calls | resume      # supervised sessions
18exo audit            search | export                       # tenant or per-deployment
19exo skill            list | get | create | update | delete | sync
20exo role             list | get | create | update | delete
21exo team             list | get | create | update | delete | add-user |
22                     remove-user | attach-role | detach-role
23exo permission       list | create | update | delete
24exo idp              list | get | create | update | delete
25exo runtime-policy   list | get | create | update | delete
26exo guardrail        list | get | create | update | delete
27exo integration      list | get | create | update | delete
28exo provider         list | get | create | update | delete
29 
30# Add --json to any command for machine-readable output.

Interactive TUI

exo tui (alias exo ui) opens a full-screen browser for your tenant: pick a category — Agents, Tools, Deployments, Integrations, Providers, Roles, Teams, Skills — drill into the list, and inspect any resource. From an agent or tool, press c to connect; the TUI shells out to exo agent connect or exo tool connect for you, so you never copy a resource name by hand.

●exo tui keys· text

1↑ ↓  /  k j     move within a list
2← →             back / forward between panes
3enter           select · view detail · run the action
4c               connect to the selected agent or tool
5q  /  esc       quit

Common workflows

A few real incantations:

●attach to an agent· bash

1# Run a supervised agent and drop into its shell
2exo agent invoke prod/checkout-bot --reason "investigating stuck order"
3 
4# Or attach to an already-running supervised session
5exo agent connect prod/checkout-bot

●open a database bastion· bash

1# Spin up a bastion pod for a Tool and get a shell with the
2# connection string injected (PGHOST, PGPORT, …); auto-pauses when idle
3exo tool connect prod/orders-db
4exo tool exec prod/orders-db -- psql -c 'select count(*) from orders'

●audit & replay· bash

1# Search the audit stream for one deployment
2exo audit search --deployment <id> --since 2026-05-01
3 
4# Download a session recording as an asciicast
5exo deployment casts download <id> <cast-id> -o session.cast

●sync skills to disk· bash

1# Materialise tenant skills into a local runtime layout
2exo skill sync --runtime claude --output-dir . --prune
3# writes ./.claude/skills/<name>/SKILL.md with exo: provenance frontmatter

Environment & config

●environment· text

1EXO_ENDPOINT          Dashboard API base URL (else credentials.json, else default)
2EXO_TOKEN             Raw bearer token — highest precedence
3EXO_CLIENT_ID         OAuth client credentials, exchanged at /api/v1/oauth/token
4EXO_CLIENT_SECRET     (used when no EXO_TOKEN / credentials.json is present)
5EXO_CREDENTIALS       Override path to credentials.json (default ~/.config/exo/)
6EXO_MANAGER_URL       Direct agentkube-manager URL (bypass the kube-apiserver proxy)
7KUBECONFIG            Kubeconfig for cluster commands
8NO_COLOR              Disable ANSI colour (https://no-color.org)

Terraform

The terraform-provider-exo provider is the right tool for managed, reviewed, version-controlled changes — deployments, roles, IdPs. The CLI is the right tool for interactive work; the provider is the right tool for the work you don't want to do interactively. Both speak to the same API and produce the same audit trail.

Previous · Identity & accessRoles & permissions Next · Editorial Changelog