CLI Reference
Antemure ships four binaries. None has sub-commands — each is a single flat command configured by flags and AURA_* environment variables. All read RUST_LOG and bind 0.0.0.0 by default.
antemure-daemon
The endpoint agent. Runs in the foreground (a service supervises it), serving the console on port 18900.
| Flag | Default | Description |
|---|---|---|
-c, --config <PATH> | ~/.antemure/config.yaml | Path to the YAML config. |
-p, --port <u16> | 18900 | Web/API port. |
-n, --node <ID> | enrolled id → hostname | Node id override. |
--single-cycle | off | Run exactly one cycle, print the result, and exit (testing). |
Key env: AURA_NODE_API_TOKEN, AURA_BIND_ADDR, AURA_CORS_ORIGINS, AURA_HEARTBEAT_SECS, AURA_FLEET_POLL_SECS, AURA_ADMISSION_TLS_CERT/_KEY/_PORT (k8s admission webhook), plus all config-field overrides. Default log filter antemure=info,tokio=warn.
antemure-hub
The fleet control plane and dashboard on port 18901.
| Flag | Default | Description |
|---|---|---|
--port <u16> | 18901 | Listen port. |
--endpoints <PATH> | ~/.antemure/endpoints.json | JSON roster of endpoints to poll. |
--fleet-config <PATH> | ~/.antemure/hub-fleet-config.json | Where per-node + fleet config persists (its parent is the hub state dir). |
--license-key <KEY> | env | Hub license (overrides AURA_LICENSE_KEY). |
--access8-url <URL> | env | Control plane (overrides AURA_ACCESS8_URL). |
--gateway-url <URL> | gateway.secureinsights.ai | Reasoning gateway base URL. |
Key env: enrollment secrets AURA_HUB_JOIN_TOKEN / AURA_NODE_API_TOKEN (auto-generated if unset), AURA_HUB_ADVERTISE, SSO (WORKOS_API_KEY, WORKOS_CLIENT_ID, WORKOS_WEBHOOK_SECRET, AURA_AUTH_COOKIE_SECRET, AURA_AUTH_REDIRECT_URI), AURA_SUPERADMIN_EMAILS, tenancy (AURA_TENANCY_MODE), and the SOAR link (AURA_SOAR_URL, AURA_SOAR_PROXY_SECRET). With neither an admin nor SSO configured the hub runs in open mode.
antemure-soar
The durable SOAR worker + internal API on port 18902.
| Flag | Default | Description |
|---|---|---|
--port <u16> | 18902 | API port. |
--migrate | off | Apply DB migrations (+ dev seed) and exit. |
Required env: AURA_SOAR_DATABASE_URL, AURA_SOAR_WORKER_DATABASE_URL (Postgres), AURA_SOAR_PROXY_SECRET; for --migrate, AURA_SOAR_MIGRATION_DATABASE_URL. Others: TEMPORAL_ADDRESS (default 127.0.0.1:7233), TEMPORAL_NAMESPACE, AURA_VAULT_PATH/AURA_VAULT_KEY, and per-integration vars (Jira, webhook). Normally installed by install-soar.sh or the Helm chart rather than run by hand.
antemure-mcp
The MCP server — no CLI flags, configured entirely by environment. Serves JSON-RPC 2.0 over POST /mcp on port 18902 and proxies to the hub.
| Env | Default | Description |
|---|---|---|
AURA_HUB_URL | http://127.0.0.1:18901 | Hub to control. |
AURA_MCP_PORT | 18902 | Listen port. |
RUST_LOG | info | Log filter. |
MCP tools
The MCP server exposes every hub action as a role-gated tool (36 in total), filtered to the caller's role (resolved from the hub). Connect an MCP Streamable-HTTP client (e.g. Claude) to http://<host>:18902/mcp with your Antemure session as the bearer. Representative tools by minimum role:
- Viewer —
antemure_whoami,fleet_overview,list_endpoints,fleet_incidents,fleet_pending,fleet_threats,inspect_endpoint,knowledge_graph,kg_query,kg_lookup,get_license,list_vault(names only). - Operator —
authorize_remediation(all=truegrants standing fleet autonomy),deny_remediation,retry_pending,rerun_remediation,ignore_incident,fleet_hunt,fleet_respond,analyst_chat,configure_integration,remediate_integration_alert. - Admin —
set_fleet_config,set_node_config,set_license,clear_threats,delete_vault_entry,list_users,delete_user,get_auth_config.
The MCP server enforces the same RBAC matrix as the hub and forwards each call carrying the caller's session, so the hub re-enforces it (defense in depth). See Tokens, Auth & RBAC.