Command reference

Run breachline --help or breachline <command> --help for the full option list of your installed version.

Account

Command	What it does
breachline auth login	Sign in with email and password, the browser, or --key bl_live_... for non-interactive use.
breachline auth logout	Sign out and clear all BreachLine data stored on this machine.

Running Nebula

Command	What it does
breachline	Start the interactive terminal client in the current project.
breachline run [message..]	Run with a message and exit. See options below.
breachline models	List the models available to your account.
breachline serve	Start a headless server.
breachline web	Start the server and open the web interface.
breachline acp	Start an Agent Client Protocol server for editors that support it.

run options

Option	Effect
--continue	Continue the last session.
--session <id>	Continue a specific session.
--fork	Fork the session before continuing (with --continue or --session).
--model <model>	Choose the model.
--agent <name>	Choose the agent.
--format json	Print raw JSON events instead of formatted output, for scripts and CI.
--file <path>	Attach one or more files to the message.
--title <text>	Title the session.

Sessions and data

Command	What it does
breachline session list	List sessions.
breachline session delete <id>	Delete a session.
breachline export [id]	Export a session as JSON. Add --sanitize to redact sensitive transcript and file data.
breachline stats	Show token usage and cost statistics, optionally for the last N days or one project.

Extending

Command	What it does
breachline mcp add	Add an MCP server (interactive, or with flags for CI). See MCP servers.
breachline mcp add-json <name> <json>	Add an MCP server from a JSON definition.
breachline mcp list	List MCP servers and their status.
breachline mcp get <name>	Show one server’s configuration, status and capabilities.
breachline mcp approve <name>	Approve a pending project server and connect it.
breachline mcp remove <name>	Remove a server and disconnect it.
breachline mcp auth [name]	Sign in to an OAuth-enabled MCP server.
breachline mcp edit	Open the MCP config file in your editor.
breachline agent create	Create a custom agent definition.
breachline agent list	List available agents.
breachline plugin list	List loaded plugins.

Source control

Command	What it does
breachline github install	Install the GitHub agent in a repository.
breachline github run	Run the GitHub agent.
breachline pr <number>	Check out a GitHub pull request branch, then start BreachLine on it.

Devices and sandboxes

Command	What it does
breachline mobile [ios or android]	Set up mobile app testing: connect your own iOS device, or use a server-side Android sandbox.
breachline sandbox connect	Verify Docker and connect an approved machine’s sandbox and network tunnel.
breachline sandbox doctor	Check prerequisites, the signed image, the service and the backend without running a task.
breachline sandbox stop	Stop the local broker, keeping task containers, workspaces and receipts.

Maintenance

Command	What it does
breachline upgrade [version]	Upgrade to the latest or a specific version.
breachline uninstall	Remove the CLI and its files. --keep-config and --keep-data keep configuration or sessions; --dry-run shows what would be removed.

Note

The interactive client starts in nebula, the default primary agent, which runs the authorized objective end to end and coordinates specialist branches when the work splits. Other primary agents include pentest, a methodology-driven engagement that finishes with a client-ready report, and god, which focuses on finding previously unknown, high-impact vulnerabilities. Press Tab (or Shift+Tab) to switch between them.