reference developer public

CLI reference

The drc binary is a Rust command-line client for local capture, analysis, hosted API operations, governance, and CI integration.

Run drc --help and drc COMMAND --help against the installed version for the authoritative flags. The examples below use the current command names and option forms.

Core capture and analysis

Command	Purpose
`drc init`	Detect a project and create `.drc/drc.toml`.
`drc run`	Start the background capture daemon/proxy.
`drc watch`	Stream events from the daemon live socket.
`drc stop`	Stop the daemon, optionally flushing buffered events.
`drc capture`	Create a local capture session envelope and checkpoint events.
`drc search`	Search known local executions.
`drc replay`	Replay a known execution; `--fix` performs counterfactual envelope comparison.
`drc trace`	Show causal chain and root-cause context.
`drc diff`	Compare two executions.
`drc bisect`	Isolate a first divergence between baseline and mutated executions.
`drc blast-radius`	Scan execution history for a similar pattern.
`drc analyze`	Run the local analysis pipeline.
`drc diagnose`	Check local CLI prerequisites and storage paths.
`drc healthcheck`	Check an HTTP readiness endpoint.

Capture examples


drc init --codebase . --language auto --non-interactive --telemetry off --auto-update off
drc run --port 8080 --target-port 3000
drc watch --filter error
drc stop --flush

Analysis examples


drc search --service checkout --time-range 24h --format json
drc trace EXECUTION_ID --json
drc replay --execution-id EXECUTION_ID --mode strict --json
drc diff BASELINE_ID CANDIDATE_ID --format json --show-fields
drc bisect --baseline BASELINE_ID --mutated MUTATED_ID --json
drc blast-radius --execution-id EXECUTION_ID --max-scan 100 --json
drc analyze --execution-id EXECUTION_ID --json

Analysis JSON is intended for automation and agents. Always inspect completeness and result status before treating it as a release decision.

Authentication and hosted operations


drc login --api-url https://api.example.com --email you@example.com --password-stdin
drc whoami
drc logout
drc api-key generate --file .drc/api-keys.json --service-name ci --tenant-id TENANT_ID --role service
drc api-key list --file .drc/api-keys.json

Use a secret manager for production credentials. --allow-insecure-http is intended for controlled local/non-TLS endpoints, not public traffic.

Gateway and CI


drc gateway check \
  --baseline BASELINE_ID \
  --candidate CANDIDATE_ID \
  --deployment-id DEPLOYMENT_ID \
  --environment staging

drc ci capture \
  --artifact-dir .drc/ci \
  --failing-command "pytest tests/test_checkout.py" \
  --exit-code 1

drc ci replay \
  --artifact-dir .drc/ci \
  --baseline-execution-id BASELINE_ID \
  --candidate-execution-id CANDIDATE_ID

drc ci comment --artifact-dir .drc/ci --output .drc/ci/pr-comment.md --dry-run

Gateway and CI checks report analysis/comparison results. They do not execute a deployment or claim that a candidate is safe without the required evidence contract.


drc push --execution-id EXECUTION_ID
drc pull --execution-id EXECUTION_ID
drc share --execution-id EXECUTION_ID --recipient teammate@example.com
drc shares list
drc unshare --execution-id EXECUTION_ID --recipient teammate@example.com

Share operations remain tenant- and permission-controlled. Treat shared execution data as sensitive.

Governance and privacy


drc privacy audit capture.json --policy .drc/redaction.toml --fail-on-leak
drc governance audit log --limit 100
drc governance audit verify
drc governance classification classify capture.json
drc governance legal-hold create --case CASE --description "Incident review" --targets EXECUTION_ID
drc incident export --execution-id EXECUTION_ID --output .drc/incident-packet.json

Local governance inspection does not issue compliance reports or signed evidence. Retention, legal-hold, and enterprise evidence workflows are handled by the authenticated web workspace.

Billing and server management

The CLI includes account/billing and foreground server subcommands for deployments that enable them:


drc billing plan
drc billing usage
drc billing portal
drc server start --host 127.0.0.1 --port 3000

The server process is foreground-owned; keep it under the process lifecycle tooling used by your environment.

Output and exit behavior

The primary analysis commands support --json. Keep stdout machine-readable when piping; send logs to stderr in wrappers. Commands return non-zero on configuration, authentication, storage, network, validation, replay, or governance failures. Do not parse ANSI output; use JSON for automation.

Evidence workspace

Enterprise evidence issuance is available from the authenticated web workspace. Keep API credentials and captured data under your organization’s access and retention policies.