Reference
CLI Reference
All iris commands (v0.2.12), organized by phase. Run iris --help for the live command tree.
Discover
| Command | Description |
|---|---|
iris scan | Scan governance directory for policy violations |
iris scan --discover | Find ungoverned agents in Python/TypeScript source |
iris scan --discover --auto-register | Write passport drafts for ungoverned findings |
iris scan --discover --govern | Register and apply one-line governance fixes |
iris scan --format json | Machine-readable output for CI |
iris scm scan-local | Scan a local repo for agent patterns |
iris scm scan-repo | Scan a GitHub repository |
iris scm scan-org | Inventory agents across a GitHub org |
iris scm webhook start | Listen for push events and re-scan |
iris scm setup | Interactive GitHub token/App setup |
Inventory
| Command | Description |
|---|---|
iris declare | Declare an agent — creates passport.yaml (primary) |
iris register | Alias for iris declare |
iris quickstart | Interactive setup walkthrough |
iris list | List all governed agents (alias: iris agents) |
iris list --filter-ungoverned | Show agents missing policy.cedar |
iris status | Compliance dashboard and next actions per agent |
iris models list | Model tiers, export-control status, fallbacks |
iris models directives | Active model suspensions and kill switches |
iris models reload | Hot-reload registry and directives |
iris users add/list/remove | Manage reviewers and delegation users |
Define (policy)
| Command | Description |
|---|---|
iris compile --agent <name> | Plain English intent → Cedar (top-level alias) |
iris policy compile | Same as iris compile |
iris policy compile --backend openai | Choose LLM backend (anthropic, openai, google, mistral, groq, ollama, together) |
iris policy compile --litellm-model ollama/llama3.2 | Any LiteLLM model string |
iris policy compile --dry-run | Preview Cedar without writing to disk |
iris policy diff | Compare intent draft vs committed Cedar |
iris policy status --agent <name> | Check policy binding, staleness, and draft cache |
iris policy commit --agent <name> | Apply compiled draft to policy.cedar |
iris preview --agent <name> | Risk impact of pending policy changes |
iris framework suggest | Recommend applicable compliance frameworks |
Guard (runtime)
| Command | Description |
|---|---|
iris enforce | Verify drop-in clients or @agent.guard() are wired |
iris explain | Plain-English explanation of how the proxy works |
iris delegation status/test/log | User delegation config and audit |
iris dlp scan/test | Scan files and test prompts for sensitive data |
HITL (human-in-the-loop)
| Command | Description |
|---|---|
iris hitl setup --agent <name> | Interactive wizard to enable HITL and declare condition rules |
iris hitl list | List pending reviews (use --status all for history) |
iris hitl list --agent <name> | Filter reviews by agent |
iris hitl show <review-id> | Full detail for a single review |
iris hitl approve <review-id> | Approve — waiting agent call proceeds |
iris hitl reject <review-id> --reason "..." | Reject — agent call raises IrisViolationError |
iris hitl escalate <review-id> | Escalate to a senior reviewer |
iris hitl config --agent <name> | Show HITL configuration for an agent |
iris hitl rules --agent <name> | Show what will and will not trigger HITL |
iris hitl test --agent <name> | Simulate a HITL review flow |
Full guide: HITL & Delegation
Audit (compliance)
| Command | Description |
|---|---|
iris compliance check --framework <id> | Run compliance check (colorado-ai-act, ccpa-admt, china-pipl, hipaa, soc2, aiuc-1, …) |
iris compliance assess | Impact assessment (Colorado, CCPA ADMT, PIPL PIPIA) |
iris certify --framework colorado-ai-act | Certification readiness score (alias: iris test) |
iris certify --framework aiuc-1 --format aiuc1-export | AIUC-1 evidence JSON keyed by sub-control IDs (B006.1, B006.2, …) |
iris certify --framework iso-42001 | ISO 42001 coverage tiers (FULL / PARTIAL / NOT APPLICABLE) from AIUC-1 crosswalk |
iris regulatory check/list/watch | Track AI law changes |
iris regulatory history/apply | View and apply regulatory updates |
iris evidence report --agent <name> | Full audit report for one agent |
iris evidence list --agent <name> | List recent vault events |
iris evidence query | Filter vault events by agent, decision, regulation, risk |
iris evidence export --agent <name> | Export for auditors (JSON, CSV, AIUC-1, OTel) |
iris evidence stats | Aggregate stats across all agents |
iris evidence record-cicd | Write signed cicd_run event from CI/CD (github_actions, gitlab, jenkins, terraform, argocd) |
iris evidence export --format aiuc1 | Export via ControlMapping table (same path as AIUC-1 certify) |
iris vault redact | GDPR erasure — tombstone + payload scrub, mappings preserved |
Monitor
| Command | Description |
|---|---|
iris witness --agent <name> | Live attested feed of policy decisions (alias: iris watch) |
iris sentinel | Continuous governance monitoring |
iris drift snapshot/check/report/watch | Compliance posture change detection |
iris cost summary/report/alert/optimize | Token cost tracking per agent |
iris red-team --agent <name> | Adversarial policy bypass testing |
Integrate
| Command | Description |
|---|---|
iris mcp start | Start Cursor MCP server (stdio) |
iris entitlements | Show tier and feature availability |
iris license status/activate/deactivate | License management |
SDK optional packages
| Install | Drop-in client |
|---|---|
pip install iris-security-sdk[anthropic] | IrisAnthropic |
pip install iris-security-sdk[openai] | IrisOpenAI |
pip install iris-security-sdk[google] | IrisGemini |
pip install iris-security-sdk[vertexai] | IrisVertexAI |
pip install iris-security-sdk[langchain] | LangChain callbacks |
pip install iris-security-sdk[crewai] | CrewAI integration |
pip install iris-security-scm | SCM scanning commands |
Environment variables
| Variable | Description |
|---|---|
IRIS_ENV | dev · test · staging · production — stamped on Evidence Vault events |
IRIS_AGENT_ID | Default agent for iris evidence record-cicd |
IRIS_VAULT_SIGNING_KEY | HMAC signing key for Evidence Vault v2 (local dev default is per-agent derived) |
IRIS_USER_EMAIL | Acting user for delegation and HITL |
IRIS_USER_WORK_AUTHORIZATION | Work authorization for frontier/export-controlled models |
IRIS_TELEMETRY_OPT_OUT=1 | Disable anonymous telemetry |
GITHUB_TOKEN | Required for iris scm scan-repo / scan-org |