CLI reference

Oriel exposes one root command:

oriel [--config oriel.toml] <command>

The config flag is also available as ORIEL_CONFIG.

Root flag

Flag	Default	Description
`--config`, `-c`	`oriel.toml`	Path to the TOML config file. Environment overrides still apply.

`serve`

Run the Oriel server.

oriel serve --role=all

Flag	Default	Values
`--role`	`all`	`all`, `ingest`, `query`, `worker`

`migrate`

Apply or inspect metadata and ClickHouse schema migrations.

oriel migrate up
oriel migrate status
oriel migrate down --steps 1 --yes

Subcommand	Purpose
`migrate up`	Apply all pending migrations.
`migrate status`	Show migration ledger state for each store.
`migrate down`	Roll back applied migrations. This destroys data and requires `--yes`.

Common flag:

Flag	Default	Values
`--store`	`all`	`metadata`, `clickhouse`, `all`

migrate down flags:

Flag	Default	Description
`--steps`	`1`	Number of versions to roll back.
`--all`	`false`	Roll back every applied version.
`--yes`	`false`	Confirm destructive rollback.

`admin`

First-run and emergency administration helpers.

ORIEL_BOOTSTRAP_PASSWORD='change-me' \
  oriel admin bootstrap --email you@example.com
oriel admin create-workspace --slug demo
oriel admin token --workspace demo --permissions telemetry:query
oriel admin invite --email user@example.com --workspace demo --role viewer

Subcommand	Purpose
`admin bootstrap`	Create the first instance-admin user. Refuses to run once any user exists.
`admin create-workspace`	Create a workspace.
`admin token`	Mint an API token for a workspace. The secret is printed once.
`admin invite`	Create an invitation and print its one-time accept link.

admin bootstrap flags:

Flag	Required	Description
`--email`	Yes	User email.
`--password`	Yes	Prefer `ORIEL_BOOTSTRAP_PASSWORD` because flags are visible in process lists.
`--name`	No	Display name. Defaults to email.

admin create-workspace flags:

Flag	Required	Description
`--slug`	Yes	Workspace slug. Leading underscore slugs are reserved.
`--name`	No	Display name. Defaults to slug.
`--owner-email`	No	Instance-admin recorded as creator.

admin token flags:

Flag	Required	Default	Description
`--workspace`	Yes		Workspace slug.
`--name`	No	`api`	Token name.
`--permissions`	No	`telemetry:query`	Comma-separated API permissions.

admin invite flags:

Flag	Required	Description
`--email`	Yes	Invitation recipient.
`--workspace`	No	Workspace slug. Omit for an instance account-only invite.
`--role`	No	Workspace role slug. Defaults to `viewer` for workspace invites.
`--instance-admin`	No	Grant instance-admin on an instance invite.

`doctor`

Check deployment health.

oriel --config /etc/oriel/oriel.toml doctor

doctor checks:

Metadata DSN and PostgreSQL connectivity
ClickHouse DSN, connectivity, and version floor
Valkey DSN and connectivity
Migration status for both stores
Clock skew
TLS or plaintext listener safety
Disk headroom

`flags`

Offline feature-flag developer tooling. These commands read only the filesystem and never contact a running server.

`flags scan`

Scan a repository for feature-flag key references and emit a usage map plus orphaned and undefined keys, as JSON or JUnit. Pass the flag keys Oriel defines (via --keys or --keys-file) to detect orphaned keys (defined but never referenced) and undefined keys (referenced in code but not defined).

oriel flags scan ./my-app --keys-file flags.txt --format junit --fail-on-issues

Flag	Purpose
`--repo`	Repository root to scan (or pass it as an argument). Defaults to the current directory.
`--keys`	Comma-separated flag keys defined in Oriel.
`--keys-file`	File of flag keys: one per line, or a JSON array.
`--format`	`json` (default) or `junit`.
`--call-pattern`	Override the flag-accessor regex; capture group 1 is the key.
`--fail-on-issues`	Exit non-zero when orphaned or undefined keys are found (for CI gating).

`mcp`

Run a read-only MCP server over stdio so an AI agent can investigate telemetry through the query API. It is a client of a running query server, authenticated by an API token, and exposes only read operations.

export ORIEL_TOKEN=orl_...
oriel mcp --api https://oriel.example.com --workspace demo

Flag	Default	Description
`--api`	`http://127.0.0.1:6743`	Base URL of the Oriel query API. Also `ORIEL_API`.
`--workspace`, `-w`		Default workspace slug. Omit to use the token’s workspace. Also `ORIEL_WORKSPACE`.

The token is read from ORIEL_TOKEN, never a flag, so it stays out of process lists. It needs telemetry:query, plus slos:read and alerts:read for the SLO and alert tools.