kapable CLI

A single native binary (linux-amd64, darwin-arm64) that mirrors the SDK's customer-tier surface from your terminal — auth, board, data, comms, knowledge, store, and a local dev/preview supervisor. It rides kapable-sdk exclusively, so anything you can do with the Rust SDK you can do from the CLI.

First call

kapable whoami

You should see your signed-in identity and org.

Install

curl -fsSL https://cli.kapable.ai/install.sh | sh

Detects your OS/arch (linux or darwin, amd64 or arm64), downloads the latest stable build from the public release registry, verifies its SHA-256, and installs to ~/.local/bin/kapable (no sudo). Re-running the same command upgrades in place.

Overrides

KAPABLE_INSTALL_DIR / --install-dir <dir> changes the install location (default ~/.local/bin). KAPABLE_CHANNEL / --channel <name> picks a release channel (default stable). If ~/.local/bin isn't on your PATH, the installer prints how to add it.

Verify the install:

kapable --version

Staying current

The installed binary updates itself — no need to re-run the installer:

kapable self-update --check   # report whether a newer stable build exists; changes nothing
kapable self-update            # download, verify SHA-256, and atomically replace this binary

The replace is atomic: the new binary is staged, proven to run (--version succeeds), and only then swapped in with a single rename. Any failure before that point leaves your current binary untouched. On macOS, a Gatekeeper quarantine strip runs automatically; if the staged binary still won't launch, an ad-hoc codesign retry kicks in as a safety net.

Authenticating

Two credential shapes, resolved in the same precedence order on every command: flag > environment variable > stored config (an org key in [api] outranks a stored session in [session]).

kapable auth login --email you@example.com   # prompts for your password
kapable auth me                 # confirm — prints identity, org, role
kapable auth logout             # clear the stored session (any [api] org key stays)

Login persists a session grant to ~/.kapable/kapable.toml under [session] (session_token — the durable kses_… token; the short-lived JWT is never persisted).

kapable auth set-key sk_org_...   # persists a durable org key under [api]

# or, for a single invocation / headless agent — no file written:
export KAPABLE_API_KEY=sk_org_...
kapable auth me

# or, per-command override (highest precedence):
kapable --api-key sk_org_... auth me

Env vars & flags

Name	Kind	Effect
`--api-key <key>`	global flag	Credential for this invocation only. Highest precedence.
`--api-url <url>`	global flag	Base URL for this invocation only.
`KAPABLE_API_KEY`	env var	Credential, second precedence. Recommended for CI/agents.
`KAPABLE_API_URL`	env var	Base URL, second precedence.
`--config <path>`	global flag	Config file path (default `~/.kapable/kapable.toml`).
`KAPABLE_RELEASES_URL`	env var	`self-update` only — override the release registry (staging/testing).

With nothing set, the base URL defaults to https://api.kapable.ai and an unauthenticated command fails with an actionable Not authenticated. Run `kapable auth login …` … error — never a silent 401.

Command tree

Every command in the CLI, generated from its own command tree at version 0.21.4 — 28 groups, 243 commands in all. --help on any of them prints its flags.

kapable activity Activity: inspect, watch, and publish org-scoped Herald events · 5 commands

`kapable activity list`	List recent events without arbitrary payload or metadata fields
`kapable activity show`	Show one event, including its payload and metadata
`kapable activity earliest`	Return the earliest position still retained for this principal
`kapable activity watch`	Watch the live event stream as NDJSON until cancelled or bounded
`kapable activity publish`	Publish an org-scoped event.

kapable login Sign in — the fastest way to get started.

Takes no subcommand. Run kapable login --help for its flags.

kapable logout Sign out — clears the stored session (device- or password-minted alike).

Takes no subcommand. Run kapable logout --help for its flags.

kapable whoami Who am I — show the authenticated identity (org, email/key, role).

Takes no subcommand. Run kapable whoami --help for its flags.

kapable app App lifecycle: create, list, status, clone, open, deploy, logs, pat mint, templates, delete · 11 commands

`kapable app deploy`	Deploy an app and follow it to `live`/`failed` (push-verify built in).
`kapable app logs`	Print the newest deployment's build log tail (stdout = the raw log)
`kapable app list`	List your org's apps (JSON default; --table for columns)
`kapable app status`	Show an app row + its newest deployment (works with sessions AND read-scope org keys — composed from routes both can call, D15)
`kapable app clone`	git-clone an app's repo (git.kapable.dev/customer-{org}/{app})
`kapable app open`	Print the app's live URL (and open it in a browser)
`kapable app pat`	App repo PATs
`kapable app pat mint`	Print the app's repo bot PAT as JSON on stdout (owner session required; the server mints one on demand for apps that predate bot PATs)
`kapable app create`	Create an app from a starter template and follow provisioning to `created` (repo ready) — requires a login session (`kapable login`)
`kapable app templates`	List the starter-template catalog (`--template` values for `create`)
`kapable app delete`	Delete an app (soft-delete; container + routes torn down, repo archived).

kapable brand Brand: install the Kapable brand kit — theme tokens, the four faces and their licences, the mark — and check a copy for drift. · 3 commands

`kapable brand install`	Download the brand kit into a directory and record what was fetched
`kapable brand check`	Compare the copies in a directory with what the platform serves
`kapable brand show`	Print the live brand facts — the faces and the accent, as served

kapable artifact Artifacts: publish a document to the org gallery, list, read, verdict · 9 commands

`kapable artifact publish`	Publish a document — a new slug creates v1, an existing slug appends the next version.
`kapable artifact list`	List the org gallery (latest-version metadata only, never the body)
`kapable artifact get`	Show one artifact's metadata and its full version list
`kapable artifact html`	Fetch a published document's rendered body
`kapable artifact skill`	Install the artifact-publishing doctrine as a Claude Code skill, so an agent on a fresh machine publishes to taste without being told how
`kapable artifact skill install`	Write the skill into a Claude Code skills directory
`kapable artifact skill show`	Print the skill to stdout instead of writing it
`kapable artifact skill status`	Report the embedded version and what is installed, without writing
`kapable artifact verdict`	Read a decided ballot's verdict.

kapable agent Agent: LLM-powered agentic TUI over the platform (bare `agent` or `agent -p "…"` headless); `run`/`swap`/`status` remain the local worker supervisor · 3 commands

`kapable agent run`
`kapable agent swap`
`kapable agent status`

kapable auth Auth: login, orgs, API keys, apps · 21 commands

`kapable auth login`	Login: with --email (password prompted, or read from stdin when piped), with --email/--password for classic command-line credentials, or with neither to sign in via the browser (device login) and persist the session for future commands.
`kapable auth set-key`	Persist a durable org API key (`sk_org_…`) as the stored credential
`kapable auth clear-key`	Remove the stored org API key (leaves any stored login session intact).
`kapable auth logout`	Remove the stored login session (leaves any stored org key intact)
`kapable auth me`	Show current authenticated user info
`kapable auth orgs`	Manage organisations
`kapable auth orgs get`	Get an organisation by ID
`kapable auth orgs members`	List members of an organisation
`kapable auth keys`	Manage API keys
`kapable auth keys list`	List API keys for the current org
`kapable auth keys create`	Create a new API key
`kapable auth keys rotate`	Rotate an API key: mint a fresh secret onto the same key row.
`kapable auth keys revoke`	Revoke an API key
`kapable auth service-tokens`	Manage service tokens (`sig_st_` and legacy `st_`) — automation credentials
`kapable auth service-tokens list`	List service tokens for the current org
`kapable auth service-tokens create`	Create a new Signet service token (`sig_st_*`).
`kapable auth service-tokens rotate`	Rotate a service token; Signet keeps its id and reveals a new value once
`kapable auth service-tokens revoke`	Revoke a service token (idempotent)
`kapable auth apps`	List apps in an organisation
`kapable auth apps list`	List apps in an organisation
`kapable auth apps get`	Get app detail (with deployments)

kapable board Board: stories, sprints, plans, products, comments · 30 commands

`kapable board stories`	Manage stories
`kapable board stories list`	List stories with optional filters
`kapable board stories get`	Get a story by UUID or code
`kapable board stories create`	Create a new story
`kapable board stories update`	Update an existing story
`kapable board stories delete`	Delete a story
`kapable board stories transition`	Transition a story to a new status
`kapable board sprints`	Manage sprints
`kapable board sprints list`	List sprints with optional filters
`kapable board sprints get`	Get a sprint by UUID or code (includes attached stories)
`kapable board sprints create`	Create a new sprint
`kapable board sprints start`	Start a planned sprint
`kapable board sprints complete`	Complete an active sprint
`kapable board sprints attach`	Attach a story to a sprint
`kapable board sprints detach`	Detach a story from a sprint
`kapable board plans`	Manage plans
`kapable board plans list`	List plans with optional filters
`kapable board plans get`	Get a plan by UUID or code
`kapable board plans create`	Create a new plan
`kapable board plans update`	Update an existing plan
`kapable board plans revisions`	List revisions for a plan
`kapable board products`	Manage products
`kapable board products list`	List all products
`kapable board products get`	Get a product by slug or UUID
`kapable board products create`	Create a new product
`kapable board products update`	Update an existing product
`kapable board comments`	Manage comments
`kapable board comments list`	List comments for a target
`kapable board comments create`	Create a comment
`kapable board comments delete`	Delete a comment

kapable builder Designer: live previews for the design.kapable.ai workspace · 2 commands

`kapable builder preview`	Manage live preview sources for designer sessions
`kapable builder preview register`	Register a preview tunnel URL so the workspace iframe can load it

kapable comms Comms: agents, rooms, messages, email · 13 commands

`kapable comms agents`	Manage agents
`kapable comms agents list`	List all agents in the org
`kapable comms agents create`	Create (or upsert) an agent
`kapable comms agents get`	Get agent detail by ID
`kapable comms agents delete`	Delete an agent
`kapable comms rooms`	Manage rooms
`kapable comms rooms list`	List rooms
`kapable comms rooms create`	Create a new room
`kapable comms rooms get`	Get room details (with participants)
`kapable comms rooms messages`	List messages in a room
`kapable comms rooms post`	Post a message to a room
`kapable comms email`	Send email via a mailbox
`kapable comms email send`	Send an email via a mailbox

kapable conductor Conductor: run the agent daemon on this Mac — install, setup, status, uninstall · 4 commands

`kapable conductor install`	Download the daemon and (unless --no-setup) run the full setup
`kapable conductor setup`	Platform-side setup only — re-runnable for repair
`kapable conductor status`	Report what is installed, running, and registered.
`kapable conductor uninstall`	Stop and remove the launchd job.

kapable data Data: tables, rows, search · 10 commands

`kapable data tables`	Manage tables
`kapable data tables list`	List all tables
`kapable data tables create`	Create a new table (columns as JSON array)
`kapable data tables drop`	Drop a table
`kapable data rows`	Manage rows
`kapable data rows list`	List rows in a table
`kapable data rows get`	Get a single row by UUID
`kapable data rows create`	Create one or more rows (JSON object or array)
`kapable data rows delete`	Delete a row
`kapable data search`	Full-text search within a table

kapable dev Dev: spawn the local dev server + open a preview tunnel

Takes no subcommand. Run kapable dev --help for its flags.

kapable feedback Feedback: file a bug report or propose an idea (IMP-2190) · 2 commands

`kapable feedback bug`	Report a bug (files a `ticket_type: "bug"` ticket)
`kapable feedback idea`	Propose an idea (files a `ticket_type: "feature"` ticket)

kapable knowledge Knowledge: sources, claims, predicates, tensions · 13 commands

`kapable knowledge sources`	Manage knowledge sources
`kapable knowledge sources list`	List knowledge sources
`kapable knowledge sources create`	Create a new knowledge source
`kapable knowledge sources delete`	Delete a knowledge source
`kapable knowledge claims`	Manage knowledge claims
`kapable knowledge claims list`	List claims with optional filters
`kapable knowledge claims get`	Get a single claim by UUID
`kapable knowledge claims create`	Create a new claim
`kapable knowledge claims search`	Search claims (lexical, vector, or hybrid)
`kapable knowledge predicates`	List predicates in the ontology
`kapable knowledge predicates list`	List all predicates
`kapable knowledge predicates ontology`	Show ontology info for a predicate
`kapable knowledge tensions`	Detect tensions (contradictions) in the knowledge graph

kapable inbox Inbox: notification feed, unread count, read receipts, and previews · 5 commands

`kapable inbox list`	List unread notifications (or history with --include-read)
`kapable inbox count`	Return the unread badge count without fetching feed rows
`kapable inbox read`	Mark explicit notification ids read, or mark everything through an instant
`kapable inbox replay`	Replay an existing stored audio render on an org sink
`kapable inbox preview`	Preview how many stored notifications a subscription pattern matches

kapable kap Kaps: create, list, versions, triggers, runs, tokens, secrets, db · 33 commands

`kapable kap list`	List your org's kaps
`kapable kap get`	Show one kap with its files, version and triggers
`kapable kap create`	Create a kap from local files; prints the address and the bypass token once
`kapable kap save`	Save a whole new file snapshot to a kap
`kapable kap versions`	List a kap's versions, newest first
`kapable kap diff`	Show what changed between two versions
`kapable kap restore`	Restore an old version as a new version
`kapable kap delete`	Delete a kap (recoverable for a while afterwards)
`kapable kap recover`	Recover a deleted kap
`kapable kap recovery`	List deleted kaps that can still be recovered
`kapable kap token`	Bypass tokens: skip the audience check for one kap
`kapable kap token list`	List a kap's bypass tokens
`kapable kap token create`	Mint a bypass token; the token is printed once
`kapable kap token revoke`	Revoke a bypass token
`kapable kap secret`	Per-kap secrets: values come from stdin or a file, never the command line
`kapable kap secret list`	List a kap's secret names (values never come back)
`kapable kap secret set`	Set a secret's value; read from stdin, or --value-file
`kapable kap secret delete`	Delete a secret
`kapable kap trigger`	Triggers: request, schedule and inbox
`kapable kap trigger list`	List a kap's triggers
`kapable kap trigger add-schedule`	Attach a schedule trigger that runs a file on a cadence
`kapable kap trigger add-inbox`	Attach an inbox trigger that runs a file when mail arrives
`kapable kap trigger pause`	Pause a trigger
`kapable kap trigger resume`	Resume a paused trigger
`kapable kap trigger delete`	Delete a trigger
`kapable kap trigger run-now`	Run a schedule trigger now, even while paused
`kapable kap runs`	List a kap's runs, newest first
`kapable kap disable`	Switch a kap off; it refuses calls until enabled
`kapable kap enable`	Switch a kap back on
`kapable kap usage`	What your org consumed, per kap, per day, for the last 30 days
`kapable kap db`	The kap's own PostgreSQL database
`kapable kap db query`	Run one SQL statement against the kap's database
`kapable kap db tables`	List the kap's tables and columns

kapable model Model catalogue: facts, freshness, and role-based model recommendations · 5 commands

`kapable model list`	List catalogue models with bounded filtering, sorting, and pagination
`kapable model show`	Show the full facts for one canonical model id or exact alias
`kapable model status`	Show catalogue freshness, source health, and latest published diff
`kapable model roles`	List the work roles in an org's public model roster
`kapable model recommend`	Return the org-approved ranked model fallback for a work role.

kapable notify Notify: send a one-liner update to the operator (the D8 agent surface)

Takes no subcommand. Run kapable notify --help for its flags.

kapable self-update Self-update: replace this binary with the channel's latest published build

Takes no subcommand. Run kapable self-update --help for its flags.

kapable drop Drops: one-time secret handoff — mint a link, claim it, check its state · 3 commands

`kapable drop claim`	Claim a drop and put the secret somewhere that is not your screen
`kapable drop mint`	Mint a drop and print the one link that can claim it
`kapable drop status`	What is the state of a drop I minted? Never reveals the secret

kapable store Store: buckets, objects · 9 commands

`kapable store buckets`	Manage buckets
`kapable store buckets list`	List all buckets
`kapable store buckets create`	Create a new bucket
`kapable store objects`	Manage objects
`kapable store objects list`	List objects in a bucket
`kapable store objects upload`	Upload a file to a bucket
`kapable store objects download`	Download an object from a bucket
`kapable store objects delete`	Delete an object from a bucket
`kapable store objects head`	Check if an object exists

kapable todo Todos: the obligation primitive — list, add, claim, complete, dependencies (IMP-2715) · 15 commands

`kapable todo list`	List todos.
`kapable todo summary`	The launchpad-badge summary counts (open/blocked/overdue/… + by-kind)
`kapable todo add`	File (add) a new todo
`kapable todo show`	Show a todo's detail, including its dependency edges
`kapable todo wait`	Wait until a todo is completed, dropped, or deleted.
`kapable todo update`	Update an existing todo.
`kapable todo delete`	Soft-delete a todo
`kapable todo done`	Mark a todo done.
`kapable todo drop`	Drop (abandon) a todo.
`kapable todo reopen`	Reopen a closed (done/dropped) todo
`kapable todo claim`	Claim shared (unassigned, or workspace-assigned) work.
`kapable todo release`	Release a held claim.
`kapable todo dep`	Manage prerequisite (dependency) edges
`kapable todo dep add`	Add prerequisites: `id` waits on every id in --depends-on (max 50 per call, D20)
`kapable todo dep remove`	Remove a prerequisite edge

kapable vault Vault: secrets, forwarded to the operator CLI (`kapable-ops vault …`)

Takes no subcommand. Run kapable vault --help for its flags.

kapable voice Voice: talk to the platform agent — local web console, spoken results

Takes no subcommand. Run kapable voice --help for its flags.

kapable workspace Workspaces: collaboration containers, membership, roles, and audit · 19 commands

`kapable workspace list`	List workspaces visible to the current principal
`kapable workspace show`	Show a workspace, its member role assignments, and bound resources
`kapable workspace create`	Create a workspace
`kapable workspace update`	Rename or re-describe a workspace
`kapable workspace delete`	Delete a workspace (workspace-owner only)
`kapable workspace member`	Manage workspace members
`kapable workspace member add`	Add an existing org user by user id
`kapable workspace member set-role`	Change an existing member's role
`kapable workspace member remove`	Remove a member from the workspace
`kapable workspace invite`	Manage workspace invitations
`kapable workspace invite create`	Create an invitation.
`kapable workspace invite list`	List invitations with email addresses masked
`kapable workspace invite revoke`	Revoke an unused invitation
`kapable workspace role`	Manage fixed and custom workspace roles
`kapable workspace role list`	List built-in and custom roles
`kapable workspace role create`	Create a custom role
`kapable workspace role update`	Replace a custom role's capability set
`kapable workspace role delete`	Delete a custom role
`kapable workspace audit`	Read the org audit trail, optionally narrowed to one workspace

Every subcommand supports --help. Output defaults to JSON (scriptable); this mirrors the SDK's ListResponse<T> shape for list endpoints (data + total).

Publishing artifacts — `kapable artifact`

The document is read from a file, never from an argument. That is the point of the command: prose passed through a shell string can break an interpolation on an apostrophe or a $, leaving the previous content in the payload — and the publish still returns 200. Use - to read stdin.

kapable artifact publish --slug q3-report --title "Q3 Delivery" \
  --kind report --markdown report.md \
  --summary "…" --favicon "🧾" --grounding repo:platform/kapable-artifacts

# a ballot — see the Artifacts guide for the grammar and its bounds
kapable artifact publish --slug the-call --title "The call" \
  --kind decision --html body.html --decision ballot.json
kapable artifact publish --slug the-call --title "…" --kind decision \
  --html body.html --decision carry        # forward the existing ballot unchanged

kapable artifact list --kind decision -t
kapable artifact get   <slug>
kapable artifact html  <slug> --version 2 -o old.html
kapable artifact verdict <slug>           # 'still open' until a member rules

--dry-run validates locally and stops. Every mechanically checkable publish rule runs before the network call — the 2 MiB cap, external resource loads, forbidden <iframe>/<object>/<embed>, meta refresh, and a full-page wrapper where a fragment belongs — and each error names the fix. Publish warnings go to stderr, so piping the JSON cannot hide an unstyled-document.

--markdown and --html are not interchangeable

--markdown is server-rendered in the platform’s house reading register — the right default, and impossible to publish slop through, since you never author CSS. But the register has its own palette, so a markdown artifact cannot carry your org’s brand accent. Only --html can, and only if it inherits the platform theme tokens rather than restating colours. Deciding is always a member action in the browser; agent keys get a 403.

Example session

curl -fsSL https://cli.kapable.ai/install.sh | sh
kapable auth login --email you@example.com   # prompts for your password
kapable auth me
kapable board stories list --status active
kapable data tables list

Two binaries: kapable vs. kapable-ops

kapable is the customer/developer surface documented here. kapable-ops is a separate, privileged operator binary (deploy, vault, caddy, migrate) — it is not published on this registry and is not what cli.kapable.ai/install.sh installs.

kapable CLI

Install

Staying current

Authenticating

Env vars & flags

Command tree

Publishing artifacts — `kapable artifact`

Example session

Next Steps

Getting Started

Authentication

Board API

Next

Search documentation

kapable CLI

Install

Staying current

Authenticating

Env vars & flags

Command tree

Publishing artifacts — kapable artifact

Example session

Next Steps

Getting Started

Authentication

Board API

Next

Publishing artifacts — `kapable artifact`