The command line
Every command, and the flags every command takes.
aertun helpEvery command takes --json, --root DIR and --token T. With --json, standard output is one JSON document. A token can also come from AERTUN_TOKEN.
| Group | Commands |
|---|---|
| Running it | init, serve, mcp |
| Collecting what happens | connect, collect, source, telemetry, inbound, spool, identity |
| Proving AI work | proof, windtunnel, bench |
| Detecting and deciding | detect, sigma, correlate, triage, hunt, finding, intel, analyst, automate, geo, content |
| Cases and response | incident, action, notify, work |
| Vulnerabilities and code | vuln, feed, sca, sarif, appsec |
| The estate and its people | estate, workforce, remind, vendor, access |
| People, agents, sign-in and changes | auth, agent, oidc, saml, scim, ssf, token, pending, approvals |
| Its own record and settings | auditlog, logd, siem, compliance, privacy, vault, config, network, version |
Every command has a screen in the console or a written reason why not, and an MCP operation or a written reason why not; a test fails when one has neither.