@kosli/cli

Kosli CLI

The Kosli CLI records and queries software delivery events with Kosli, giving you a tamper-evident record of how your software was built, tested, and deployed.

With it you can:

• Fingerprint artifacts — compute the SHA256 of files, directories, and OCI/Docker images.
• Record attestations and evidence — bind test results, security scans (Snyk, SonarQube), pull-request approvals, Jira issues, and custom evidence to your flows and trails.
• Snapshot running environments — report what is actually running in Kubernetes, ECS, Lambda, S3, Docker, Azure Web Apps, GCP Cloud Run, servers, and filesystem paths.
• Query and assert compliance — search and diff snapshots, and gate your CI/CD pipelines with kosli assert commands.

See the documentation site for the full command reference and usage guides.

Installation

Install with whichever method suits your platform. After installing, run kosli version to verify.

Install script (Linux / macOS)

curl -sSL https://raw.githubusercontent.com/kosli-dev/cli/main/install-cli.sh | sh

The script detects your OS and architecture and installs the matching release binary into a directory on your PATH. To install a specific version, pass the tag as an argument:

curl -sSL https://raw.githubusercontent.com/kosli-dev/cli/main/install-cli.sh | sh -s -- v<X.Y.Z>

Homebrew (macOS / Linux)

brew install kosli-cli

Upgrade later with brew upgrade kosli-cli.

npm

npm install -g @kosli/cli

npx @kosli/cli is not supported — npx skips the optional platform dependency, so install the package first.

Docker