# CLI reference Every chock command and its options, generated from the engine's own --help. The site generates these pages from the engine's argument parsers at the pinned commit. > Ask the user before running any command on this page: each one changes how their agent or repository behaves. ## Every command and subcommand Each command and subcommand has its own page, generated from the engine's argument parsers at the pinned commit. An alias says which command it stands for. Ask the user before running the commands below: | Command | Group | Summary | | --- | --- | --- | | [`chock init`](https://chock.sh/docs/cli/init/index.md) | Everyday | Scaffold a consumer repo (wiring only -- no policies) | | [`chock add`](https://chock.sh/docs/cli/add/index.md) | Everyday | Install a policy or skill from a catalog and compile it | | [`chock install`](https://chock.sh/docs/cli/install/index.md) | Everyday | Build a chock.sh selection into one plugin for one agent (install --selection [--client C]) | | [`chock remove`](https://chock.sh/docs/cli/remove/index.md) | Everyday | Remove an installed policy and resync | | [`chock sync`](https://chock.sh/docs/cli/sync/index.md) | Everyday | Recompile + rewire so the repo matches its policies (--ci/--skills for extras) | | [`chock check`](https://chock.sh/docs/cli/check/index.md) | Everyday | Run every truth check: validate, verify, evals, matrix (--only to narrow; --history scans past commits) | | [`chock status`](https://chock.sh/docs/cli/status/index.md) | Everyday | Policy states and coverage (--only registry,log for more) | | [`chock stop`](https://chock.sh/docs/cli/stop/index.md) | Everyday | Refuse every agent tool call, commit and push here until resume (--agent C for one client) | | [`chock resume`](https://chock.sh/docs/cli/resume/index.md) | Everyday | Lift a stop: agents are judged by the policies again | | [`chock doctor`](https://chock.sh/docs/cli/doctor/index.md) | Everyday | Check each client's hooks on each route: present, current, and seen running (--client X) | | [`chock incident`](https://chock.sh/docs/cli/incident/index.md) | Everyday | An ordered, redacted timeline from the local decision log (incident --since T [--until T] [--share]) | | [`chock witness`](https://chock.sh/docs/cli/witness/index.md) | Everyday | Export one client's redacted decision log for its agentseam evidence issue (witness export --client C) | | [`chock witness export`](https://chock.sh/docs/cli/witness/export/index.md) | Everyday | Write one client's redacted log records to a local file; never uploads | | [`chock enable`](https://chock.sh/docs/cli/enable/index.md) | Everyday | Enable a policy by id | | [`chock disable`](https://chock.sh/docs/cli/disable/index.md) | Everyday | Disable a policy by id | | [`chock bundle`](https://chock.sh/docs/cli/bundle/index.md) | Everyday | Switch a member of an installed plugin bundle on or off (bundle on\|off , bundle status) | | [`chock bundle on`](https://chock.sh/docs/cli/bundle/on/index.md) | Everyday | Switch one policy on | | [`chock bundle off`](https://chock.sh/docs/cli/bundle/off/index.md) | Everyday | Switch one policy off | | [`chock bundle status`](https://chock.sh/docs/cli/bundle/status/index.md) | Everyday | Every installed bundle, each member's state and label | | [`chock new`](https://chock.sh/docs/cli/new/index.md) | Authoring | Create a deterministic artifact skeleton | | [`chock compile`](https://chock.sh/docs/cli/compile/index.md) | Authoring | Low-level single-policy compile | | [`chock install-skills`](https://chock.sh/docs/cli/install-skills/index.md) | Authoring | Install bundled authoring skills into agent skill dirs (write mode; check via CI) | | [`chock registry`](https://chock.sh/docs/cli/registry/index.md) | Authoring | Scan/list/resolve the artifact registry | | [`chock registry init`](https://chock.sh/docs/cli/registry/init/index.md) | Authoring | Create an empty registry | | [`chock registry scan`](https://chock.sh/docs/cli/registry/scan/index.md) | Authoring | Scan repo and rebuild registry | | [`chock registry list`](https://chock.sh/docs/cli/registry/list/index.md) | Authoring | List registered artifacts | | [`chock registry get`](https://chock.sh/docs/cli/registry/get/index.md) | Authoring | Get registry metadata for an ID | | [`chock registry resolve`](https://chock.sh/docs/cli/registry/resolve/index.md) | Authoring | Resolve ID to manifest path | | [`chock plugin`](https://chock.sh/docs/cli/plugin/index.md) | Authoring | Package policies as installable plugins (plugin build [--format claude] [--check]) | | [`chock marketplace`](https://chock.sh/docs/cli/marketplace/index.md) | Authoring | Emit marketplace index files over a built plugin tree (marketplace build --dist ) | | [`chock gateway`](https://chock.sh/docs/cli/gateway/index.md) | Authoring | Run the MCP gateway proxy (gateway run --repo . -- ) | | [`chock gateway run`](https://chock.sh/docs/cli/gateway/run/index.md) | Authoring | Serve stdio between the MCP client and the wrapped server | | [`chock mcp`](https://chock.sh/docs/cli/mcp/index.md) | Authoring | Serve the read-only chock_guidance MCP tool over stdio (mcp --repo .) | | [`chock review`](https://chock.sh/docs/cli/review/index.md) | Authoring | Produce or check reviewer evidence (review emit \| review verify \| review require) | | [`chock review emit`](https://chock.sh/docs/cli/review/emit/index.md) | Authoring | Run the checks and write evidence | | [`chock review verify`](https://chock.sh/docs/cli/review/verify/index.md) | Authoring | Re-derive every verified claim | | [`chock review require`](https://chock.sh/docs/cli/review/require/index.md) | Authoring | CI gate: is this PR merge-ready? | | [`chock compliance`](https://chock.sh/docs/cli/compliance/index.md) | Authoring | Generate a compliance coverage report (compliance report --framework owasp_asi) | | [`chock validate`](https://chock.sh/docs/cli/validate/index.md) | Pre-launch aliases | Alias of: check --only validate | | [`chock verify`](https://chock.sh/docs/cli/verify/index.md) | Pre-launch aliases | Alias of: check --only verify | | [`chock verify init`](https://chock.sh/docs/cli/verify/init/index.md) | Pre-launch aliases | Write chock.lock from installed packs | | [`chock verify verify`](https://chock.sh/docs/cli/verify/verify/index.md) | Pre-launch aliases | Verify installed packs match the lockfile | | [`chock eval`](https://chock.sh/docs/cli/eval/index.md) | Pre-launch aliases | Alias of: check --only evals | | [`chock check-matrix`](https://chock.sh/docs/cli/check-matrix/index.md) | Pre-launch aliases | Alias of: check --only matrix | | [`chock recompile`](https://chock.sh/docs/cli/recompile/index.md) | Pre-launch aliases | Alias of: sync | | [`chock refresh`](https://chock.sh/docs/cli/refresh/index.md) | Pre-launch aliases | Alias of: sync / check --only index | | [`chock install-hooks`](https://chock.sh/docs/cli/install-hooks/index.md) | Pre-launch aliases | Alias of: sync (hooks part) | | [`chock install-ci`](https://chock.sh/docs/cli/install-ci/index.md) | Pre-launch aliases | Alias of: sync --ci | | [`chock policies`](https://chock.sh/docs/cli/policies/index.md) | Pre-launch aliases | Alias of: status | | [`chock gate-log`](https://chock.sh/docs/cli/gate-log/index.md) | Pre-launch aliases | Alias of: status --only log | `chock` exits 2 for a command it does not have, as its dispatcher says: [src/chock/cli.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/cli.py) ## Everyday ### `chock init` Scaffold a consumer repo (wiring only -- no policies) Ask the user before running the commands below: ```text usage: __main__.py [-h] [--agents [AGENTS ...]] [--agent-agnostic] [--skip-hooks] [--force] [repo] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock add` Install a policy or skill from a catalog and compile it Ask the user before running the commands below: ```text usage: chock add [-h] [--repo REPO] [--from SOURCE] [--ref REF] [--force] [--skip-compile] [--verify-sha SHA256] artifact_id ``` The full options are on this page's HTML version, as the engine prints them. ### `chock install` Build a chock.sh selection into one plugin for one agent (install --selection [--client C]) Ask the user before running the commands below: ```text usage: chock install [-h] --selection SELECTION [--client {claude-code,copilot,codex,cursor,devin,goose,grok,antigravity,openhands,kimi-code,factory-droid}] [--dest DEST] [--marketplace-name NAME] [--apply] [--allow-source SOURCE] [--trust-local ID=SHA256] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock remove` Remove an installed policy and resync Ask the user before running the commands below: ```text usage: chock remove [-h] [--repo REPO] policy_id ``` The full options are on this page's HTML version, as the engine prints them. ### `chock sync` Recompile + rewire so the repo matches its policies (--ci/--skills for extras) Ask the user before running the commands below: ```text usage: chock sync [-h] [--repo REPO] [--agents [AGENTS ...]] [--skip-hooks] [--check] [--ci] [--skills] [--committed] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock check` Run every truth check: validate, verify, evals, matrix (--only to narrow; --history scans past commits) Ask the user before running the commands below: ```text usage: chock check [-h] [--repo REPO] [--only ONLY] [--mode MODE] [--event EVENT] [--base BASE] [--format {text,sarif}] [--output OUTPUT] [--head-ref HEAD_REF] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock status` Policy states and coverage (--only registry,log for more) Ask the user before running the commands below: ```text usage: chock status [-h] [--repo REPO] [--only ONLY] [--summary] [--verify-log] [--head SEQ:SHA256] [--policy POLICY] [--since DAYS] [--json] [--by {policy,rule,agent,event}] [--format {text,md}] [--route {sync,plugin}] [--level {info,debug}] [--verdict {allow,block,ask,warn,off}] [--plugin PLUGIN] [--follow] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock stop` Refuse every agent tool call, commit and push here until resume (--agent C for one client) Ask the user before running the commands below: ```text usage: chock stop [-h] [--repo REPO] [--agent {antigravity,claude_code,codex_cli,cursor,devin,factory_droid,gemini_cli,goose,grok,mistral_vibe,openhands,tabnine,vscode_copilot,windsurf}] [--reason REASON] [--everywhere] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock resume` Lift a stop: agents are judged by the policies again Ask the user before running the commands below: ```text usage: chock resume [-h] [--repo REPO] [--everywhere] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock doctor` Check each client's hooks on each route: present, current, and seen running (--client X) Ask the user before running the commands below: ```text usage: chock doctor [-h] [--repo REPO] [--client CLIENT] [--client-version CLIENT_VERSION] [--sessions SESSIONS] [--json] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock incident` An ordered, redacted timeline from the local decision log (incident --since T [--until T] [--share]) Ask the user before running the commands below: ```text usage: chock incident [-h] --since SINCE [--until UNTIL] [--format {text,md,json}] [--share] [--repo REPO] [--route {sync,plugin}] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock witness` Export one client's redacted decision log for its agentseam evidence issue (witness export --client C) Ask the user before running the commands below: ```text usage: chock witness [-h] {export} ... ``` The full options are on this page's HTML version, as the engine prints them. ### `chock enable` Enable a policy by id Ask the user before running the commands below: ```text usage: chock enable [-h] [--repo REPO] policy_id ``` The full options are on this page's HTML version, as the engine prints them. ### `chock disable` Disable a policy by id Ask the user before running the commands below: ```text usage: chock disable [-h] [--repo REPO] policy_id ``` The full options are on this page's HTML version, as the engine prints them. ### `chock bundle` Switch a member of an installed plugin bundle on or off (bundle on|off , bundle status) Ask the user before running the commands below: ```text usage: chock bundle [-h] {on,off,status} ... ``` The full options are on this page's HTML version, as the engine prints them. ## Authoring ### `chock new` Create a deterministic artifact skeleton Ask the user before running the commands below: ```text usage: __main__.py [-h] [--root ROOT] [--kind {content_regex,guard,script,rule,skill}] {policy,skill,subagent} id ``` The full options are on this page's HTML version, as the engine prints them. ### `chock compile` Low-level single-policy compile Ask the user before running the commands below: ```text usage: __main__.py [-h] [--targets [TARGETS ...]] [--agents [AGENTS ...]] [--repo REPO] [--policy-dir POLICY_DIR] [--output-root OUTPUT_ROOT] policy_id ``` The full options are on this page's HTML version, as the engine prints them. ### `chock install-skills` Install bundled authoring skills into agent skill dirs (write mode; check via CI) Ask the user before running the commands below: ```text usage: __main__.py [-h] [--skills [SKILLS ...]] [--check] [repo] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock registry` Scan/list/resolve the artifact registry Ask the user before running the commands below: ```text usage: __main__.py [-h] [--root ROOT] {init,scan,list,get,resolve} ... ``` The full options are on this page's HTML version, as the engine prints them. ### `chock plugin` Package policies as installable plugins (plugin build [--format claude] [--check]) Ask the user before running the commands below: ```text usage: chock plugin [-h] [--repo REPO] [--policies-dir POLICIES_DIR] [--format {agent-plugins,claude,copilot,cursor,codex,devin,goose,grok,antigravity,openhands,kimi,droid,all}] [--out-dir OUT_DIR] [--policy ID] [--out OUT] [--check] {build} ``` The full options are on this page's HTML version, as the engine prints them. ### `chock marketplace` Emit marketplace index files over a built plugin tree (marketplace build --dist ) Ask the user before running the commands below: ```text usage: chock marketplace [-h] [--dist DIST] [--name NAME] [--tree {claude,codex,cursor,devin}] [--check] [--url URL] {build} ``` The full options are on this page's HTML version, as the engine prints them. ### `chock gateway` Run the MCP gateway proxy (gateway run --repo . -- ) Ask the user before running the commands below: ```text usage: chock gateway [-h] {run} ... ``` The full options are on this page's HTML version, as the engine prints them. ### `chock mcp` Serve the read-only chock_guidance MCP tool over stdio (mcp --repo .) Ask the user before running the commands below: ```text usage: chock mcp [-h] [--repo REPO] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock review` Produce or check reviewer evidence (review emit | review verify | review require) Ask the user before running the commands below: ```text usage: chock review [-h] {emit,verify,require} ... ``` The full options are on this page's HTML version, as the engine prints them. ### `chock compliance` Generate a compliance coverage report (compliance report --framework owasp_asi) Ask the user before running the commands below: ```text Usage: chock compliance report [--repo .] [--framework owasp_asi] [--json] ``` The full options are on this page's HTML version, as the engine prints them. ## Pre-launch aliases ### `chock validate` Alias of: check --only validate Ask the user before running the commands below: ```text usage: __main__.py [-h] [--mode {agnostic,frontier-agentskills,frontier-claude,frontier-openai,frontier-devin,frontier-cursor,frontier-copilot,frontier-codex}] [--json] [--include INCLUDE] [--exclude EXCLUDE] [--no-registry-check] [--event {commit}] [path] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock verify` Alias of: check --only verify Ask the user before running the commands below: ```text usage: __main__.py verify [-h] [--root ROOT] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock eval` Alias of: check --only evals Ask the user before running the commands below: ```text usage: chock check --only evals [-h] [--repo REPO] [--mode {deterministic,agent}] [--json] [--verbose] [policy_id] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock check-matrix` Alias of: check --only matrix Ask the user before running the commands below: ```text usage: chock check --only matrix ``` The full options are on this page's HTML version, as the engine prints them. ### `chock recompile` Alias of: sync Ask the user before running the commands below: ```text usage: chock sync [-h] [--repo REPO] [--agents [AGENTS ...]] [--skip-hooks] [--check] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock refresh` Alias of: sync / check --only index Ask the user before running the commands below: ```text usage: __main__.py [-h] [--repo REPO] [--check] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock install-hooks` Alias of: sync (hooks part) Ask the user before running the commands below: ```text usage: __main__.py [-h] [repo_root] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock install-ci` Alias of: sync --ci Ask the user before running the commands below: ```text usage: __main__.py [-h] [--path PATH] [repo_root] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock policies` Alias of: status Ask the user before running the commands below: ```text usage: chock status [-h] [--repo REPO] ``` The full options are on this page's HTML version, as the engine prints them. ### `chock gate-log` Alias of: status --only log Ask the user before running the commands below: ```text usage: chock status --only log [-h] [--repo REPO] [--policy POLICY] [--since DAYS] [--route {sync,plugin}] [--level {info,debug}] [--verdict {allow,block,ask,warn,off}] [--plugin PLUGIN] [--follow] [--json] [--by {policy,rule,agent,event}] [--format {text,md}] ``` The full options are on this page's HTML version, as the engine prints them. From the engine docs: [docs/cli-reference.md](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/docs/cli-reference.md) ## Typical workflows **Onboard and prove enforcement** Ask the user before running the commands below: ```bash chock init . chock add protect-main-branch git checkout main && git commit -m x # blocked by protect-main-branch ``` **Author, validate, compile a new guard** Ask the user before running the commands below: ```bash chock new policy block-console-log # …edit manifest.yaml (hook.gate) + evals… chock check chock compile block-console-log ``` **CI pipeline (see `.github/workflows/ci.yml`)** Ask the user before running the commands below: ```bash ruff check . && ruff format --check . chock check chock sync --repo . --check chock registry scan # then diff to detect drift pytest -q ``` --- Built from engine [5a4b6287a46e](https://github.com/open-coder-ai/chock/commit/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021) and catalog [1e60d211c1bb](https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f).