Agents
Structured output, non-interactive operation, and safety controls for agents.
CubeAPM CLI includes global controls for coding agents, CI jobs, and scripts. These controls work with Claude Code, OpenAI Codex, Cursor, or any coding agent or agent harness that can run shell commands.
Machine-readable output
- Use
-o jsonfor data that will be parsed. - Read/query commands write requested data to stdout; errors are written to stderr with a non-zero exit status.
- With
-o json, CLI errors use{"error":"..."}. logs query -o jsonemits a stream of JSON objects, not one array;-o yamlemits one YAML document per entry, separated by---.
Safety flags
| Flag | Environment | Effect |
|---|---|---|
--read-only | CUBEAPM_READ_ONLY=true | Blocks every write command |
--no-input | CUBEAPM_NO_INPUT=true | Disables interactive login and update confirmation |
--quiet, -q | CUBEAPM_QUIET=true | Suppresses informational output where supported |
CUBEAPM_READ_ONLY=true \
CUBEAPM_NO_INPUT=true \
CUBEAPM_QUIET=true \
cubeapm traces search --service api-gateway --last 1h -o jsonRead-only mode blocks every write command: telemetry ingestion, starting or
stopping log deletion, config set, config profiles use and delete, and
update (update --check still runs). Listing deletion tasks, reading config,
and all query commands remain available.
Read-only is only ever added, never removed. A profile's read_only: true,
CUBEAPM_READ_ONLY=true, or --read-only turns it on, and neither
CUBEAPM_READ_ONLY=false nor --read-only=false turns it off.
CUBEAPM_NO_INPUT and CUBEAPM_QUIET take effect only for 1 or true;
--quiet=false overrides CUBEAPM_QUIET, but --no-input=false does not
override CUBEAPM_NO_INPUT.
The update notice never reaches agents: the once-a-day GitHub release check
runs only when stderr is a terminal, and never when CI is set, with --quiet,
or when CUBEAPM_NO_UPDATE_NOTIFIER or NO_UPDATE_NOTIFIER is set. To check
for a release from a script, use cubeapm update --check -o json; to install
without a prompt, cubeapm update --yes.
Read-only mode does not cover login, which is interactive; --no-input
blocks it. It is not a general filesystem sandbox, so use an external sandbox
if local file writes must also be prevented.
Non-interactive connection
export CUBEAPM_SERVER=cube.example.com
export CUBEAPM_EMAIL="$CUBEAPM_CI_EMAIL"
export CUBEAPM_PASSWORD="$CUBEAPM_CI_PASSWORD"
export CUBEAPM_NO_INPUT=true
export CUBEAPM_READ_ONLY=true
cubeapm metrics query 'up' -o jsonPort overrides are available as CUBEAPM_QUERY_PORT, CUBEAPM_INGEST_PORT,
and CUBEAPM_ADMIN_PORT.
Claude Code skill
A ready-to-use skill lives at
cubeapm/SKILL.md.
The exhaustive agent-oriented command reference is
docs/llms.txt.