Business tools
Stripe, Razorpay, Google Workspace (gog), Sentry, Cloudflare, Linear, Resend, Shopify and Supabase through fixed read-only command lists.
These CLIs are maintained by their vendors or communities, and Reckon adopts them
rather than building its own. Each runs as an allowlist: only the read commands
listed here run through reckon run, credentials come from the connection's
secrets file, and flags that pick another account or turn safety off are refused.
These entries were derived from each CLI's source in October 2026 and have not
yet been exercised against live accounts. Run reckon verify after connecting,
and expect small adjustments.
Stripe
Revenue, charges, subscriptions, disputes, payouts and refunds. CLI: stripe. Use a restricted read-only key.
reckon connect stripe --org acme --provider stripe # then set STRIPE_API_KEY in the secrets file
reckon verify stripe # runs: stripe balance retrieve
reckon run stripe -- balance retrieve ...Settings: STRIPE_API_KEY.
Read commands: balance retrieve, balance_transactions list, balance_transactions retrieve, charges list, charges retrieve, customers list, customers retrieve, disputes list, disputes retrieve, invoices list, invoices retrieve, payment_links list, payment_links retrieve, payouts list, payouts retrieve, prices list, prices retrieve, products list, products retrieve, refunds list, refunds retrieve, subscriptions list, subscriptions retrieve.
Razorpay
Indian payments, orders, settlements, refunds and subscriptions. CLI: razorpay. Use a key pair for the account you want; Reckon pins the API base URL.
reckon connect razorpay --org acme --provider razorpay # then set RAZORPAY_KEY_ID, RAZORPAY_KEY_SECRET in the secrets file
reckon verify razorpay # runs: razorpay payments list --count 1
reckon run razorpay -- payments list ...Settings: RAZORPAY_KEY_ID, RAZORPAY_KEY_SECRET.
Read commands: payments list, orders list, customers list, refunds list, settlements list, disputes list, invoices list, payment-links list, qr-codes list, subscriptions list, payments downtime list, settlements instant-list, settlements recon, invoices items list, subscriptions plans list.
Google Workspace, GA4 and YouTube (gog)
Gmail, Calendar, Drive, Sheets, Docs, Contacts, Tasks, GA4 reports, Search Console and YouTube. CLI: gog. Reckon forces gog's read-only mode and blocks sending, uploads and downloads.
reckon connect gog --org acme --provider gog # then set GOG_ACCESS_TOKEN in the secrets file
reckon verify gog # runs: gog drive ls --max 1 --json
reckon run gog -- drive ls ...Settings: GOG_ACCESS_TOKEN.
Read commands: drive ls, drive search, drive get, gmail search, gmail messages search, gmail get, gmail thread get, calendar calendars, calendar events, calendar event, calendar search, calendar freebusy, contacts list, contacts search, contacts get, people me, people get, sheets get, sheets metadata, docs info, docs cat, tasks lists list, tasks list, tasks get, analytics accounts, analytics report, searchconsole sites list, searchconsole query, youtube activities list, youtube videos list, youtube playlists list, youtube playlists items list, youtube comments list, youtube channels list, youtube search list, youtube subscriptions list.
Sentry
Issues, events, traces, logs and release health. CLI: sentry. Use a token scoped to read; Reckon disables telemetry and update checks.
reckon connect sentry --org acme --provider sentry # then set SENTRY_AUTH_TOKEN in the secrets file
reckon verify sentry # runs: sentry org list --limit 1 --json --fresh
reckon run sentry -- auth whoami ...Settings: SENTRY_AUTH_TOKEN or SENTRY_TOKEN.
Read commands: auth whoami, org list, org view, project list, issue list, issue view, issue events, event list, event view, log list, log view, trace list, trace view, trace logs, span list, span view, release list, release view, release deploys, repo list, team list, monitor list, dashboard list, dashboard view, dashboard revisions.
Cloudflare (cf)
Accounts, zones, DNS records, Workers, D1, KV, R2, queues and rulesets. CLI: cf. cf is in beta: pin the version you install. Use an API token with read permissions.
reckon connect cloudflare --org acme --provider cloudflare # then set CLOUDFLARE_API_TOKEN in the secrets file
reckon verify cloudflare # runs: cf user tokens verify
reckon run cloudflare -- user tokens verify ...Settings: CLOUDFLARE_API_TOKEN.
Read commands: user tokens verify, accounts tokens verify, accounts list, zones list, zones get, dns records list, dns records get, dns dnssec get, workers list, d1 list, kv namespaces list, r2 buckets list, queues list, rulesets list.
Linear
Issues, projects, cycles and milestones. CLI: linear. Linear has no read-only mode in the CLI, so create the API key with read-only permission. Use --all, not -a (which opens the desktop app on some commands).
reckon connect linear --org acme --provider linear # then set LINEAR_API_KEY in the secrets file
reckon verify linear # runs: linear auth whoami
reckon run linear -- issue list ...Settings: LINEAR_API_KEY; optional LINEAR_TEAM_ID.
Read commands: issue list, issue query, issue view, issue comment list, issue relation list, project list, project view, project comment list, project-update list, milestone list, milestone view, cycle list, cycle view, team list, team members, team states, user list, label list, auth whoami.
Resend
Sent emails and their status, domains, contacts, segments and broadcasts. CLI: resend. Resend has no read-only key type, so this list is the only write guard; logs get is excluded because request bodies can contain new API keys, and emails get because email bodies hold password-reset links and one-time codes.
reckon connect resend --org acme --provider resend # then set RESEND_API_KEY in the secrets file
reckon verify resend # runs: resend domains list --limit 1 --json
reckon run resend -- emails list ...Settings: RESEND_API_KEY.
Read commands: emails list, emails metrics, domains list, domains get, contacts list, contacts get, contacts segments, segments list, segments get, segments contacts, broadcasts list, broadcasts get, logs list, whoami.
Shopify
Store data through Admin GraphQL queries. CLI: shopify, store commands only. store execute refuses mutations unless --allow-mutations is given, which Reckon refuses and forces off. Set SHOPIFY_FLAG_STORE to the store domain and run reckon login shopify once for a read-scoped token.
reckon connect shopify --org acme --provider shopify # then set SHOPIFY_FLAG_STORE in the secrets file
reckon verify shopify # runs: shopify store execute --query 'query { shop { name myshopifyDomain } }' --json
reckon run shopify -- store execute ...Settings: SHOPIFY_FLAG_STORE.
Read commands: store execute, store info, store auth list.
Supabase
Organisations, projects, branches, backups, functions, advisors and project settings through the Management API. CLI: supabase. inspect db and migration list are excluded: on a linked project they create a read-write login role. Inspect the database through a postgres connection with a read-only role instead. The five config get commands need --experimental.
reckon connect supabase --org acme --provider supabase # then set SUPABASE_ACCESS_TOKEN in the secrets file
reckon verify supabase # runs: supabase orgs list
reckon run supabase -- orgs list ...Settings: SUPABASE_ACCESS_TOKEN; optional SUPABASE_PROJECT_ID.
Read commands: orgs list, projects list, branches list, backups list, functions list, db advisors, postgres-config get, ssl-enforcement get, network-restrictions get, network-bans get, vanity-subdomains get, domains get, sso list, sso show.
WhatsApp Business
Phone numbers with their quality rating and messaging limit, message templates
and their review status, and message and pricing analytics. CLI:
whatsapp, our own read-only CLI (every request is a GET). Use a system user
token with whatsapp_business_management.
reckon connect whatsapp --org acme --provider whatsapp # then set WHATSAPP_ACCESS_TOKEN and WHATSAPP_BUSINESS_ACCOUNT_ID
reckon verify whatsapp # runs: whatsapp account get
reckon run whatsapp -- analytics pricing --from 2026-10-01 --to 2026-10-08 --dimension pricing_categorySettings: WHATSAPP_ACCESS_TOKEN, WHATSAPP_BUSINESS_ACCOUNT_ID; optional WHATSAPP_API_VERSION (default v25.0).
Reckon forces the Graph host, so a connection cannot send the token elsewhere.