CLI Reference

The aegisgate-platform binary is a single 19.1MB Go binary with zero external dependencies. This page documents all command-line flags and subcommands.

Global Flags

These flags are available on the main command and apply to the running platform:

Config Precedence

Configuration is resolved in the following order (highest priority first):

1. CLI flags — command-line arguments override everything
2. Environment variables — AEGISGATE_* env vars
3. Config file — YAML file specified with --config
4. Deploy profile — preset selected with --profile
5. Built-in defaults — hardcoded safe defaults

Deploy Profiles

Deploy profiles (v4.4.0+) are predefined configuration presets that populate all config fields with sensible defaults for common deployment scenarios.

Listing Profiles

./aegisgate-platform --profile list

Using a Profile

# Run directly with a profile (no config file needed)
./aegisgate-platform --profile quickstart --embedded-mcp

# Use a profile as a base, override with a config file
./aegisgate-platform --profile production --config my-overrides.yaml --embedded-mcp

Available Profiles

See Deploy Profiles for detailed per-profile configuration values.

Subcommands

Subcommands use a hook pattern: the binary checks os.Args[1] before flag.Parse() and dispatches to the appropriate handler. All subcommands return an exit code (0 = success, 1 = error).

setup — Setup Wizard (v4.4.0+)

Interactive or non-interactive environment detection and config generation.

# Interactive mode (prompts for each step)
./aegisgate-platform setup

# Non-interactive (auto-detect everything)
./aegisgate-platform setup --non-interactive

# Skip profile selection
./aegisgate-platform setup --profile quickstart

# Custom output path
./aegisgate-platform setup --output /etc/aegisgate/config.yaml

# Overwrite existing config
./aegisgate-platform setup --force

The wizard detects: Docker, Kubernetes, systemd, bare metal; available ports; existing TLS certificates; and recommends the most appropriate deploy profile.

config — Config Validation (v4.4.0+)

Validate and inspect configuration files.

# Validate a config file (15+ checks: ports, TLS, log levels, rate limits, SIEM)
./aegisgate-platform config validate aegisgate-platform.yaml

# Show effective config as YAML
./aegisgate-platform config show aegisgate-platform.yaml

# Show effective config as JSON
./aegisgate-platform config show --format json

# List available deploy profiles
./aegisgate-platform config profiles

Validation checks include:

• Port conflicts (proxy, MCP, dashboard, A2A on same port)
• TLS certificate path validation (files exist, readable)
• Log level validation (debug, info, warn, error)
• Rate limit sanity (proxy ≥ MCP, reasonable values)
• SIEM endpoint URL validation
• Persistence backend validation
• A2A configuration consistency

maintenance — Maintenance Windows (v4.4.0+)

Manage maintenance windows for planned downtime.

# Check current maintenance status
./aegisgate-platform maintenance status

# Enable maintenance mode immediately
./aegisgate-platform maintenance enable --message "Security update in progress"

# Schedule a future maintenance window
./aegisgate-platform maintenance schedule \
  --start "2026-09-01T02:00:00Z" \
  --end "2026-09-01T04:00:00Z" \
  --reason "Quarterly security patch"

# Disable maintenance mode
./aegisgate-platform maintenance disable

During maintenance mode:

• All proxy requests return HTTP 503 with Retry-After header
• Health (/health), version (/version), and maintenance (/api/v1/maintenance) endpoints remain accessible
• Load balancers can detect the maintenance state via /health and drain traffic
• The maintenance API is also available via REST: GET/POST /api/v1/maintenance

attestation — Attestation Verification

Verify cryptographic attestations (AR-EaaS, AIBOM, Agent Intent, Prompt Cache, CVE-for-AI).

# Verify an attestation envelope
./aegisgate-platform attestation verify envelope.json

benchmark — Performance Benchmarking

Run built-in performance benchmarks.

./aegisgate-platform benchmark --duration 60s --concurrency 100

Other Subcommands

Environment Variables

All CLI flags have corresponding environment variables prefixed with AEGISGATE_:

See also: Configuration Reference, Deploy Profiles, Deployment Guide.