CLI reference
Command index, global flags, and exit codes for the refpoint binary.
On this page
This section documents the binary’s surface. The pages for individual commands are mechanical by design: synopsis, flags, examples, exit codes, in that order, so a generator can own them once the schema export lands. Treat this index as the hand-maintained entry point.
refpoint [command] [flags]Commands
| Command | Purpose |
|---|---|
run |
Execute a profile against one or more targets |
check |
Validate a profile without executing anything |
list |
List the controls a path would run |
report |
Re-render a saved JSON result in another format |
diff |
Compare two saved results |
tui |
Browse a saved result full-screen |
init |
Scaffold a new profile |
config |
Create or show the configuration file |
keygen |
Generate an Ed25519 report-signing keypair |
verify |
Verify a report’s attestation |
version |
Print the version |
Global flags
Available on every command.
| Flag | Default | Description |
|---|---|---|
--config PATH |
~/.refpoint/config.toml |
Config file path |
--log-level LEVEL |
info |
debug, info, warn, error. An unknown value is an error, not a silent fallback |
--no-color |
false | Disable terminal color |
Diagnostics go to stderr. refpoint emits only debug-level lines of its own, so the default level keeps runs silent on stderr apart from the startup banner.
Exit codes
| Code | Condition |
|---|---|
| 0 | Everything passed |
| 1 | At least one control failed, and either no threshold was set or the score met it |
| 2 | At least one target was unreachable or a control errored |
| 5 | Controls failed and the weighted score fell below --threshold |
| 130 | Interrupted by SIGINT or SIGTERM |
Codes are computed per profile, and a multi-profile run exits with the worst of them. Code 5 requires failures: a threshold alone never produces it, because with zero failures the score cannot be below a meaningful threshold.
On the first signal, in-flight controls are cancelled and recorded as errored, the partial report is still written, and the run exits 130 rather than pass or fail. A second signal force-exits.