@atollhq/cli is the recommended interface for agents and terminal-first humans.
Install
--json, non-TTY output, CI, shell completions, and ATOLL_NO_UPDATE_CHECK=1.
Authenticate
--org-id org-uuid or set it later with atoll config set-org org-uuid --profile <name>.
API keys are created in the web app:
- Agents for agent keys
- Settings > Integrations > Create API Key for integration keys
Common commands
atoll api get is a GET-only authenticated fallback for uncommon inspection gaps. It only accepts Atoll paths under /api/, and the CLI blocks /api/internal/*, billing, and KPI sync admin routes because some GET endpoints can run jobs or synchronize external state. Use typed commands for routine mutations and human-admin-gated workflows.
Internal KPI calculations
Use--internal-task-completion when a goal’s progress should be calculated from linked task completion instead of an external metric or manual snapshots.
KPI HTTP sync drafts
Agents can draft generic third-party KPI pollers with the CLI after a human admin has allowlisted the exact destination host. Agents cannot publish syncs or run network requests. Human admins complete approval in Atoll.GET, https, JSON, no redirects, no query strings, no request bodies, and no secret values. Use secret reference names only; admins enter the actual values in Atoll.
Global flags
Context resolution
The CLI resolves request context with these rules:
Relevant environment variables:
ATOLL_* env vars do not silently override profile context. Conflicting env values fail before network calls. Pass --profile, add repo-local .atoll/context.json, or opt into env mode.
Repo-local baseUrl values cannot reuse a saved profile key unless that same
base URL is stored in the profile. After verifying the repository and
destination host, set ATOLL_TRUST_REPO_BASE_URL=1 for a one-process explicit
override.
Repo-local context is intentionally non-secret. Commit it only when the defaults are safe for the repository:
profile, orgId, defaultProject, defaultTeam, and baseUrl. apiKey is rejected. If the file omits profile, use an explicit --profile or --env-mode; the CLI refuses to combine repo-local project/org defaults with an unrelated active profile.

