Reference
Command reference
Every regixo command, grouped the way regixo help shows them,
with the flags that matter and one example each. The command line is the whole product on the free
side — it runs headless, so an agent or a CI job drives every command the same way you do.
Read this from your own project — the list of commands, or any one of them in detail:
say
“Show me what Regixo can do in this project.”
Show the commandHide the commandShow the sentenceHide the sentence
run
$ regixo help $ regixo help start # or: regixo start --help
An agent reads the same thing as data — every command with its usage, the env vars it reads, and
the full error list (code → message → fix). This is its first call:
say
“Read Regixo’s command manifest and tell me what it can do.”
Show the commandHide the commandShow the sentenceHide the sentence
run
$ regixo help --jsonOr hand it the whole job at once — regixo skill prints the playbook that teaches a
coding agent to operate Regixo: the setup order, the guardrails, and where it must hand back to you.
Nothing to install:
say
“Read Regixo’s operating playbook, then set it up for this project.”
Show the commandHide the commandShow the sentenceHide the sentence
run
$ regixo skillTiers: free ships in the open-source build · paid needs an unlock · a command marked both is free to draft and paid to seal. Free stays free forever.
Every command
| Command | What it does | Key flags | Example |
|---|---|---|---|
| Get started | |||
start |
Scan your sources’ structure into a local catalog — names and types only, never the row data. A source it can’t reach is reported, not fatal. | --source <id> · --dora · --catalog-only · --json |
regixo start |
open |
Open the map and draft record in your browser; also serves the versioned /api/v1 read API while it runs. Keeps running until you press Ctrl+C — give it a terminal of its own, and run it yourself rather than handing it to an agent (why). |
--no-browser · --port <n> · --json |
regixo open |
invite |
Hand the draft to your compliance team — a forwardable DRAFT PDF plus a claim-in-portal link and a metadata-only snapshot. --email locks the claim link to that address, so only they can claim admin; --unbound sends it unbound instead — anyone holding the link can become the record’s admin. |
--yes · --no-upload · --email <addr> · --unbound · --no-open · --json |
regixo invite --yes |
share |
Write one self-contained HTML file for a teammate who doesn’t run Regixo. It opens as a briefing for your compliance team — what looks like personal data, where it lives — with the full map underneath as evidence. Metadata only; a read-only snapshot of the last scan. | --out <path> · --title <name> · --json |
regixo share --out data-map.html |
| Connect sources | |||
add |
Connect a data source — writes regixo.yml, stores only the env-var name, never the secret. A wizard on a terminal, flag-driven when scripted. Also adds a bring-your-own connector: add script --generator … (a small schema-printing script an AI agent authors). |
--ref <ENV> · --from <file> · --generator <file> · --target <id> · --role controller|processor · --region · --id · --label · --skill · --yes · --json |
regixo add postgres --ref DATABASE_URL |
connectors |
Add a connector Regixo doesn’t ship (any SaaS or your own internal API) — with a coding agent. Runs out-of-process; nothing authored runs inside Regixo. --skill prints the agent playbook (interview + how to author); new scaffolds a generator script; list shows yours. Best-effort — excluded from the freshness guarantee. |
list · new <name> · --skill · --force · --json |
regixo connectors --skill |
sources |
List your data sources, or remove one (undo an add). Remove drops it from regixo.yml and clears its mapped data; your .env secret is left untouched. Removing a scanned source needs --yes. |
remove <id> · --yes · --json |
regixo sources remove app-db --yes |
test |
Dry-run each source connection — credentials and reachability — without scanning. Exits non-zero if any source fails. | [source] · --json |
regixo test app-db |
| Inspect | |||
status |
Show what is connected, scanned, and still missing — sources, datasets, PII counts, and a loud coverage number if any source was unreachable. | --probe · --no-probe · --json |
regixo status |
search |
Search the catalog from the terminal — datasets and columns, ranked by the same engine as the portal and the API. | --limit <n> · --json |
regixo search payment amount |
doctor |
Check Node and your config, resolve and probe each source connection, then print a specific fix. | --no-probe · --json |
regixo doctor |
log |
Show the append-only change log — what was added or removed in the map, and when. | --since <ISO> · --limit <n> · --json |
regixo log --since 2026-01-01 |
evidence |
Assemble one machine-readable evidence bundle — RoPA and DORA drafts, change-log, source list — with a per-artifact sha256. Draft-only, attests nothing. | verify <file> · --json |
regixo evidence |
| Enrich | |||
describe |
Draft or fill dataset and column descriptions — deterministic, local, no egress. Persists outside the snapshot, so a re-scan never clobbers it. | list|draft|set|confirm|clear · --all · --force · --model · --skill · --json |
regixo describe draft --all |
lineage |
Assert a cross-system data flow no scanner can infer (e.g. Stripe → your users table). Survives a re-scan. | list|add|remove · --origin user|dbt|all · --skill · --json |
regixo lineage add stripe/customers app-db/public/users |
glossary |
Define business terms and link them to datasets — semantic context for people and agents. | list|set|suggest|confirm|remove · --datasets=id,id · --suggest · --skill · --json |
regixo glossary set MRR "Monthly recurring revenue" |
classify |
Correct a column’s personal-data flag when the classifier got it wrong. Mechanical and local — it never confirms a legal field. | list|set|clear · personal|special|criminal|not · --skill · --json |
regixo classify set app-db/public/users.nickname personal |
catalog |
Share your team’s notes — export or import the descriptions, terms, corrections and legal answers layered onto the map. No schema, no secrets travel. | export|import · --out <path> · --dry-run · --json |
regixo catalog export |
| Agents | |||
skill |
Print the playbook that teaches your coding agent to run Regixo for you — the whole job, in order. Nothing to install or register. | --write · --json |
regixo skill |
mcp |
Let an AI assistant read your catalog over stdio — eight read tools, read-only by construction, and nothing leaves your machine. | --print-config · --skill |
regixo mcp --print-config |
| Settings | |||
config |
View or change saved settings — for example catalog-only mode, which hides the EU-compliance surfaces. | catalog-only <on|off> · --json |
regixo config catalog-only on |
| Compliance | |||
report |
(Re)generate the GDPR Article 30 RoPA DRAFT — and the DORA register DRAFT, if you are in DORA scope. | --dora · --json |
regixo report --dora |
pull |
Bring your compliance team’s claim-side answers home — the RoPA legal fields and (in DORA scope) the register cells, merged into this machine with a per-field diff that never blindly overwrites your newer local answer. The claim token is the capability; the portal address on your recorded claim link is used automatically. (regixo dora pull is the older name and keeps working.) |
<claim-token> · --dry-run · --force · --json |
regixo pull clm_… |
dorafree draft paid export |
Fill the DORA register a scanner can’t know — contracts, functions, LEIs. Import, set, or check status; options lists a closed-set column’s allowed values; pull is the older alias of regixo pull; export validates and seals the filing package (paid). |
import|set|options|pull|status|export |
regixo dora status |
annotate |
Fill or confirm the RoPA legal fields a scan can’t decide — purpose, lawful basis, retention, transfers, security measures. --confirm records it as a named human act; --why records the reasoning behind the answer — the balancing test behind Art. 6(1)(f), for example — so the next person to hold the record has it. |
list|set|clear · --confirm · --why "<reason>"Keys are activity keys, or processor:<client> for the Art. 30(2) record — whose fields are controllerContact · processingCategories · transfersOutsideEU · transferSafeguard · securityMeasures. |
regixo annotate set <key> retention "6 years" |
verifypaid |
Turn the DRAFT into the OFFICIAL, signed version. Verifies REGIXO_LICENCE_KEY offline; without the paid layer it reports as the free build. If open legal calls remain it stops and lists them — answering them is the stronger record; --seal-with-open-calls proceeds and the seal records that you acknowledged them. |
--json · --seal-with-open-calls |
regixo verify |
sealfree pull paid stamp |
Pull the signed, sealed record home from the portal once your compliance lead signs it; seal stamp attaches the RFC 3161 time counter-stamp — the mechanism ships, but no time-stamp authority is configured yet, so seals record timestampProof: none until the owner selects one. |
pull <token> · stamp · --json |
regixo seal pull clm_… |
serve-claim |
Preview the claim locally — what your compliance team sees — before you send it. | --no-browser · --port <n> |
regixo serve-claim |
| Operator (paid module) | |||
adminpaid |
Run the account layer — records, users and roles, machine tokens, licences, audit. Needs the paid module; a free build reports PORTAL_NOT_INSTALLED. Every subcommand: the operator surface ↓. |
<command> · --yes · --json |
regixo admin grant --claim clm_… --plan ropa |
| Keep current | |||
watch |
Re-scan for changes: refresh the map, append a dated history of what changed, and flag signed records whose core fields moved for re-signing. One-shot — schedule it from CI or cron. On a paired machine it also sends the refreshed record to your compliance team's copy. | --ci · --webhook <url> · --json |
regixo watch --ci |
push |
Send the record as it stands to your compliance team's copy — no re-scan. Works when a source is unreachable or still waiting on a credential, because it touches no database. Needs a paired machine; unpaired, it says so and exits 1. | --json |
regixo push |
annotate sits under Compliance; admin is the vendor's
operator surface and needs the paid module. Both now appear in the grouped regixo help
list, which is generated from the one owning registry.
Full flags and examples for any command: regixo help <command>.
The operator surface — regixo admin
The vendor's control of the account layer, run on the portal machine against its data dir
(REGIXO_DATA). It needs the paid module — a free build answers
PORTAL_NOT_INSTALLED. None of it is part of the engineer's day or the compliance team's —
it is the surface whoever operates a portal uses.
| Command | What it does |
|---|---|
| Records | |
admin tenants | List all records (○ pending · ● active). |
admin tenant <token> | Full detail of one record. |
admin tenant rm <token> [--yes] | Destructive. Delete the record + its claim files. |
| Users & sign-in | |
admin members <token> | List a record’s members + roles. |
admin member add <token> <email> --role <r> | Add a member (viewer|preparer|approver|admin). |
admin member set <token> <email> --role <r> | Change a member’s role. |
admin member rm <token> <email> [--yes] | Destructive. Remove a member (last-admin guard). |
admin user <email> | Everything one person holds (support lookup). |
admin user logout <email> [--yes] | Destructive. Force sign-out everywhere. |
admin user rm <email> [--yes] | Destructive. Erase an account (refused while sole admin anywhere). |
admin user move <old-email> <new-email> [--yes] | Destructive. Re-key an account to a new address (sessions end). |
admin sso set --claim <token> --issuer <url> --client-id <id> --client-secret-env <VAR> [--require] | Connect the record’s IdP. The secret is passed by env-var name; --require turns off magic-link sign-in for that record. |
admin sso show --claim <token> | The record’s IdP config (secret never printed). |
admin sso rm --claim <token> | Disconnect the record’s IdP. |
| Machines | |
admin machines <claim-token> | List a record’s machine sync tokens. |
admin machine add <claim-token> --label <l> | Generate an ingest-only rgx_sync_ token (shown once). |
admin machine rm <claim-token> <id> [--yes] | Destructive. Revoke one machine token. |
| Licences | |
admin mint --tenant <id> --plan <p> --expires <ISO> [--live --key-file <pem>] | Mint a licence. Defaults to the dev sandbox key; --live signs with the production key file. |
admin grant --claim <token> --plan <p> [--expires <ISO>] [--key <rgx_…>] [--live --key-file <pem>] | Give a customer their licence (invoice/manual); someone on their compliance team then signs. Granting never seals the record. |
admin revoke --licence <key> [--reason <text>] | Deny-list: refuse the key at unlock. |
admin licences [<token>] | Per-record licence state. |
| Support | |
admin health [--send-test <email>] | Is this portal fit to serve customers? Run this one. --send-test sends ONE real email to prove delivery. |
admin claims --member <email> | What an address holds here (alias of admin user <email>). |
admin audit [--claim <token>] [--user <email>] | The append-only who-did-what log. |
admin resend --claim <token> [--to <email>] [--new-recipient] | Email the live claim link. Sending to a NEW address needs --new-recipient — it grants view access, and is audited. |
Every command takes --json, every mutation is audited, and the
destructive ones need --yes when run headless. The product prints this same list with
regixo admin help. Per-record roles and machine tokens from the customer's side — the
Team card, not the CLI: Roles & governance.
Portal & agent equivalents
The command line is the whole free product, but several commands also have a point-and-click twin in
the local portal (regixo open), and the read commands answer to an AI agent too. The
tours: The free portal ·
The compliance portal ·
With an AI agent.
| Command | In the portal |
|---|---|
open | The portal itself — regixo open serves it on localhost:4319. |
search | The Map search box (“Search datasets and columns…”). |
classify | Map → a column’s Correct select, with Revert to Regixo’s call. |
describe | A dataset’s Draft a description / Confirm / Clear. |
lineage | Map → + Assert a flow (target id + grain). |
glossary | The Glossary composer — + Add term (Term · Definition · Link to datasets). |
evidence | Evidence bundle → ↓ Download / ↻ Regenerate. |
config | Settings toggles — Mode and DORA scope. |
watch | Map → ↻ Refresh now (re-scan · stays local) runs the same re-scan; Settings → Keep it current is where you schedule it. |
mcp | The Agents (MCP) screen — pick a client, Copy snippet. |
verify | The compliance portal — Unlock & pay, then Sign & seal. |
pull | Record → Bring their answers in, when the page says answers are waiting. Same merge, one click. |
seal pull | Record → Bring the sealed record home, once the portal says it was signed. |
invite | Record → Make the invitation (Make an updated invitation on a re-invite) → Before this leaves your machine → Upload it and make the link. |
Everything else is CLI-only — no portal control: start, add,
connectors, share, serve-claim,
annotate, dora import/set, catalog, admin,
seal (other than seal pull), report, test,
doctor, status,
sources, log, skill, push. Connecting a source is CLI-only.
Payment happens only on the compliance portal.
Global flags & exit codes
Every command is agent-drivable: off a terminal (or under CI, or with
--non-interactive) it never prompts. A missing required input is a coded error that
names the flag or env var to supply — not a blocked prompt.
--json— machine-readable output, on every agent-driven command.--non-interactive— force headless mode even on a terminal: never prompt, take answers from flags, env andregixo.yml. A non-TTY orCIrun behaves the same way on its own.--help— usage, flags and examples for a command (same asregixo help <command>).--version— the installed version.--yes— accept defaults and give consent without a prompt. Global, like the flags above, but it only changes anything where an action is gated:add,invite,sources removeand the destructiveadminops.--intent <catalog|compliance>— aregixo startsetup flag (orREGIXO_INTENT) that records what you came for. It tunes the portal’s emphasis only — the RoPA is always drafted either way.
| Exit code | Meaning |
|---|---|
0 | Success. |
1 | A coded error — read error.code and error.fix (see Errors & fixes). |
2 | Usage error or unknown command. |
3 | A core RoPA field changed. Emitted only by regixo watch --ci, so CI can block a merge — plain regixo watch keeps 0/1. |
Looking up an error?
Every coded error carries a stable
code and a specific fix. The full
registry is the next page: Errors & fixes.Your next step
When a command exits non-zero, the
code and fix tell you exactly what to
do. The whole registry is next: Errors & fixes →.