The command line
Every command, and the flags every command takes.
vaigil helpEvery command takes --json, --root DIR and --token T. With --json, standard output is one JSON document. A token can also come from VAIGIL_TOKEN.
| Group | Commands |
|---|---|
| Running it | init, serve, mcp |
| Collecting what happens | connect, collect, source, telemetry, inbound, spool, identity |
| Detecting and deciding | detect, sigma, correlate, triage, hunt, finding, intel, analyst, automate, geo |
| Cases and response | incident, action, notify, work |
| Vulnerabilities and code | vuln, feed, sca, sarif, appsec |
| The estate and its people | estate, workforce, remind, vendor, access |
| People, sign-in and changes | auth, oidc, saml, scim, token, pending, approvals |
| Its own record and settings | auditlog, logd, siem, vault, config, network, version |
Every command has a screen in the console or a written reason why not, and an MCP operation or a written reason why not; a test fails when one has neither.