The CLI agent

When to use the CLI

Use the CLI agent when your warehouse is not reachable from the internet (a private VPC, a firewalled Postgres or Redshift), or when policy requires that credentials never leave your environment. The CLI runs the same connectors and the same checks as the web app, entirely on your machine. It is offline by default: nothing is sent anywhere unless you pass the upload flag, and even then only the computed results (scores and finding names, never row data, never credentials) go to your dashboard.

Install

Requires Node.js 20 or newer.

npm install -g @mortariq/cli
mortariq --help

# Add --html to any scan for a self-contained report you can
# share internally. No account or API key needed.
mortariq scan --platform postgres ... --html report.html

Examples

One command per platform. The report prints to your terminal.

# PostgreSQL (private network)
mortariq scan --platform postgres \
  --host db.internal --database app --user mortariq_reader \
  --password <password> --schema public

# Amazon Redshift (inside your VPC)
mortariq scan --platform redshift \
  --host my-wg.123456789.us-east-1.redshift-serverless.amazonaws.com \
  --database dev --user mortariq_reader --password <password> \
  --schema analytics

# Snowflake (key-pair)
mortariq scan --platform snowflake \
  --account myorg-account --user MORTARIQ_SVC \
  --private-key ./rsa_key.p8 --database ANALYTICS --schema PUBLIC

# Microsoft Fabric (service principal)
mortariq scan --platform fabric \
  --server xxxx.datawarehouse.fabric.microsoft.com --database MyWarehouse \
  --tenant-id <tenant> --client-id <client> --client-secret <secret> \
  --schema dbo

# BigQuery (service-account key file)
mortariq scan --platform bigquery \
  --project my-project --dataset analytics --key ./service-account.json

Profiles and upload

Add --profile rag (or agents, training, feature-serving) for a deep workload assessment; the default is the scan profile. To push results to your dashboard so they appear alongside web assessments, add --upload --api-key miq_... (API keys are a Team feature, generated in Settings). The upload contains the computed assessment only: metadata-derived scores and finding names. No Team plan? --html gives you a shareable local report on any plan, no account or key required.

mortariq scan --platform postgres ... --profile agents \
  --upload --api-key miq_xxxxxxxx

What the upload does and does not contain