Clanker CLI

Agent swarm powering Clanker Cloud, the first AI DevOps IDE for agents and humans.

Docs available at docs.clankercloud.ai

Language: English | 简体中文

Ask questions about your infra (and optionally GitHub/etc). Clanker can inspect existing environments and also generate or apply infrastructure and deploy plans through its maker and deploy flows.

Repo: bgdnvk/clanker

Homebrew tap: clankercloud/homebrew-tap

Install

Homebrew (can be outdated, the best is to build from master)

brew tap clankercloud/tap
brew install clanker

From source

make install

Self-update

clanker update

By default, clanker update replaces the current binary with the latest GitHub release from bgdnvk/clanker. To track the latest commit on the repository's default branch instead, set the update channel during setup:

clanker config init --update-channel main

or edit ~/.clanker.yaml:

update:
    channel: main # release or main

You can also override it for one run:

clanker update --channel release
clanker update --channel main

Requirements

• Go
• Provider CLIs only for the providers you want Clanker to inspect or manage

clanker onboarding scan
clanker onboarding scan --provider aws,gcp,azure,kubernetes,flyio,linear,notion --format json
clanker onboarding install --dry-run --provider aws,gcp,azure,kubernetes,flyio
clanker onboarding install --yes aws gcloud az kubectl flyctl

clanker onboarding scan detects local credentials and missing provider CLIs, then returns official install docs, auth commands, and token/account URLs for users and agents. Install only the tools needed for selected or detected providers. Examples: AWS uses the official AWS CLI installer and local profiles, GCP uses the official Google Cloud CLI plus Application Default Credentials, and Azure uses the official Azure CLI sign-in flow. Agents that have been asked to install or use Clanker Cloud should run the install step, rerun the scan, then walk any remaining browser login, SSO, sudo, or official API-token step with the user.

Config

Copy the example config and edit it for your environments/providers:

cp .clanker.example.yaml ~/.clanker.yaml

alternatively you can do clanker config init

Most providers use env vars for keys (see .clanker.example.yaml), e.g.:

export OPENAI_API_KEY="..."
export GEMINI_API_KEY="..."
export COHERE_API_KEY="..."

No config file defaults

If you run without ~/.clanker.yaml:

• Default provider: openai (unless you pass --ai-profile).
• OpenAI key order: --openai-key → OPENAI_API_KEY (also supports ai.providers.openai.api_key and ai.providers.openai.api_key_env if config exists).
• Gemini API key order (when using --ai-profile gemini-api): --gemini-key → GEMINI_API_KEY (also supports ai.providers.gemini-api.api_key and ai.providers.gemini-api.api_key_env if config exists).
• Cohere API key order (when using --ai-profile cohere): --cohere-key → COHERE_API_KEY (also supports ai.providers.cohere.api_key and ai.providers.cohere.api_key_env if config exists).
• Model: openai defaults to gpt-5; gemini/gemini-api defaults to gemini-2.5-flash; cohere defaults to command-a-03-2025.

AWS

Clanker uses your local AWS CLI profiles (not raw access keys in the clanker config).

Create a profile with the official AWS CLI. Prefer SSO where your AWS account supports it; use access keys only when your account requires them.

aws configure sso
aws sso login --profile clankercloud-tekbog
aws configure --profile clankercloud-tekbog | cat
aws sts get-caller-identity --profile clankercloud-tekbog | cat

Set the default environment + profile in ~/.clanker.yaml:

infra:
    default_provider: aws
    default_environment: clankercloud

    aws:
        environments:
            clankercloud:
                profile: clankercloud-tekbog
                region: us-east-1

Override for a single command:

clanker ask --aws --profile clankercloud-tekbog "what lambdas do we have?" | cat

Cloud Provider Inventory Examples

Use static list commands for read-only inventory without AI interpretation:

clanker aws list resources
clanker aws list all-services
clanker aws list bedrock-kb
clanker gcp list services
clanker gcp list resources
clanker gcp list run-worker-pools
clanker azure list resource-graph
clanker azure list private-endpoints
clanker azure list ai-search
clanker cf list ai-search
clanker cf list browser-sessions
clanker cf list secrets-stores
clanker cf list pipelines

Each provider exposes the full supported resource list through its help:

clanker aws list --help
clanker gcp list --help
clanker azure list --help
clanker cf list --help

Usage

Clanker Apps

Clanker Apps are account-scoped, immutable deployments for small team software. Deploy a complete HTML document when you need working JavaScript, forms, browser storage, external resources, downloads, navigation, or API calls. The document runs as supplied at its own public app URL; network calls follow normal browser and API CORS behavior.

Creating an app or deployment keeps it private. activate (also available as publish or share) publishes one deployment and returns its shareable link. The full JSON result stays available while a concise Public URL: line makes the link easy to copy. unpublish removes public access without removing retained versions. delete permanently disposes of the app, all versions, and hosted artifacts.

For example, save a complete app as index.html, then deploy it:

<!doctype html>
<title>Team CRM</title>
<main id="app"></main>
<script>
  const contacts = [{ name: "Ada", company: "Analytical Engines" }];
  document.querySelector("#app").textContent =
    `${contacts.length} contact: ${contacts[0].name}`;
</script>

export CLANKER_CLOUD_API_KEY="..."

clanker cloud apps create "Team CRM" --description "Shared contact workspace"
clanker cloud apps deploy APP_ID --html-file ./index.html
clanker cloud apps deployments APP_ID
clanker cloud apps share APP_ID DEPLOYMENT_ID
clanker cloud apps unpublish APP_ID
clanker cloud apps delete APP_ID

Single-file HTML deployments are valid UTF-8 and limited to 2 MiB. The CLI sends exactly the supplied HTML; it does not remove features or filter content. Deployment output identifies this runtime as clanker-html-v1 and reports its file count, total bytes, and browser network policy.

HTML apps can explicitly opt into hosted Gemini and/or Kimi calls without shipping provider credentials in the document:

clanker cloud apps deploy APP_ID \
  --html-file ./agent.html \
  --agentic-provider gemini \
  --agentic-provider kimi

Inside the deployed HTML, derive the root-stable app endpoint before calling it so the request still works after client-side navigation:

const slug = location.pathname.split("/")[2];
const endpoint = `/a/${encodeURIComponent(slug)}/__clanker/llm`;
const response = await fetch(endpoint, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    provider: "gemini",
    messages: [{ role: "user", content: "Summarize these contacts" }],
  }),
});
const result = await response.json();

Agentic access is absent unless at least one --agentic-provider is supplied. When enabled, the defaults are also the launch ceilings: 25 requests per app per UTC day, 16000 input characters per request, and 1024 output tokens per request. Lower them with --agentic-daily-requests, --agentic-max-input-chars, and --agentic-max-output-tokens. The limits must remain at least 1. Agentic options apply only to HTML deployments. These controls are versioned with the deployment, while the daily request counter is app-wide and continues across deployment activations until the next UTC day.

The existing fixed-renderer appSpec v1 runtime remains available for declarative snapshots. Save a specification such as this as app-spec.json:

{
  "schemaVersion": 1,
  "title": "Team CRM",
  "description": "Shared contact workspace",
  "theme": "ocean",
  "blocks": [
    {
      "type": "metrics",
      "title": "Overview",
      "items": [{ "label": "Contacts", "value": "12" }]
    },
    {
      "type": "table",
      "title": "Contacts",
      "columns": ["Name", "Company"],
      "rows": [["Ada", "Analytical Engines"]]
    }
  ]
}

clanker cloud apps deploy APP_ID --app-spec-file ./app-spec.json

The v1 block types are metrics, text, table, cards, and list. Specifications are limited to 24 blocks and 256 KiB. Use exactly one of --html, --html-file, --app-spec-json, or --app-spec-file for each deployment.

Create and deploy generate a valid idempotency key automatically. Pass --idempotency-key when you need the same stable key across manual retries.

One-shot sandbox tasks require an account key, then dispose their compute and persistent sandbox storage before returning. If cleanup fails, the command prints the sandbox id and an exact sandboxes delete retry command. Use --keep-sandbox only for intentional debugging work:

clanker cloud sandboxes run "inspect this repository and summarize it"
clanker cloud sandboxes run --keep-sandbox "prepare a debugging workspace"

MCP

Clanker also exposes its own MCP surface as a CLI command.

Run it over HTTP:

clanker mcp --transport http --listen 127.0.0.1:39393 | cat

Or over stdio for MCP clients that launch commands directly:

clanker mcp --transport stdio | cat

The CL