Commands
Every rady verb, grouped by workflow. Use --help on any command for flag-level detail (rady fabricate --help).
ℹGlobal flags
Every subcommand accepts --api-key / -k and --base-url / -b. Resolution order for the API key: explicit flag → RADMAH_API_KEY env var → OS keyring (keyed by base_url).
An https:// endpoint on your private network (your own deployment at an RFC 1918 address or a name under .internal) needs --allow-private-base-url, which goes before the command (rady --allow-private-base-url jobs list), or RADMAH_ALLOW_PRIVATE_BASE_URL=1 for every command. http://localhost needs neither. An http:// URL to any other host is refused (the key would cross the network unencrypted) unless you pass --allow-insecure-http before the command or export RADMAH_ALLOW_INSECURE_HTTP=1 (from 1.4.0). The flag also accepts that typed URL as a private-network endpoint; the variable lifts only the cleartext refusal, so a private http:// endpoint also needs RADMAH_ALLOW_PRIVATE_BASE_URL=1. rady then prints a one-line warning on stderr, and a region redirect never carries the key from it to another host on your network. Cloud metadata endpoints are always refused.
Authentication
rady auth login
Store an API key in the OS credential store.
Prompts for an API key on stdin (echo off) when --api-key is omitted, verifies it by calling /health against the resolved base_url, then persists the key via keyring keyed by base_url. A failing verification never persists — retry with a fresh key.
rady auth login
rady --allow-private-base-url auth login --api-key sl_live_... --base-url https://radmah.internal
rady auth whoami
Resolved endpoint + credential source + tenant identity.
Shows which base_url the CLI will use, which source the API key was loaded from (flag / env / keyring), and the tenant slug returned by the server on a fresh /health call. Exits non-zero when the credential fails to verify.
rady auth whoamirady auth logout
Clear the stored credential for a given endpoint.
Removes the keyring entry for that base_url. Safe to run when no key is stored (idempotent). Does not revoke the key server-side — rotate in the dashboard for that.
rady auth logout
rady auth logout --base-url https://radmah.internalData generation & chat
rady fabricate
Reviewed dataset generation from a natural prompt.
preview drafts a contract from the prompt (server infers columns + types + ranges) and returns a preview id. refine applies a plain-English change and returns the next preview version. approve seals the reviewed contract, submits the generation job, waits for completion, and writes the primary artefact to --output (or stdout with -o -). Credits are metered server-side and reserved when the generation job is submitted. preview and refine each call a language model, so each one also consumes an AI request from your monthly allowance; the deterministic row generation that approve triggers consumes none. Pass --seed on preview for byte-identical re-runs of the sealed contract. state, drain, and cancel round out the group.
PV=$(rady fabricate preview "100 SaaS accounts with MRR 50-5000" -n 100 -q)
rady fabricate refine $PV "add churn_risk low/medium/high"
rady fabricate approve $PV -n 100 -o accounts.csv
rady chat
Interactive AI-assistant REPL.
Opens a chat session, starts a prompt_toolkit REPL with arrow-key history. User messages go to the assistant; responses render as Rich Markdown. Slash commands: /jobs (list), /approve (confirm a pending plan), /quit or Ctrl-D to exit. Sessions stay open server-side — resume with rady chat.
rady chat
rady chat --mode scada # stay on SCADA simulations
rady chat --mode ics # stay on ICS attacks
Generation engines
rady synthesize
Train + sample from your own dataset.
Runs Synthesis against an owned source dataset. The command submits a training-and-generation job, waits to terminal status, prints runtime, credits, and row count, then downloads the primary artefact. FHIR Bundle is a separate standards workflow, not a model selector on this command.
rady synthesize -d ds_a8f3b21c -n 10000
rady synthesize -d ds_a8f3b21c -n 1000 --seed 91 --output customers.csvrady scada simulate
Virtual SCADA run against a named plant template.
67 plant templates available (see `rady scada plants`). --ot-server serves the session live while it runs: on Sovereign over Modbus (TCP 5502), OPC UA and BACnet, and MQTT published to --mqtt-broker, for up to 24 hours; Enterprise adds DNP3 and up to 30 days. IEC 61850 is recorded only; a live request naming it (or MQTT without a broker) is refused with LIVE_PROTOCOL_NOT_SERVED before anything is quoted. --protocol, --regime-file, --fault and --calendar-file pass the protocols, an operating regime, requested faults and your plant's operating calendar. Free records only.
rady scada simulate --plant tank_farm_07 --duration 4
rady scada plants # list available plants
rady ics attack
Run a MITRE ATT&CK ICS technique on a plant.
42 ATT&CK for ICS technique IDs can appear in a bundle; 32 ship bespoke generators. Each run produces a labelled cyber-range bundle: pcapng + ground-truth.ndjson + signals.parquet + sealed Sigma/Snort/Suricata/YARA detection rules derived from the event types.
rady ics attack --plant tank_farm_07 --technique T0832
rady ics techniques # list supported techniques
rady ics mitre-coverage # coverage by depth: full / derived / recon / planned
rady ads new
Kick off an Agentic Data Scientist run from an English goal.
Creates a project, (by default) waits for the plan to reach awaiting_approval, then prints the step table. Approve with `rady ads approve <project>` to start execution. HAGP gate preserved.
rady ads new -g "Profile customers dataset, engineer tenure + spend, train churn model, SHAP drivers"
rady ads list
rady ads approve <project>
SCADA sessions: replay and live control
rady scada replay
A finished SCADA / ICS session's replay: status and signals.
Shows the replay of a finished Virtual SCADA or ICS session of any length: its time range, signals, resolutions and event counts, and the sealed telemetry (name and SHA-256) the replay was derived from. The replay is prepared when the session finishes; reading a session that finished earlier prepares it (a read-only key may do this too). --wait reads until the answer is final. Exit 0 ready, 4 while it is being prepared, 5 failed, 6 no replay for this job.
rady scada replay 52506c87-cb7f-4682-ab5d-bf176ca9e4a8 --waitrady scada replay-window
A time window of the replay, at the finest resolution that fits.
Every recorded sample when the window holds no more than --points (50-2000) per signal, otherwise buckets that each keep their first, last, lowest and highest reading with their times, so no spike is dropped; the output says which. Times are epoch milliseconds or ISO-8601 (UTC when no zone is given).
rady scada replay-window <job-id> --signal basin_1::dissolved_oxygen \
--start 2026-01-01T01:00:00Z --end 2026-01-01T01:10:00Z --csv window.csvrady scada replay-events
The session's alarm journal or security events, page by page.
Events inside the window in time order (--order desc: newest first), with the exact count of every event in the window. The window defaults to the whole session, events before the first or after the last telemetry sample included. --flagged keeps raised alarms or malicious events; --all reads every page to the end (with --json, one JSON line per event) and fails (exit 1) rather than stop early should the API end the list without a way to continue. One page says how many events exist and how to read the rest.
rady scada replay-events <job-id> --kind alarm --flagged --all --json > raised.jsonl
rady scada replay-events <job-id> --kind security --flagged --all # every attack of an ICS sessionrady scada session-health
The live OT servers of a running session (Sovereign or Enterprise).
For a live session: its state, protocols, connection strings, end time and whether it can be stopped. A recorded (batch) run had no live server and says so (exit 6).
rady scada session-health <job-id>rady scada stop
Stop a live session early, gracefully.
The servers close, what the session recorded is sealed, the session completes with it, and the unused part of the time it was requested for is refunded at the session's hourly rate, rounded up (at least 1 credit is kept). Repeating the command changes nothing. A recorded run, or a live session that has ended, has nothing to stop (409 SESSION_NOT_LIVE).
rady scada stop <job-id>
rady jobs wait <job-id> && rady scada replay <job-id> --waitContracts & inputs
rady seals
sealed contract lifecycle — create, list, validate.
Seals are immutable sealed contracts. create takes a local JSON file + engine + mode and returns the sealed ID. validate runs the same schema + satisfiability check as server pre-flight, without creating state or consuming credits.
rady seals list
rady seals create ./contract.json
rady seals validate ./contract.jsonrady contract hash
the canonical hash of a Contract-K file, without sealing it.
Sends the file to the platform (POST /v1/client/seals/hash) and prints the canonical contract hash a seal created from it would record. Nothing is sealed or charged. --show-serialized is refused: the API returns the hash only.
rady contract hash --file ./contract.json --seed 42rady fhir synth
a synthetic FHIR R4 bundle, generated on the platform.
Runs a healthcare_fhir job, waits for it and saves its sealed fhir_bundle.json byte-for-byte to --output, then prints the resource count per type, whether RadMah's conformance check passed and the bundle fingerprint. Generator options go in --option key=value (repeatable, for example birth_year_min=1950); an invalid value is refused before any quote or charge. The same seed, options and workspace give the same bundle bytes. Every succeeded FHIR job gets a reproduction token: an opaque value naming that one job on the platform, shown with `rady fhir token show <job>` to the workspace's owner, admin and member roles and withdrawn with `rady fhir token revoke <job>`; it never expires on its own and is never part of the evidence bundle. A collaborator who runs --reproduction-token with it regenerates exactly that job's bytes in their own workspace (the platform resolves the token to the job's seed, patient count and options; an unknown or revoked token is refused before any charge). The job also delivers Bulk NDJSON per resource type, a conformance report and the terminology notices: list them with `rady jobs artifacts <job>`. Metered per delivered resource like any FHIR job: price it first with `rady jobs quote --kind synthesize --engine healthcare_fhir --rows N --seed N`, and cap it with --max-credits.
rady fhir synth --seed 7 --n-patients 25 --option birth_year_min=1950 -o ./bundle.json --max-credits 10rady fhir token
show or revoke a FHIR job's reproduction token.
show prints a succeeded FHIR job's reproduction token: its reference, status, creation time, patient count and generator version, and the token itself for the workspace's owner, admin and member roles (a viewer sees that it exists). Whoever holds the token regenerates that one job's bundle in their own workspace with `rady fhir synth --reproduction-token`, and nothing else. revoke withdraws it after asking (--yes skips the question): from then on the token regenerates nothing, including jobs already created with it that have not run. A job regenerated from another workspace's token has no token of its own.
rady fhir token show 52506c87-cb7f-4682-ab5d-bf176ca9e4a8
rady fhir token revoke 52506c87-cb7f-4682-ab5d-bf176ca9e4a8 --yesrady plan
ADS campaign templates as draft plans, read-only.
Lists the platform's campaign catalogue and shows one campaign's parameters and draft plan steps. Nothing is started and no AI request or credit is used; `rady ads` runs a plan.
rady plan list
rady plan campaign scada_baseline_six_protocol --jsonrady scenarios fabricate
A facility description → a sealed scenario pack, in one command.
Describe an industrial facility and get back a sealed SCADA scenario pack: its asset types, its sensor catalogue with engineering units and alarm limits, and the seal hash that pins it. Writes the pack JSON to --output when supplied so you can version it or feed it to `rady scada simulate --plant <pack_id>`. The pack is also kept in your workspace, so `rady scenarios packs` lists it afterwards. Charged to your credit balance like any other fabrication — the command prints what it cost.
rady scenarios fabricate -d "a municipal wastewater plant with screening, aeration and clarification" -o ./pack.json
rady scenarios packs # list scenario packs (plants / attack templates / FHIR profiles)rady datasets upload
Upload a local CSV / JSON / Parquet as a dataset.
Returns a dataset ID you can feed straight to `rady synthesize -d <id>`. preview / analyze / list subcommands round out the dataset lifecycle.
rady datasets upload customers_q3.csv
rady datasets list
rady datasets preview ds_7a12Job lifecycle
rady jobs list
Recent jobs in reverse-chronological order.
Color-coded status column (running / succeeded / failed / cancelled), short-form IDs for easy copy-paste, plus a next-step hint pointing at rady jobs get.
rady jobs list
rady jobs list --limit 50rady jobs quote
Price a job before submitting it.
Asks the platform's pricing authority for the credits a job will reserve. Learned Synthesis quotes price the workload at the resolved compute tier; healthcare_fhir quotes price the deterministic resource projection for the given seed and generator options (FHIR is metered per delivered resource, so --rows is the patient count and the projection is shown per resource type). Nothing is reserved by quoting.
rady jobs quote --kind synthesize --dataset-id 91dd078e-... --rows 10000
rady jobs quote --kind synthesize --engine healthcare_fhir --rows 100 --seed 42
rady jobs quote --kind synthesize --engine healthcare_fhir --rows 100 --seed 42 -o encounters_per_patient_mean=4rady jobs get
Full detail for one job.
Short or full job ID accepted. Shows kind, engine, status, progress, dataset, seal, started/finished timestamps, and any error_code / error_detail.
rady jobs get a8f3b21c
rady jobs get 91dd078e-... rady jobs wait
Block until terminal status.
Polls every --poll seconds (default 4) until the job hits succeeded / failed / cancelled. Exits non-zero if the job failed or timed out.
rady jobs wait a8f3b21c
rady jobs wait a8f3b21c --poll 2 --timeout 900rady jobs cancel
Cancel a queued or running job.
Prompts for confirmation unless --yes is passed. No-op on terminal (succeeded / failed / cancelled) jobs.
rady jobs cancel a8f3b21c
rady jobs cancel a8f3b21c --yesrady jobs artifacts
List the artefacts a completed job produced.
Prints id, name, row count, and MIME for every artefact. Use the ID with rady jobs download to fetch content.
rady jobs artifacts a8f3b21crady jobs download
Download an artefact by ID.
Writes the artefact content to --output (or stdout with -o -). Content is typed as string (CSV / JSON — MIME comes from the /artifacts listing).
rady jobs download a8f3b21c d7c922f0 -o ./out.csv
rady jobs download a8f3b21c d7c922f0 -o - # pipe to jq, wc, etc.rady jobs evidence
Sealed evidence-bundle summary.
Shows bundle ID, seal hash, contract hash, data hash, determinism proof, and creation timestamp. For full offline verification use evidence verifier (ships with the SDK).
rady jobs evidence a8f3b21cEvidence
rady evidence verify
Fully offline bundle verification — no network, no API key.
Verifies BLAKE3 integrity + optional Ed25519 signature using the public cryptographic primitives in the SDK. Reports integrity, signature status, Merkle root, bundle hash. Exit 0 on verify-OK, 1 on mismatch. No API key required — runs fully offline.
rady evidence verify ./bundle.json
rady evidence verify ./bundle.json --public-key /etc/trust/customer.pub
rady evidence get <job-id> # fetch a bundle summary from the server
Account & integration
rady usage
Credits available, used this month, plan, renewal.
Top-level `rady usage` with no subcommand shows the current billing period summary. `rady usage plans` lists the billing plans you can upgrade to.
rady usage
rady usage plans
rady webhooks
HTTPS webhook delivery with HMAC signature.
create enforces HTTPS + refuses private / loopback URLs (matches server-side SSRF guard). test sends a signed delivery and returns the response status + latency. Signing secret shown plaintext ONCE on create.
rady webhooks create --url https://acme.example/hooks --events job.succeeded,job.failed
rady webhooks test wh_1a8f
rady webhooks deliveries wh_1a8f
rady ai-provider
Your workspace's own AI provider key (bring your own key).
The same setting as Settings → AI Providers and the SDK's get_llm_config / update_llm_config / delete_llm_config. set reads the key from standard input (--key-stdin) or asks for it without echo at a terminal - never from the command line - and keeps every other setting unless an option changes it. The key is stored encrypted and bound to your workspace, and only ever shown masked (its first and last four characters at most). A refused key exits 2 and prints its code (LLM_API_KEY_TOO_LONG, LLM_API_KEY_INVALID_CHARACTERS, ...).
rady ai-provider set --provider anthropic --model claude-3-5-sonnet-latest --key-stdin < anthropic.key
rady ai-provider show
rady ai-provider remove --yes