Commands

Every rady verb, grouped by workflow. Use --help on any command for flag-level detail (rady mock --help).

ℹGlobal flags

Every subcommand accepts --api-key / -k and --base-url / -b. Resolution order for the API key: explicit flag → RADMAH_API_KEY env var → OS keyring (keyed by base_url).

Authentication

rady auth login

Store an API key in the OS credential store.

rady auth login [--api-key KEY] [--base-url URL]

Prompts for an API key on stdin (echo off) when --api-key is omitted, verifies it by calling /health against the resolved base_url, then persists the key via keyring keyed by base_url. A failing verification never persists — retry with a fresh key.

rady auth login
rady auth login --api-key sl_live_... --base-url http://radmah.internal:8000

rady auth whoami

Resolved endpoint + credential source + tenant identity.

rady auth whoami [--base-url URL]

Shows which base_url the CLI will use, which source the API key was loaded from (flag / env / keyring), and the tenant slug returned by the server on a fresh /health call. Exits non-zero when the credential fails to verify.

rady auth whoami

rady auth logout

Clear the stored credential for a given endpoint.

rady auth logout [--base-url URL]

Removes the keyring entry for that base_url. Safe to run when no key is stored (idempotent). Does not revoke the key server-side — rotate in the dashboard for that.

rady auth logout
rady auth logout --base-url http://radmah.internal:8000

Data generation & chat

rady mock

One-shot mock data from a natural prompt.

rady mock --prompt TEXT [--rows N] [--seed N] [--output PATH]

Fabricates a sealed contract seal from the prompt (server infers columns + types + ranges), submits a mock job, waits for completion, writes the primary artefact to --output (or stdout with -o -). Credits metered server-side. Pass --seed for byte-identical re-runs.

rady mock -p "100 SaaS accounts with MRR 50-5000" -n 100
rady mock -p "1,000 medical patients" -n 1000 -o patients.csv
rady mock -p "monthly retail orders" -n 500 --seed 42 --output -

rady chat

Interactive AI-assistant REPL.

Opens a chat session, starts a prompt_toolkit REPL with arrow-key history. User messages go to the assistant; responses render as Rich Markdown. Slash commands: /jobs (list), /approve (confirm a pending plan), /quit or Ctrl-D to exit. Sessions stay open server-side — resume with rady chat.

rady chat
rady chat --mode scada      # stay on SCADA simulations
rady chat --mode ics        # stay on ICS attacks

Session open, user asks for 100 SaaS customer records, assistant proposes a schema preview, /approve confirms

Generation engines

rady synthesize

Train + sample from your own dataset.

rady synthesize --dataset <id> --engine <name> [--rows N] [--seed N] [--epochs N] [--output PATH]

Covers every synthesize-family engine: dvfm (flagship), gaussian_copula, tabular_diffusion, trc, trc_skeleton, fhir_bundle, cctp. Submits a training+sampling job, waits to terminal status, prints a summary table with runtime + credits + row count, then downloads the primary artefact.

rady synthesize -d ds_a8f3b21c -e dvfm -n 10000
rady synthesize -d ds_a8f3b21c -e tabular_diffusion --epochs 300
rady synthesize -d ds_a8f3b21c -e fhir_bundle -n 100

Summary table with engine, rows, runtime, credits, evidence hint

rady scada simulate

Virtual SCADA run against a named plant template.

rady scada simulate --plant <id> [--duration HOURS] [--seed N] [--ot-server]

67 plant templates available (see `rady scada plants`). --ot-server activates a live OT server (Modbus / DNP3 / S7 / OPC-UA / MQTT / BACnet) and enables the streaming-surcharge price path.

rady scada simulate --plant tank_farm_07 --duration 4
rady scada plants   # list available plants

rady ics attack

Run a MITRE ATT&CK ICS technique on a plant.

rady ics attack --plant <id> --technique <T-ID> [--seed N]

67 MITRE T-IDs supported (T0800-T0892). Each run produces a labelled cyber-range bundle: pcapng + ground-truth.ndjson + signals.parquet + sealed Sigma/Snort/Suricata/YARA detection rules derived from the event types.

rady ics attack --plant tank_farm_07 --technique T0832
rady ics techniques   # list supported techniques

rady ads new

Kick off an Autonomous Data Scientist run from an English goal.

rady ads new --goal "<text>" [--title NAME] [--no-wait-plan]

Creates a project, (by default) waits for the plan to reach awaiting_approval, then prints the step table. Approve with `rady ads approve <project>` to start execution. HAGP gate preserved.

rady ads new -g "Profile customers dataset, engineer tenure + spend, train churn model, SHAP drivers"
rady ads list
rady ads approve <project>

ADS project awaiting_approval with 6 steps

Contracts & inputs

rady seals

sealed contract lifecycle — create, list, validate.

rady seals {list | get | create | validate} [args]

Seals are immutable sealed contracts. create takes a local JSON file + engine + mode and returns the sealed ID. validate runs the same schema + satisfiability check as server pre-flight, without creating state or consuming credits.

rady seals list
rady seals create ./contract.json --engine dvfm --mode synthesize
rady seals validate ./contract.json

5 recent seals listed with engine + mode

rady scenarios fabricate

English → sealed sealed contract in one command.

rady scenarios fabricate --description "<text>" [--output PATH]

The same natural-language-to-sealed contract flow the web chat UI exposes, but scriptable. Writes the fabricated seal JSON to --output when supplied so you can version it or re-use it as a test fixture.

rady scenarios fabricate -d "100 B2B SaaS accounts MRR 50-5000" -o ./scenario.json
rady scenarios packs   # list scenario packs (plants / attack templates / FHIR profiles)

Fabricate scenario with written seal JSON

rady datasets upload

Upload a local CSV / JSON / Parquet as a dataset.

rady datasets upload <file> [--name NAME]

Returns a dataset ID you can feed straight to `rady synthesize -d <id>`. preview / analyze / list subcommands round out the dataset lifecycle.

rady datasets upload customers_q3.csv
rady datasets list
rady datasets preview ds_7a12

Job lifecycle

rady jobs list

Recent jobs in reverse-chronological order.

rady jobs list [--limit N]

Color-coded status column (running / succeeded / failed / cancelled), short-form IDs for easy copy-paste, plus a next-step hint pointing at rady jobs get.

rady jobs list
rady jobs list --limit 50

A color-coded table of recent jobs with id, kind, engine, status, rows, and created timestamp

rady jobs get

Full detail for one job.

rady jobs get <id>

Short or full job ID accepted. Shows kind, engine, status, progress, dataset, seal, started/finished timestamps, and any error_code / error_detail.

rady jobs get a8f3b21c
rady jobs get 91dd078e-...

rady jobs wait

Block until terminal status.

rady jobs wait <id> [--poll SECONDS] [--timeout SECONDS]

Polls every --poll seconds (default 4) until the job hits succeeded / failed / cancelled. Exits non-zero if the job failed or timed out.

rady jobs wait a8f3b21c
rady jobs wait a8f3b21c --poll 2 --timeout 900

rady jobs cancel

Cancel a queued or running job.

rady jobs cancel <id> [--yes]

Prompts for confirmation unless --yes is passed. No-op on terminal (succeeded / failed / cancelled) jobs.

rady jobs cancel a8f3b21c
rady jobs cancel a8f3b21c --yes

rady jobs artifacts

List the artefacts a completed job produced.

rady jobs artifacts <id>

Prints id, name, row count, and MIME for every artefact. Use the ID with rady jobs download to fetch content.

rady jobs artifacts a8f3b21c

rady jobs download

Download an artefact by ID.

rady jobs download <job-id> <artifact-id> [-o PATH]

Writes the artefact content to --output (or stdout with -o -). Content is typed as string (CSV / JSON — MIME comes from the /artifacts listing).

rady jobs download a8f3b21c d7c922f0 -o ./out.csv
rady jobs download a8f3b21c d7c922f0 -o -           # pipe to jq, wc, etc.

rady jobs evidence

Sealed evidence-bundle summary.

rady jobs evidence <id>

Shows bundle ID, seal hash, contract hash, data hash, determinism proof, and creation timestamp. For full offline verification use evidence verifier (ships with the SDK).

rady jobs evidence a8f3b21c

Evidence

rady evidence verify

Fully offline bundle verification — no network, no API key.

rady evidence verify <bundle.json> [--public-key PATH]

Verifies BLAKE3 integrity + optional Ed25519 signature using the public cryptographic primitives in the SDK. Reports integrity, signature status, Merkle root, bundle hash. Exit 0 on verify-OK, 1 on mismatch. No API key required — runs fully offline.

rady evidence verify ./bundle.json
rady evidence verify ./bundle.json --public-key /etc/trust/customer.pub
rady evidence get <job-id>   # fetch a bundle summary from the server

Offline verify — integrity OK, Ed25519 verified

Account & integration

rady usage

Credits available, used this month, plan, renewal.

rady usage

Top-level `rady usage` with no subcommand shows the current billing period summary. `rady usage plans` lists the billing plans you can upgrade to.

rady usage
rady usage plans

Sovereign plan, 1487 credits available, renews in 11 days

rady webhooks

HTTPS webhook delivery with HMAC signature.

rady webhooks {list | create | test | deliveries} [args]

create enforces HTTPS + refuses private / loopback URLs (matches server-side SSRF guard). test sends a signed delivery and returns the response status + latency. Signing secret shown plaintext ONCE on create.

rady webhooks create --url https://acme.example/hooks --events job.succeeded,job.failed
rady webhooks test wh_1a8f
rady webhooks deliveries wh_1a8f