Commands
Every rady verb, grouped by workflow. Use --help on any command for flag-level detail (rady fabricate --help).
ℹGlobal flags
Every subcommand accepts --api-key / -k and --base-url / -b. Resolution order for the API key: explicit flag → RADMAH_API_KEY env var → OS keyring (keyed by base_url).
Authentication
rady auth login
Store an API key in the OS credential store.
Prompts for an API key on stdin (echo off) when --api-key is omitted, verifies it by calling /health against the resolved base_url, then persists the key via keyring keyed by base_url. A failing verification never persists — retry with a fresh key.
rady auth login
rady auth login --api-key sl_live_... --base-url http://radmah.internal:8000
rady auth whoami
Resolved endpoint + credential source + tenant identity.
Shows which base_url the CLI will use, which source the API key was loaded from (flag / env / keyring), and the tenant slug returned by the server on a fresh /health call. Exits non-zero when the credential fails to verify.
rady auth whoamirady auth logout
Clear the stored credential for a given endpoint.
Removes the keyring entry for that base_url. Safe to run when no key is stored (idempotent). Does not revoke the key server-side — rotate in the dashboard for that.
rady auth logout
rady auth logout --base-url http://radmah.internal:8000Data generation & chat
rady fabricate
Reviewed dataset generation from a natural prompt.
preview drafts a contract from the prompt (server infers columns + types + ranges) and returns a preview id. refine applies a plain-English change and returns the next preview version. approve seals the reviewed contract, submits the generation job, waits for completion, and writes the primary artefact to --output (or stdout with -o -). Credits metered server-side. Pass --seed on preview for byte-identical re-runs of the sealed contract. state, drain, and cancel round out the group.
PV=$(rady fabricate preview "100 SaaS accounts with MRR 50-5000" -n 100 -q)
rady fabricate refine $PV "add churn_risk low/medium/high"
rady fabricate approve $PV -n 100 -o accounts.csv
rady chat
Interactive AI-assistant REPL.
Opens a chat session, starts a prompt_toolkit REPL with arrow-key history. User messages go to the assistant; responses render as Rich Markdown. Slash commands: /jobs (list), /approve (confirm a pending plan), /quit or Ctrl-D to exit. Sessions stay open server-side — resume with rady chat.
rady chat
rady chat --mode scada # stay on SCADA simulations
rady chat --mode ics # stay on ICS attacks
Generation engines
rady synthesize
Train + sample from your own dataset.
Runs Synthesis against an owned source dataset. The command submits a training-and-generation job, waits to terminal status, prints runtime, credits, and row count, then downloads the primary artefact. FHIR Bundle is a separate standards workflow, not a model selector on this command.
rady synthesize -d ds_a8f3b21c -n 10000
rady synthesize -d ds_a8f3b21c -n 1000 --seed 91 --output customers.csvrady scada simulate
Virtual SCADA run against a named plant template.
67 plant templates available (see `rady scada plants`). --ot-server activates the five live Virtual SCADA protocols (Modbus / DNP3 / OPC-UA / MQTT / BACnet) and enables the streaming-surcharge price path. Enterprise VPLC adds IEC 61850 as the sixth protocol capability.
rady scada simulate --plant tank_farm_07 --duration 4
rady scada plants # list available plants
rady ics attack
Run a MITRE ATT&CK ICS technique on a plant.
42 ATT&CK for ICS technique IDs can appear in a bundle; 32 ship bespoke generators. Each run produces a labelled cyber-range bundle: pcapng + ground-truth.ndjson + signals.parquet + sealed Sigma/Snort/Suricata/YARA detection rules derived from the event types.
rady ics attack --plant tank_farm_07 --technique T0832
rady ics techniques # list supported techniques
rady ads new
Kick off an Agentic Data Scientist run from an English goal.
Creates a project, (by default) waits for the plan to reach awaiting_approval, then prints the step table. Approve with `rady ads approve <project>` to start execution. HAGP gate preserved.
rady ads new -g "Profile customers dataset, engineer tenure + spend, train churn model, SHAP drivers"
rady ads list
rady ads approve <project>
Contracts & inputs
rady seals
sealed contract lifecycle — create, list, validate.
Seals are immutable sealed contracts. create takes a local JSON file + engine + mode and returns the sealed ID. validate runs the same schema + satisfiability check as server pre-flight, without creating state or consuming credits.
rady seals list
rady seals create ./contract.json
rady seals validate ./contract.jsonrady scenarios fabricate
A facility description → a sealed scenario pack, in one command.
Describe an industrial facility and get back a sealed SCADA scenario pack: its asset types, its sensor catalogue with engineering units and alarm limits, and the seal hash that pins it. Writes the pack JSON to --output when supplied so you can version it or feed it to `rady scada simulate --plant <pack_id>`. The pack is also kept in your workspace, so `rady scenarios packs` lists it afterwards. Charged to your credit balance like any other fabrication — the command prints what it cost.
rady scenarios fabricate -d "a municipal wastewater plant with screening, aeration and clarification" -o ./pack.json
rady scenarios packs # list scenario packs (plants / attack templates / FHIR profiles)rady datasets upload
Upload a local CSV / JSON / Parquet as a dataset.
Returns a dataset ID you can feed straight to `rady synthesize -d <id>`. preview / analyze / list subcommands round out the dataset lifecycle.
rady datasets upload customers_q3.csv
rady datasets list
rady datasets preview ds_7a12Job lifecycle
rady jobs list
Recent jobs in reverse-chronological order.
Color-coded status column (running / succeeded / failed / cancelled), short-form IDs for easy copy-paste, plus a next-step hint pointing at rady jobs get.
rady jobs list
rady jobs list --limit 50rady jobs quote
Price a job before submitting it.
Asks the platform's pricing authority for the credits a job will reserve. Learned Synthesis quotes price the workload at the resolved compute tier; healthcare_fhir quotes price the deterministic resource projection for the given seed and generator options (FHIR is metered per delivered resource, so --rows is the patient count and the projection is shown per resource type). Nothing is reserved by quoting.
rady jobs quote --kind synthesize --dataset-id 91dd078e-... --rows 10000
rady jobs quote --kind synthesize --engine healthcare_fhir --rows 100 --seed 42
rady jobs quote --kind synthesize --engine healthcare_fhir --rows 100 --seed 42 -o encounters_per_patient_mean=4rady jobs get
Full detail for one job.
Short or full job ID accepted. Shows kind, engine, status, progress, dataset, seal, started/finished timestamps, and any error_code / error_detail.
rady jobs get a8f3b21c
rady jobs get 91dd078e-... rady jobs wait
Block until terminal status.
Polls every --poll seconds (default 4) until the job hits succeeded / failed / cancelled. Exits non-zero if the job failed or timed out.
rady jobs wait a8f3b21c
rady jobs wait a8f3b21c --poll 2 --timeout 900rady jobs cancel
Cancel a queued or running job.
Prompts for confirmation unless --yes is passed. No-op on terminal (succeeded / failed / cancelled) jobs.
rady jobs cancel a8f3b21c
rady jobs cancel a8f3b21c --yesrady jobs artifacts
List the artefacts a completed job produced.
Prints id, name, row count, and MIME for every artefact. Use the ID with rady jobs download to fetch content.
rady jobs artifacts a8f3b21crady jobs download
Download an artefact by ID.
Writes the artefact content to --output (or stdout with -o -). Content is typed as string (CSV / JSON — MIME comes from the /artifacts listing).
rady jobs download a8f3b21c d7c922f0 -o ./out.csv
rady jobs download a8f3b21c d7c922f0 -o - # pipe to jq, wc, etc.rady jobs evidence
Sealed evidence-bundle summary.
Shows bundle ID, seal hash, contract hash, data hash, determinism proof, and creation timestamp. For full offline verification use evidence verifier (ships with the SDK).
rady jobs evidence a8f3b21cEvidence
rady evidence verify
Fully offline bundle verification — no network, no API key.
Verifies BLAKE3 integrity + optional Ed25519 signature using the public cryptographic primitives in the SDK. Reports integrity, signature status, Merkle root, bundle hash. Exit 0 on verify-OK, 1 on mismatch. No API key required — runs fully offline.
rady evidence verify ./bundle.json
rady evidence verify ./bundle.json --public-key /etc/trust/customer.pub
rady evidence get <job-id> # fetch a bundle summary from the server
Account & integration
rady usage
Credits available, used this month, plan, renewal.
Top-level `rady usage` with no subcommand shows the current billing period summary. `rady usage plans` lists the billing plans you can upgrade to.
rady usage
rady usage plans
rady webhooks
HTTPS webhook delivery with HMAC signature.
create enforces HTTPS + refuses private / loopback URLs (matches server-side SSRF guard). test sends a signed delivery and returns the response status + latency. Signing secret shown plaintext ONCE on create.
rady webhooks create --url https://acme.example/hooks --events job.succeeded,job.failed
rady webhooks test wh_1a8f
rady webhooks deliveries wh_1a8f