Docs
amfelt doctor
Diagnose the agent’s install + posture.
Run a read-only posture check on this agent install.
The doctor subcommand verifies:
* Identity files (key, agent_id, org_id) are present and loadable.
* The key-storage tier (T1 filesystem vs T2 OS keyring) and its
posture contract (file permissions for T1).
* The Amfelt API is reachable at AMFELT_API_ENDPOINT, else at
api-endpoint in the config file, else at the endpoint remembered when
the agent registered (never the default).
* The API's security-posture endpoint agrees with this agent's
self-reported tier.Exit codes:
0 overall PASS or WARN — the install is operational.
1 at least one check FAILED — remediate before running syncs.
2 doctor itself could not build the config — check env vars.Use --json in CI to parse the report. --include-unregistered runs the
partial suite before an agent has been registered (skips identity +
posture checks).
Usage
amfelt doctor [flags]Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--include-unregistered | bool | false | run the partial suite before an agent has been registered |
--json | bool | false | emit the report as JSON |
--timeout | duration | 5s | HTTP reachability timeout for the api + posture probes |
Global flags
| Flag | Type | Default | Description |
|---|---|---|---|
--amfelt-dir | string | .amfelt | directory for workspace files (such as plugins); does not move agent identity (controlled by AMFELT_DIR) |
--config | string | — | directory or filename of the application configuration |
-f, --format | string | default | log format to use; either default, pretty, or json |
-l, --level | string | info | minimum log level to display; either error, warn, info, or debug |
-v, --verbose | bool | false | trigger to use verbose logging |
Generated from amfelt v5.6.3.
Last updated on November 1, 2026