# CLI reference > Commands, flags, output modes, and exit behavior for the Renart CLI. The `renart` binary contains the workspace and its command-line workflows. Run `renart --help` or `renart --help` for the exact reference shipped with your installed version. ## Commands | Command | Purpose | | ------------------- | -------------------------------------------------------------------------------------- | | `renart` | Start the desktop app; fall back to the browser when the native helper is unavailable. | | `renart web` | Start the browser-based IDE. | | `renart standalone` | Start the desktop app explicitly. | | `renart mcp` | Serve workspace-scoped notebook tools to a local coding agent over stdio. | | `renart run` | Execute a pipeline or asset. | | `renart plan` | Review readiness, selection, and planned operations without executing. | | `renart render` | Preview the saved operations for one asset without executing. | | `renart ls` | List pipelines or assets. | | `renart type-check` | Validate a pipeline’s saved assets and custom SQL checks. | | `renart deploy` | Snapshot a pipeline for scheduled execution. | | `renart init` | Scaffold a project. | | `renart telemetry` | Inspect or change application usage analytics for your operating-system user. | | `renart secrets` | Manage write-only connection credentials and scoped child-process access. | Pipeline commands walk up from the current directory to find the project. Use `--workspace` on commands that support it to select another project explicitly. ## Exit codes | Code | Meaning | | ---- | -------------------------------------------------------------------------------- | | `0` | The command completed successfully. | | `1` | Execution, planning, rendering, or validation completed with a blocking failure. | | `2` | The arguments or selected target are invalid. | ## `renart web` ```bash renart web [options] [workspace root] ``` | Flag | Default | Meaning | | ------------------------------- | ------------------ | -------------------------------------------------------------------------- | | `--static-dir` | `web/dist` | Override the directory containing static web assets. | | `--watch-mode` | `auto` | Workspace watcher: `auto`, `fsnotify`, or `poll`. | | `--watch-poll-interval` | `2s` | Poll interval used by `poll` and by the polling fallback in `auto`. | | `--scheduler` | on | Run the local in-process scheduler; use `--scheduler=false` to disable it. | | `--scheduler-state` | `.renart/state.db` | Scheduler SQLite state path. | | `--notebook-snapshot-max-bytes` | `2147483648` | Maximum staged size for one notebook source snapshot. | | `--notebook-snapshot-timeout` | `30m` | Maximum runtime for one notebook source snapshot. | | `--host` | `127.0.0.1` | Interface to bind. A non-loopback host requires `--unsafe-allow-remote`. | | `--port` | `8080` | HTTP port; Renart selects the next free port when it is occupied. | | `--unsafe-allow-remote` | off | Allow an unauthenticated non-loopback listener. Prefer a local tunnel. | | `--tls-cert` | | TLS certificate path; use with `--tls-key`. | | `--tls-key` | | TLS private-key path; use with `--tls-cert`. | | `--no-open` | off | Do not open the default browser after startup. | ## `renart standalone` ```bash renart standalone [options] [workspace root] ``` `renart standalone` starts the same embedded server as `renart web` and opens it with the optional `renart-gui` helper installed beside the CLI. If the platform webview is unavailable, it opens the browser instead. | Flag | Default | Meaning | | ------------------------------- | ------------------ | --------------------------------------------------------------------------------------------------------- | | `--static-dir` | `web/dist` | Override the directory containing static web assets. | | `--watch-mode` | `auto` | Workspace watcher: `auto`, `fsnotify`, or `poll`. | | `--watch-poll-interval` | `2s` | Poll interval used by `poll` and by the polling fallback in `auto`. | | `--scheduler` | on | Run the local in-process scheduler; use `--scheduler=false` to disable it. | | `--scheduler-state` | `.renart/state.db` | Scheduler SQLite state path. | | `--notebook-snapshot-max-bytes` | `2147483648` | Maximum staged size for one notebook source snapshot. | | `--notebook-snapshot-timeout` | `30m` | Maximum runtime for one notebook source snapshot. | | `--port` | `0` | Loopback port; `0` selects a free port. | | `--gui-binary` | beside `renart` | Override the native-helper path. The `RENART_GUI_BINARY` environment variable provides the same override. | ## `renart mcp` ```bash renart mcp [--workspace ] ``` `renart mcp` is a stdio protocol process intended to be launched by a local MCP client. It discovers the Renart server that owns the workspace and otherwise starts the notebook service in-process. Standard output is reserved for MCP JSON-RPC; diagnostics use standard error. The command exposes bounded notebook reads, reviewed semantic change sets, and explicit run/cancel/status tools. It does not expose generic filesystem, shell, Git, secret, SQL, HTTP, or REST forwarding. See [Notebook agents](https://getrenart.com/docs/notebooks/agents.md) for setup examples and the complete authority boundary. | Flag | Default | Meaning | | ------------- | ---------- | ---------------------------------------------------- | | `--workspace` | discovered | Pin the stdio server to one Git-backed project root. | ## `renart run` ```bash renart run [options] [pipeline, asset name, or path] ``` Without a target, the command runs the pipeline enclosing the current directory. When the IDE already has the same project open, the command delegates to that local server; `--local` bypasses it. ```bash renart run renart run retail renart run analytics.daily_revenue renart run analytics.customer_orders --downstream ``` | Flag | Default | Meaning | | ----------------------- | -------------------- | -------------------------------------------------------------------------------------------- | | `--workspace` | discovered | Select a project root. | | `--env` | selected environment | Environment to execute against. | | `--start-date` | schedule window | RFC 3339 start timestamp for the execution window. | | `--end-date` | schedule window | RFC 3339 end timestamp for the execution window. | | `--downstream` | off | Asset targets only: include every downstream asset. | | `--refresh-upstreams` | off | Asset targets only: build stale transitive upstreams first. | | `--full-refresh` | off | Rebuild from scratch instead of using the saved incremental strategy. | | `--sensor-mode` | `once` | Sensor behavior: `once`, `wait`, or `skip`. | | `--confirm-environment` | | Supply the environment name when its policy requires explicit confirmation. | | `--local` | off | Execute in-process even when the IDE is open. `RENART_NO_SERVER` provides the same override. | | `--json` | off | Emit JSON Lines events. | | `--quiet`, `-q` | off | Suppress streamed output and print only the final status. | ## `renart plan` ```bash renart plan [options] [pipeline, asset name, or path] ``` The default selection contains assets that need work. Pass an asset to plan its closure, `--all` for the whole pipeline, or `--selector` for an expression. ```bash renart plan retail renart plan retail --all renart plan retail --selector 'tag:daily,+analytics.daily_revenue' renart plan analytics.daily_revenue --upstream ``` | Flag | Default | Meaning | | ------------------------- | -------------------- | ----------------------------------------------------------------------------------------- | | `--workspace` | discovered | Select a project root. | | `--env` | selected environment | Environment whose configuration and policy to use. | | `--start-date` | schedule window | RFC 3339 start timestamp for the planned window. | | `--end-date` | schedule window | RFC 3339 end timestamp for the planned window. | | `--execution-time` | now | RFC 3339 timestamp used by templates. | | `--source` | working tree | Saved source: `working-tree` or `snapshot`. | | `--snapshot` | | Exact deployment version; implies `--source snapshot`. | | `--all` | off | Plan every asset instead of only assets that need work. | | `--selector` | | Pipeline targets only: select assets with an expression. | | `--selector-needed` | off | With `--selector`, retain only matching assets that need work. | | `--upstream` | off | Asset targets only: include upstream dependencies. | | `--downstream` | off | Asset targets only: include downstream dependents. | | `--full-refresh` | off | Preview the effective full-refresh form. | | `--backfill` | off | Mark an explicit single-asset window as a backfill. | | `--sensor-mode` | `once` | Sensor behavior: `once`, `wait`, or `skip`. | | `--include-stage-content` | off | Include rendered operation bodies in human output. | | `--local` | off | Plan in-process even when the IDE is open. `RENART_NO_SERVER` provides the same override. | | `--json` | off | Emit the structured plan response as JSON. | ## `renart render` ```bash renart render [options] ``` The preview distinguishes compiled SQL, execution SQL, semantic operations, and runtime-only stages. It lists column and custom quality checks as named stages. Interactive output highlights structured stage bodies; redirected output and `--json` contain no ANSI formatting. Set `NO_COLOR=1` to disable color. ```bash renart render analytics.daily_revenue renart render analytics.daily_revenue --source snapshot --snapshot deployment-id renart render raw.customers --json ``` | Flag | Default | Meaning | | ------------------ | -------------------- | ------------------------------------------------------------------------------------------- | | `--workspace` | discovered | Select a project root. | | `--env` | selected environment | Environment whose render context to use. | | `--start-date` | schedule window | RFC 3339 start timestamp for the preview window. | | `--end-date` | schedule window | RFC 3339 end timestamp for the preview window. | | `--execution-time` | now | RFC 3339 timestamp used by templates. | | `--full-refresh` | off | Preview the full-refresh form when policy permits it. | | `--source` | working tree | Saved source: `working-tree` or `snapshot`. | | `--snapshot` | | Exact deployment version; implies `--source snapshot`. | | `--local` | off | Render in-process even when the IDE is open. `RENART_NO_SERVER` provides the same override. | | `--json` | off | Emit the structured render response as JSON. | ## `renart ls` ```bash renart ls [options] [pipelines|assets] [pipeline] ``` ```bash renart ls renart ls assets renart ls assets retail ``` | Flag | Default | Meaning | | ------------- | ---------- | ----------------------------- | | `--workspace` | discovered | Select a project root. | | `--json` | off | Emit JSON instead of a table. | ## `renart type-check` ```bash renart type-check [options] [pipeline name or directory] ``` Type-check validates dependencies, SQL columns and types, declared output schemas, materialization configuration, required declarations, and custom SQL checks. It exits with code `1` on errors. | Flag | Default | Meaning | | -------------- | --------------- | ---------------------------------------------------------- | | `--workspace` | discovered | Select a project root. | | `--start-date` | schedule window | RFC 3339 start timestamp for the template context. | | `--end-date` | schedule window | RFC 3339 end timestamp for the template context. | | `--json` | off | Emit the full report as JSON. | | `--strict` | off | Also exit with code `1` when the report contains warnings. | ## `renart deploy` ```bash renart deploy [options] [pipeline name or directory] ``` Creates the same immutable schedule snapshot as **Deploy** in Schedules. | Flag | Default | Meaning | | ------------- | ---------- | ---------------------- | | `--workspace` | discovered | Select a project root. | ## `renart init` ```bash renart init [options] [directory] ``` The directory defaults to the current directory. Renart initializes a Git repository when no repository encloses it. | Flag | Default | Meaning | | ------------ | ------- | -------------------------------------------------- | | `--template` | `empty` | Project template; `renart init --help` lists them. | The templates are the demos offered on the welcome screen: | Template | Contents | | ------------- | -------------------------------------------------------------------------------------------------------- | | `product` | Product analytics: synthetic events modelled into journeys, a funnel and daily activity in local DuckDB. | | `operations` | Operations monitoring: a query sensor gating device-health models in local DuckDB. | | `earthquakes` | Earthquake monitoring: USGS events over HTTP with several materialization strategies. | | `python` | Python risk scoring: SQL features scored in Python and aggregated back in SQL. | | `jinja` | Jinja workshop: variables, date windows, conditionals and generated SQL in local DuckDB. | | `chess` | Chess performance: player games and openings from the public Chess.com API. | | `retail` | Retail analytics: bundled CSV seeds loaded through Sling, which the first run downloads. | | `empty` | A minimal pipeline with one example SQL asset. | ## `renart secrets` Connection secret values are write-only. The CLI can replace a value, bind a field to an existing environment variable, inspect safe provider metadata, or remove a binding; it never prints or reveals the current value. ```bash renart secrets status [options] [connection] [field] renart secrets set [options] renart secrets remove [options] renart secrets exec [options] [args...] renart secrets vault ``` | Command | Purpose | | ----------------------------- | ---------------------------------------------------------------------------------------------------- | | `status [connection] [field]` | Show provider, reference, and configured/missing/locked status without resolving or printing values. | | `set ` | Replace a value through a hidden prompt or standard input. | | `remove ` | Remove the binding and any value Renart owns in its selected local store. | | `exec [args...]` | Resolve the selected environment for one child process. | | `vault status` | Show whether the project vault is uninitialized, locked, unlocked, or unavailable. | | `vault init` | Create the per-project encrypted vault. | | `vault unlock` | Unlock the vault inside the running Renart server. | | `vault lock` | Lock the vault inside the running Renart server. | | `vault change-passphrase` | Replace the passphrase of an unlocked vault. | Store a replacement in the operating system’s credential store. An interactive terminal shows a hidden prompt; automation can pipe the value through stdin: ```bash renart secrets set warehouse password printf '%s' "$NEW_PASSWORD" | renart secrets set warehouse password ``` Use the encrypted local vault when the operating-system credential service is unavailable. `init` prompts twice and creates a per-project encrypted file outside the repository. If a Renart server is running, initialization leaves its vault session unlocked; otherwise the new vault is locked when the command finishes. ```bash renart secrets vault init renart secrets vault unlock renart secrets set --store vault warehouse password renart secrets vault lock ``` `unlock`, `lock`, and `change-passphrase` manage the session in a running Renart web or standalone process. Other CLI commands use an isolated session and prompt when they need to open the vault. Hidden passphrase prompts require an interactive terminal. Automation can set `RENART_VAULT_PASSPHRASE` for one command; Renart removes that variable from children started by `secrets exec`. Unattended runs are usually better served by an environment binding. Restarting Renart locks the vault. For CI or a headless machine, bind the field to an environment variable without sending its value to Renart: ```bash renart secrets set warehouse password --from-env WAREHOUSE_PASSWORD renart secrets status warehouse password ``` `exec` resolves all managed connection secrets in the selected environment and adds their symbolic names only to one child process. Put the environment and workspace flags before the command: ```bash renart secrets exec --env production -- your-command --flag ``` The child can read the configured symbols; the parent environment, command arguments, and project files do not receive resolved values. Like any process given credentials, the child itself can read or print them, so use this only with commands you trust. | Subcommand flag | Default | Meaning | | ------------------------ | ------------------------ | ------------------------------------------------------------------------ | | `--workspace` | discovered | Select a project root. | | `--env`, `--environment` | selected environment | Select the connection environment. | | `status --json` | off | Emit provider/reference metadata as JSON. Values remain excluded. | | `set --store` | `credential-store` | Store a replacement in `credential-store` or `vault`. | | `set --from-env NAME` | unset | Record an environment-variable binding instead of reading a replacement. | | `remove --yes` | interactive confirmation | Confirm removal; required in non-interactive sessions. | | `vault status --json` | off | Emit vault state and secret count as JSON. Values remain excluded. | For the end-to-end UI workflow and source-selection guidance, see [Manage connection credentials](https://getrenart.com/docs/connections-environments/managing-credentials.md). ## `renart telemetry` These commands apply across projects, store preferences outside your repository, and print JSON. They do not require an open workspace. | Command | Purpose | | -------------------------- | ------------------------------------------------------------------------------------------- | | `renart telemetry status` | Show the saved preference and effective collection status, including environment overrides. | | `renart telemetry disable` | Disable collection and discard the local installation ID, if any. | | `renart telemetry enable` | Allow collection and acknowledge its explanation; environment opt-outs still take priority. | | `renart telemetry sample` | Print a synthetic payload without creating an identifier or sending an event. | | `renart telemetry reset` | Discard a local installation ID, if any; does not delete previously received data. | The current default uses no persistent installation ID and has no configured receiver. Enabling the preference alone does not activate collection. See [Security and privacy](https://getrenart.com/docs/reference/security-and-privacy.md#application-usage-analytics) for the payload and opt-out behavior. ## Related - [Work from the terminal](https://getrenart.com/docs/cli/work-from-terminal.md) - [Installation](https://getrenart.com/docs/installation.md) - [Runs and history](https://getrenart.com/docs/workspace/runs-and-history.md)