Command Reference

The root command is shield360. Run shield360 --help or shield360 <command> --help for inline usage at any time.

shield360
├── coding        Coding-agent observability (Claude Code, Cursor, Codex)
│   ├── install     Install per-vendor host plugin manifests
│   ├── launch      Bootstrap the plugin for an agent and exec it
│   ├── uninstall   Remove per-vendor host plugin manifests
│   └── hook        Process a hook event (invoked by host plugins)
├── configure     Write persistent settings to config.env
├── doctor        Diagnose config, OTLP reachability, and plugins
└── version       Print the CLI version

shield360 coding

Coding-agent observability for Claude Code, Cursor, and Codex. See the Coding Agents setup guide for the full vendor-by-vendor walkthrough.

shield360 coding install

Install the per-vendor host plugin manifest. Idempotent - re-running drops prior shield360 entries before re-writing, leaving any third-party entries in place.

shield360 coding install --vendor=claude-code
shield360 coding install --vendor=all --dry-run   # preview without writing

Flag	Description
--vendor (required)	claude-code | cursor | codex | all
--dry-run	Print what would be written without modifying any files

Where manifests are written:

Vendor	Manifest path
Claude Code	~/.claude/plugins/shield360-cc/
Cursor	~/.cursor/hooks.json (user scope, merged)
Codex	~/.codex/plugins/shield360/

shield360 coding launch

Bootstrap the plugin for an agent and exec it - telemetry on from the first turn. Auto-installs the manifest if needed.

shield360 coding launch claude
shield360 coding launch cursor -- <agent-args...>   # pass args through after --
shield360 coding launch codex

Argument	Description
<agent> (required)	claude | claude-code | cc | cursor | codex (claude-code and cc are aliases for claude)

Any arguments after -- are forwarded to the agent’s own CLI.

shield360 coding uninstall

Remove the per-vendor plugin manifests written by install. Best-effort deregisters the plugin from the vendor’s own CLI where applicable. Leaves your shared config alone unless --purge is passed.

shield360 coding uninstall --vendor=cursor            # one vendor
shield360 coding uninstall --vendor=all               # every vendor
shield360 coding uninstall --vendor=all --purge       # also drop ~/.config/shield360 + session cache
shield360 coding uninstall --vendor=cursor --dry-run  # preview without touching disk

Flag	Description
--vendor (required)	claude-code | cursor | codex | all
--purge	Also remove ~/.config/shield360 and the session-state cache
--dry-run	Print what would be removed without modifying any files

shield360 coding hook

Note

You will almost never run this yourself. The host plugin manifests written by shield360 coding install invoke it once per agent event, piping the event payload on stdin.

shield360 coding hook --vendor=claude-code --event=SessionStart < payload.json

Flag	Description
--vendor (required)	cc | claude-code | cursor | codex
--event	Hook event name (vendor-specific; e.g. SessionStart, PreToolUse)

The hook is crash-isolated: a 5-second hard timeout (~3s reserved for OTLP flush) and it always exits 0 even when telemetry fails - a broken pipeline never blocks your coding session. It never writes to stdout (agents like Claude Code parse stdout for JSON). Set SHIELD360_DEBUG_PAYLOAD_DIR to tee raw payloads for debugging.

shield360 configure

Write persistent settings to ~/.config/shield360/config.env. See Configuration for the full flag table, precedence, and content-capture modes.

shield360 configure --endpoint https://shield360.example.com:4318 --api-key $SHIELD360_API_KEY
shield360 configure --show   # print resolved config and its source, write nothing

shield360 doctor

Diagnose the CLI’s setup. Reads the resolved config, TCP-dials the OTLP endpoint (2s timeout), and lists installed vendor plugins.

shield360 doctor

Exit code 0 means the CLI is wired up (possibly with warnings); 1 means at least one check failed. This is the first thing to run when something isn’t showing up on /agents.

shield360 version

Print the CLI version and build commit.

shield360 version
# shield360 v1.2.3 (abc1234)

Reserved (future) commands

The CLI is built to grow into Shield360’s full control plane. These command groups are reserved in the codebase and will land in future releases:

Command	Planned subcommands
shield360 prompts	pull, push, list, diff
shield360 traces	tail, query, export
shield360 eval	run, list
shield360 migrate	-

Note

These are not available yet. They are documented here only to signal the CLI’s direction - new groups plug in by registering on the root command without breaking the coding-agent integration.