Skip to content

Global Flags

These flags are available on every bnerd command.

Connection & Authentication

Flag Type Default Description
--config string $HOME/.bnerd.yaml Path to config file
--api-url string https://api.bnerd.cloud CloudAPI base URL
--token string Bearer token for authentication
--org-id string Organization ID
--project-id string Project ID (required for project-scoped resources)
--region string de-muc1 Cloud region

Output

Flag Type Default Description
-o, --output string table Output format: json, table, or yaml
--debug bool false Enable debug output (shows HTTP requests)

AI Features

Flag Type Default Description
--anthropic-key string Anthropic API key for AI features
--ai-model string haiku AI model: haiku, sonnet, opus, or a full model ID
--ai-mode string read-only AI safety mode: read-only, non-destructive, full
--ai-provider string anthropic AI provider: anthropic or openai
--openai-key string API key for OpenAI-compatible backend
--openai-base-url string Base URL for OpenAI-compatible backend (e.g., http://localhost:11434)
--openai-model string Model name for OpenAI-compatible backend (e.g., gpt-4o, llama3.2)
--ai-shell-unrestricted bool false Allow AI to run arbitrary shell commands (not just allowlist)
--ai-token-budget int 0 Max tokens per AI session (0 = unlimited)

Sandbox

Flag Type Default Description
--isolate string (off) Run AI-bearing commands in a filesystem-isolated sandbox. Values: on (default mounts including ~/.kube/config) or strict (omits kubeconfig). Bare --isolate implies on. Has no effect on non-AI commands (e.g. VPN, zones list) — those print a warning and run unsandboxed.

See AI isolation guide for runtime prerequisites, the mount table, and the threat model.

Notes

  • All flags can also be set via the config file or environment variables
  • Flag values take highest priority, overriding environment variables and config file values
  • Use --debug to troubleshoot authentication or API connectivity issues