Commands

The endura CLI controls the Runtime Sensor, jobs, policies, and license.

endura <command> [subcommand] [options]

Command	Purpose
`endura sensor`	Start, stop, inspect, and read the Sensor
`endura job`	Start, inspect, list, and stop monitored jobs
`endura policy`	Validate a file or print a running job’s policy
`endura license`	Verify and inspect the configured license
`endura version`	Print the installed version

Every command supports --help. Sensor configuration comes from the environment variables, not global CLI options.

endura sensor

endura sensor start

Start the Sensor and load its eBPF programs. Requires root.

Option	Default	Description
`-d`, `--daemon`	`false`	Fork into the background and return after the Sensor is ready.

sudo endura sensor start -d

Containerized Sensors run in the foreground because the Sensor is the container’s main process. Native startup normally takes 15 to 20 seconds while eBPF programs load.

endura sensor wait

Wait until the Sensor has loaded eBPF programs and is accepting control-socket requests. It prints ok on success.

Option	Default	Description
`-t`, `--timeout <DURATION>`	`1m`	Maximum wait, using a suffix such as `30s`, `2m`, `1h`, or `1d`.

Use this readiness barrier before starting a job:

endura sensor wait && endura job start --workspace "$WORKSPACE"

No root privilege is required.

endura sensor status

Print one of three active states:

Output	Meaning
`active (online, N/M hooks attached)`	The Sensor is running and Team Server accepted its latest status, or the Sensor is standalone.
`active (offline, ...)`	The Sensor is enforcing but its latest Team Server status update failed. The output includes the cause.
`active (incompatible: team server <version>, ...)`	Team Server is reachable but its major version differs. Enforcement continues and submission pauses.

The Sensor updates the Team Server verdict every 15 seconds. sensor status reads the cached verdict and returns immediately. It exits nonzero only when the Sensor is not running.

The hook count summarizes coverage. Root can run endura sensor hooks for individual programs.

endura sensor stop

Stop all jobs, then stop the Sensor. Requires root. Derive-mode jobs print their derived policies while stopping.

Option	Default	Description
`--exit-zero`	`false`	Report an error but exit `0`.

endura sensor logs

Read Sensor logs. Requires root because logs contain telemetry from every user.

Option	Default	Description
`-f`, `--follow`	`false`	Stream new records.
`-n`, `--number-of-records <N>`	`30`	Number of records to print.

endura sensor hooks

List each loaded eBPF program and whether it attached. Requires root.

Column	Meaning
`PROGRAM`	eBPF program name
`HOOK`	Target LSM or fentry hook
`SECTION`	ELF section
`STATE`	`attached`, `unattached`, or `unloaded`
`ERROR`	Kernel error for an unattached or unloaded program

sudo endura sensor hooks

An unattached or unloaded row means that event class is not enforced on the host.

endura job

Job commands identify a job by its 16-digit hexadecimal ID or workspace path. If neither is provided, the CLI detects the current CI/CD workspace.

endura job start

Start monitoring a workspace and print its job ID.

Option	Default	Description
`-m`, `--mode <MODE>`	policy mode	Override with `derive`, `observe`, or `enforce`.
`-p`, `--policy <PATH>`	`./.endura/policy.json`, then built-in derive policy	Policy to validate and apply.
`-w`, `--workspace <PATH>`	detected checkout	Workspace to monitor.

endura job start --workspace "$WORKSPACE"

Starting a job on a workspace that already has one replaces it after validation. Use the same start command when a workspace needs a new policy or mode.

Every workspace must exist. A non-root user may start a job only for a workspace owned by that user. Root bypasses the ownership check, not the existence check.

endura job stop

Stop a job. A derive-mode job prints its pruned policy.

Option	Default	Description
`-p`, `--policy <PATH>`	—	Write the resulting policy to a file.
`--exit-zero`	`false`	Report an error but exit `0`.
`--all`	`false`	Stop all authorized jobs.
`--after <TIMESTAMP>`	—	With `--all`, select jobs started after this Unix timestamp.
`--duration <DURATION>`	—	With `--all`, select jobs running longer than this duration.

On job start, --policy is an input. On job stop, it is an output.

# Stop by workspace.
endura job stop /workspace

# Save a derived policy.
endura job stop /workspace --policy .endura/policy.json

# Stop jobs older than two hours.
endura job stop --all --duration 2h

--all, --after, and --duration cannot be combined with a positional job value.

endura job status

Print active when the selected job exists. Otherwise, exit nonzero.

endura job list

List authorized running jobs with ID, UID, KIND, MODE, STARTED, and WORKSPACE columns.

endura policy

endura policy validate

Validate policy JSON and rule semantics without starting a job:

endura policy validate .endura/policy.json

Success prints <path>: valid (mode:<mode>). Errors include file, line, column, and a caret at the invalid value.

endura policy describe

Print the policy used by a running job. Pass its 16-digit job ID:

endura policy describe 3f9a1c7e5b2d8046

A derive-mode policy is pruned before output.

endura license

endura license verify

Validate ENDURA_LICENSE_KEY. Success prints ok.

endura license info

Print license details as JSON. The Sensor warns within 90 days of expiration.

endura version

Print <version>+<build>, for example 1.0.3+a1b2c3d. Compatibility compares only the semantic major.minor.patch version; build metadata after + has no effect.

Policy Modes

Mode	Behavior
`derive`	Observe activity and build a policy. This is the default.
`observe`	Report violations without blocking.
`enforce`	Block violations and, by default, terminate the offending task.

Authorization

Command	Authorized caller
`sensor status`, `sensor wait`	Any local user
`sensor start`, `sensor stop`, `sensor logs`, `sensor hooks`	Root
`job start`	Workspace owner or root
`job list`, `job status`, `job stop`, `policy describe`	Job owner or root

For a containerized Sensor, host PID visibility and ENDURA_PROC_PATH=/host/proc are required for workspace authorization. See Configuration.

Exit Codes

Commands exit nonzero on errors. Two controls override this:

ENDURA_EXIT_ZERO=true affects every command.
--exit-zero affects only endura sensor stop and endura job stop.

Errors still print to standard error.

Configuration