CLI Reference

Commands

Command	Description
decepticon	Start all services, open the terminal UI, and print the web dashboard URL
decepticon onboard	Interactive setup wizard (provider, API key, model profile, LangSmith)
decepticon onboard --reset	Reconfigure even if .env already exists
decepticon stop	Stop all services
decepticon status	Show service status
decepticon logs [service]	Follow service logs (default: langgraph)
decepticon kg-health	Diagnose the Neo4j knowledge graph
decepticon update	Explicitly refresh config files, Docker images, and the launcher binary when a release is available
decepticon remove	Uninstall Decepticon completely
decepticon --version	Show installed version

Web dashboard is dynamic-spawn — it does not come up with the default stack. Start it from inside the CLI with the /web slash command (which runs docker compose --profile web up -d web), then open http://localhost:3000 (configurable via WEB_PORT in .env). See Web Dashboard.

decepticon logs — Service names

decepticon logs             # langgraph (default)
decepticon logs litellm     # LiteLLM proxy
decepticon logs postgres    # PostgreSQL
decepticon logs neo4j       # Neo4j graph database
decepticon logs sandbox     # Kali Linux sandbox
decepticon logs web         # Web dashboard

---

Interactive Terminal UI

The interactive CLI is built with React 19 + Ink. It streams events from LangGraph in real time.

Keyboard Shortcuts

Key	Action
Ctrl+O	Toggle Prompt ↔ Transcript mode
Ctrl+G	Cycle graph sidebar: Overview → Nodes → Flows
Ctrl+B	Toggle graph sidebar visibility
Ctrl+C	Cancel active stream / exit transcript / exit app
Esc	Exit transcript mode

View Modes

Prompt Mode (default)

• Compact view suitable for monitoring
• Sub-agent sessions collapsed
• Consecutive tool calls from the same agent are grouped
• Shows current objective and streaming agent output

Transcript Mode (Ctrl+O)

• Full event history
• Complete tool inputs and outputs
• All sub-agent details expanded
• Useful for debugging and reviewing what the agent actually did

Graph Sidebar

The right-side panel visualizes the live Neo4j attack graph:

View	Content
Overview	High-level graph summary (node/edge counts, top hosts)
Nodes	Individual node list with type and properties
Flows	Attack chain paths discovered so far

Cycle with Ctrl+G, hide/show with Ctrl+B. A Web Canvas auto-starts for pan/zoom interaction.

Slash Commands

Available inside the interactive terminal UI:

Command	Aliases	Description
/help	/?	Show available commands and shortcuts
/clear		Clear conversation history
/file <path>	/f	Load a prompt from a file and send it
/resume [message]	/r, /continue	Resume a paused run or continue previous session
/model		Show or change the LLM model for this session
/agent		Show or switch the active orchestrator for this session
/plugins	/plugin	List or toggle agent plugin bundles
/web [up|down|url]	/dashboard	Start, stop, or print the URL of the web dashboard
/quit	/exit	Exit the CLI

---

Environment Variables

These can be set in your .env file (configure with decepticon onboard) or as shell environment variables.

Required (at least one LLM key)

Variable	Description
ANTHROPIC_API_KEY	Anthropic Claude API key
OPENAI_API_KEY	OpenAI API key (fallback)
GEMINI_API_KEY	Google Gemini API key (fallback)
MINIMAX_API_KEY	MiniMax API key (fallback)

Model Configuration

Variable	Default	Description
DECEPTICON_MODEL_PROFILE	eco	Tier preset: eco (per-agent), max (all HIGH), or test (all LOW)
DECEPTICON_AUTH_PRIORITY	(built-in order; see Models)	Comma-separated AuthMethod priority — first method primary, rest are fallbacks. When unset, the factory's built-in _DEFAULT_AUTH_PRIORITY order applies. Methods whose credential isn't configured are skipped at runtime.
DECEPTICON_AUTH_CLAUDE_CODE	false	Set true to route Anthropic models via Claude Code OAuth (auth/claude-* in LiteLLM)
DECEPTICON_AUTH_CHATGPT	false	Set true to route OpenAI models via ChatGPT subscription OAuth (auth/gpt-*)
DECEPTICON_AUTH_GEMINI	false	Set true to route Google models via Gemini Advanced OAuth (gemini-sub/*)
DECEPTICON_AUTH_COPILOT	false	Set true for Microsoft Copilot Pro OAuth (copilot/*)
DECEPTICON_AUTH_GROK	false	Set true for xAI SuperGrok OAuth (grok-sub/*)
DECEPTICON_AUTH_PERPLEXITY	false	Set true for Perplexity Pro OAuth (pplx-sub/*)
OLLAMA_API_BASE / OLLAMA_MODEL	unset	When set, registers ollama_chat/<OLLAMA_MODEL> and enables the ollama_local AuthMethod

See Models for the full Tier × AuthMethod matrix and chain examples.

Infrastructure

Variable	Default	Description
LITELLM_MASTER_KEY	sk-decepticon-master	LiteLLM proxy auth key
LITELLM_SALT_KEY	sk-decepticon-salt-change-me	LiteLLM salt (change in production)
POSTGRES_PASSWORD	decepticon	PostgreSQL password
NEO4J_PASSWORD	decepticon-graph	Neo4j password

Ports (optional)

Variable	Default	Description
LANGGRAPH_PORT	2024	LangGraph API server port
LITELLM_PORT	4000	LiteLLM proxy port
POSTGRES_PORT	5432	PostgreSQL port
WEB_PORT	3000	Web dashboard port
TERMINAL_PORT	3003	Terminal WebSocket bridge for the embedded CLI

Neo4j ports (7474 browser, 7687 bolt) are fixed in docker-compose.yml.

C2 Framework

Variable	Default	Description
COMPOSE_PROFILES	(empty)	Explicit profile override. Leave empty for normal use — heavyweight workloads are spawned on demand by the orchestrator via ops_start(...) (ADR-0006).

Set explicitly only when you want a workload up at launch — e.g. COMPOSE_PROFILES=cli,c2-sliver,ad,reversing for CI regression runs against the whole matrix.

Currently allowlisted workloads (the agent can call ops_start("X") for any of these): ad, c2-sliver, c2-havoc, reversing, cloud, mobile, phishing, forensics, ics, iot, supply-chain, wireless. Future C2 frameworks (Havoc, Mythic) plug in as additional c2-* profile services.

Observability (optional)

Variable	Description
LANGSMITH_TRACING	Set to true to enable LangSmith tracing
LANGSMITH_API_KEY	LangSmith API key
LANGSMITH_PROJECT	LangSmith project name (default: decepticon)

Debug

Variable	Description
DECEPTICON_DEBUG	Set to true for verbose debug output