Skip to content
runok runok runok

CLI Overview

runok provides subcommands for initializing configuration, evaluating commands, and executing them against your permission rules.

Commands

Section titled “Commands”

runok init

Section titled “runok init”

Initialize runok configuration with an interactive setup wizard. Detects existing Claude Code Bash permissions and offers to migrate them to runok rules.

runok check

Section titled “runok check”

Evaluate a command against your rules and report the decision — without executing it. Useful for previewing what runok would do, or for integrating with external tools like Claude Code hooks.

runok exec

Section titled “runok exec”

Evaluate a command against your rules and, if allowed, execute it — optionally within a sandbox.

runok audit

Section titled “runok audit”

View and filter audit log entries. Every exec and hook evaluation is logged automatically, and this subcommand lets you query those entries by time range, action, or command.

runok test

Section titled “runok test”

Run test cases defined in your configuration to verify that rules produce the expected decisions. Supports inline per-rule tests and a top-level tests section for cross-rule validation.

runok update-presets

Section titled “runok update-presets”

Force-update all remote presets referenced via extends, bypassing the TTL-based cache. Shows a diff for each preset that changed.

Section titled “Related”
  • Denial feedback — Configure message and fix_suggestion for denied commands.