CLI: Admin ​

Run your workspace: people, keys, billing, audit and evidence.

bumpkit team ​

Manage workspace members and invitations.

Beta: roles ​

Beta, early access. Flag: roles.

team invite also takes --role, the role to join with (default member). The CLI can invite as member or viewer and can lower a role. A person signed in to the dashboard grants anything higher, and sends invitations when Bumpkit can't email them. See SSO, SCIM & Roles.

bumpkit keys ​

Manage API keys.

bumpkit keys create ci-pipeline --expires 2027-12-31

bumpkit billing ​

Credits used by release checks, for owners and admins. 1 credit = 1 release check = $0.10, re-runs of the same commit are free, and every workspace gets 60 free credits each calendar month (UTC).

# September's credits by who ran each check
bumpkit billing usage --period 2026-09 --by actor
# Every billable check in September as CSV
bumpkit billing usage --period 2026-09 --csv > bumpkit-usage-2026-09.csv

--json prints the same report as GET /v1/billing/usage, and the dashboard's Usage and billing page and the get_billing_usage MCP tool show the same numbers. Credit purchases aren't enabled yet; contact the Bumpkit team at hello@bumpkit.dev.

bumpkit settings ​

Workspace name and public changelog. See Changelog Pages.

settings set flags:

bumpkit settings set --changelog public --slug acme --repository https://github.com/acme/api
bumpkit settings set --publish-audience slack=support
bumpkit settings set --vulnerability-alerts reachable --auto-fix-prs critical_high

bumpkit audit ​

Show who changed what in the workspace, and from where (owners, admins and auditors).

Events show the action, time, actor, source and target. Large feature grants show a feature count; use --details for every granted feature, or --json for the complete records.

Beta: audit export and streaming ​

Beta, early access. Flag: siem_streaming.

Export the full audit trail for a period, or stream new audit events to your SIEM. See Compliance Evidence.

audit export needs a key created by an owner, admin or auditor. You get the whole period, not just the latest 500 events that bumpkit audit shows. Pass --days (1 to 730) or both --from and --to, not both. With neither, you get the last 90 days. A period with more than 50,000 events fails with 400 EXPORT_TOO_LARGE, so split it into shorter periods. The export is written to the audit log as audit.export.

audit streaming is for owners and admins. --kind is webhook, splunk, datadog or s3. Read the credential from a file, or pass --secret-file - to read it from standard input. It can be up to 512 bytes. Never put it in the URL. --config-file takes an optional JSON object of provider settings, up to 128 KiB, such as Splunk's index or S3's bucket and region. Only one of the two inputs can read standard input. Every command that sends data or changes a destination asks you to confirm; -y, --yes confirms up front.

bumpkit audit export --days 30 --format csv -o audit.csv
bumpkit audit streaming list

bumpkit auditors ​

Beta, early access. Flag: auditor_access.

Give an outside auditor read-only access to your evidence and audit events, through a link that expires. Owners and admins manage links. See Compliance Evidence.

LABEL names the auditor or audit firm, up to 64 characters. --days sets the expiry, 1 to 90 (default 30). Save the URL when you create the link. Bumpkit shows it only once, and anyone who has it can use it until it expires or you revoke it. -y, --yes confirms create and revoke without a prompt.

bumpkit auditors create "Audit firm" --days 30 --yes
bumpkit auditors list
bumpkit auditors revoke LINK_ID --yes

bumpkit evidence ​

Beta, early access. Flag: compliance_export.

Change-management evidence for audits. See Compliance Evidence.

Exporting needs a key created by an owner, admin or auditor. Other roles and keys not tied to a person, such as CI keys, get 403 ROLE_REQUIRED, and the refusal is in the audit log. In CI, export with an auditor's key.

evidence export flags:

bumpkit evidence export --from 2026-07-01 --to 2026-09-30 --format csv -o q3.csv

Beta: signed bundles ​

Beta, early access. Flag: signed_evidence.

evidence export --signed downloads a signed, tamper-evident bundle (zip) you can verify offline.

bumpkit evidence export --signed --days 365 -o evidence.zip
bumpkit evidence verify evidence.zip --public-key-file bumpkit-key.json

Beta: governance evidence ​

Beta, early access. Flag: governance_evidence.

evidence governance exports proof that each agent-written change got the human review your policy asks for: who wrote it, the approvals, the gate decision and any override review, with the gaps flagged. See Compliance Evidence.

It needs a key created by an owner, admin or auditor. Pass --days (1 to 730) or both --from and --to. With neither, you get the last 90 days. --format is json (the default) or csv. Without -o, the export goes to standard output; with it, the file gets owner-only permissions. Each export is written to the audit log.

bumpkit evidence governance --days 90 -o governance.json

bumpkit findings ​

Beta, early access. Flag: finding_feedback.

Teach Bumpkit which findings are real.

findings feedback takes --real (the finding is a real problem), --false-positive (the finding is wrong) and --reason (why, in a sentence). findings precision takes --days (default 90).

bumpkit incidents ​

Beta, early access. Flag: forensics.

Trace production errors to the release behind them. See Release Health & Forensics.

incidents report flags:

incidents list takes --limit (default 50, max 500). incidents resolve takes --version (the release that fixed it, like v2.3.1) and --sha (the commit of the fix, optional).

bumpkit incidents resolve 3f2c9a1e-8b7d-4c2a-9e1f-6a5b4c3d2e1f --version v2.3.1 --sha 4b7a1d2

bumpkit report ​

Beta, early access. Flags: leadership_dashboards, confidence_score.

Leadership report for a period: releases shipped, blocked, needing approval and overridden; the agent and human share of code and of incidents; and confidence and risk per repository and CODEOWNERS team. See Confidence Score & Leadership.

bumpkit report [flags]
bumpkit report [command]

report readiness flags: --repo (one repository; default every repository), --days (default 30), --from and --to (YYYY-MM-DD, together), --format (pdf, csv or json; default pdf) and -o/--output (file to write; default bumpkit-readiness.pdf for PDF, standard output otherwise). See Release readiness report. report risk flags: --limit (default 50, max 500), --repo (only this repository) and --scope (file, area or repository; default file). report outcome flags: --kind (revert, incident, hotfix or regression) and --note (what happened, kept in the audit record).

bumpkit report --from 2026-07-01 --to 2026-09-30 --csv > q3.csv

bumpkit scorecards ​

Beta, early access. Flag: agent_scorecards.

How each coding agent's changes fared.

bumpkit proven ​

Beta, early access. Flag: proven_changes.

Which kinds of change, in which part of each repository, ship without problems, with the backtest. bumpkit proven show AREA KIND lists one class's changes and problems. See Proven changes.

bumpkit compatibility ​

Beta, early access. Flag: compatibility_matrix.

Each supported version pair declared under compatibility in bumpkit.yml, with its verdict from recorded evidence: compatible, breaking or not checked. See Compatibility matrix.

bumpkit compatibility [--repository OWNER/NAME]
bumpkit compatibility show KEY
bumpkit compatibility export [--format csv|json] [--repository OWNER/NAME]
bumpkit compatibility sync [--repository OWNER/NAME] [--policy FILE]

Workspace domains and SCIM tokens ​

These commands use the signed-in workspace and the same owner or admin permissions as Settings → Single sign-on and SCIM, including the changes only an owner can make. They require a person-bound API key and the corresponding workspace feature access.

bumpkit domains list
bumpkit domains add example.com
bumpkit domains verify DOMAIN_ID
bumpkit domains remove DOMAIN_ID --yes
bumpkit scim tokens list
bumpkit scim tokens create Okta
bumpkit scim tokens revoke TOKEN_ID --yes

After adding a domain, domains list shows the exact DNS TXT name and value. Publish that record before running domains verify; verification performs the same DNS ownership check as the dashboard. Replace IDs with values returned by the list command. Removal and token revocation require interactive confirmation or --yes.

SCIM token creation prints the new secret once. Save it directly in your identity provider. Listing tokens returns only their prefix and metadata, including with --json. SSO configuration and SCIM group-role mapping are available with the commands below.

SSO configuration and SCIM group mappings ​

bumpkit identity sso view
bumpkit identity sso set --file sso.json --yes
bumpkit identity sso remove --yes
bumpkit identity sso unlink MEMBER_EMAIL --yes
bumpkit scim groups list
bumpkit scim groups set-role GROUP_ID viewer --yes
bumpkit scim groups set-role GROUP_ID none --yes

identity sso view returns configuration, callback and SAML metadata URLs, and whether a client secret is saved. Stored secrets are never returned. identity sso set accepts one JSON object from a file or stdin (--file -), never a secret command-line flag. Prepare the file privately with mode 0600; do not commit it. Use the supported fields: protocol (oidc or saml), enabled, enforced, jit, default_role, and the protocol's fields. OIDC uses issuer, client_id, and client_secret; SAML uses entity_id, sso_url, and certificate (PEM). Omitting an OIDC client secret preserves the saved secret. The response never echoes the secret supplied.

A person signed in to the dashboard sets up or changes the identity provider, turns single sign-on off, removes it, creates SCIM tokens, and grants any role above member. The CLI gets HUMAN_APPROVAL_REQUIRED for those and can make the other changes. SSO saves perform the same issuer discovery or SAML certificate validation as the dashboard. Enforcing SSO requires an enabled provider and at least one verified workspace email domain. The default role cannot be owner. Reading or updating settings through the CLI does not establish an SSO-authenticated browser session.

SCIM groups are provisioned by your identity provider. set-role updates the group's mapping and member permissions the same way the dashboard does, including revoking API keys when required after a downgrade. Use none to clear a mapping. Settings changes, SSO removal and group mapping changes require interactive confirmation or --yes.

IdP-managed MCP access ​

Beta, early access. Flag: idp_managed_mcp.

bumpkit identity sso managed-mcp view
bumpkit identity sso managed-mcp clients add Claude

See IdP-managed MCP access.

Stored dashboard views ​

These reads require an account-bound key; authenticate with bumpkit login and inspect the workspace with bumpkit whoami.

bumpkit status --json
bumpkit quality history --repository acme/api --days 90 --json
bumpkit swarm status --json
bumpkit merge-plans --json
bumpkit report confidence status --repository acme/api --days 90 --json

These commands read stored data and do not run an analysis, publish a check or modify the workspace. quality without history still analyzes local changes. report confidence without status returns score accuracy only.

Leadership already uses bumpkit report --days 90 --json for the dashboard's default window. Match a selected repository with --repo and team with --team, or use the same --from and --to dates as the page.