CLI

The CLI has no token or login: its boundary is the container it runs in, dialling loopback. forge infra deliberately stays outside the capability model because its credentials only exist on your machine.

verb	maps to	plane
init app · provision · install · dev · build · test · lint	POST /capabilities/{initialize-app · provision-environment · install-dependencies · run-dev-server · build · test · lint}	control
productionize · deploy · release · verify · explain · plan	POST /capabilities/{productionize · deploy · release · verify · explain-failure · generate-feature-plan}	control (verify: both)
inspect [type] · secrets list · jobs · email list · auth users	POST /capabilities/inspect {type}	both
secrets set · secrets unset · schedule · email send	POST /capabilities/{set-secret · unset-secret · schedule-job · send-email}	both · both · both · data
eval <suite> · provision-monitoring	POST /capabilities/{eval · provision-monitoring}	control
capabilities · resources · events · logs <id>	GET /capabilities · /resources · /events · /logs/:id	both
mcp list-tools · register-tool · delete-tool · set-instructions · get-instructions · proactive	GET/POST/DELETE /mcp/tools · /mcp/instructions · /mcp/proactive	both
policy list · set · delete	GET/POST/DELETE /policies	both
status incident create · update · resolve · list	POST/GET /status/incidents[/update\|/resolve]	both
auth seed-owner · owner claim-legacy	POST /auth/admin/seed-owner · POST /owner/claim-legacy	both
storage migrate --store	no HTTP — a local fs → Postgres backfill in the container	—
infra bootstrap · lint · plan · apply · status · outputs · verify · release-image · untaint · destroy	local terraform + gcloud; apply is CI-only; destroy refuses prod without --i-know-this-is-prod	—

Global flags: --json, --summary, --raw. Four capabilities have no verb and are HTTP-only: agent-run, send-message, setup-observability, delivery-check.