\n\n# Kernel CLI\n\nThe Kernel CLI is a fast, friendly command‑line interface for Kernel — the platform that provides sandboxed, ready‑to‑use Chrome browsers for browser automations and web agents.\n\nSign up at [kernel.sh](https://www.kernel.sh/) and read the [docs](https://www.kernel.sh/docs/introduction).\n\n## What's Kernel?\n\nKernel provides sandboxed, ready-to-use Chrome browsers for browser automations and web agents. This CLI helps you deploy apps, run actions, manage browsers, and access live views.\n\n### What you can do with the CLI\n\n- Create new Kernel applications from templates\n- Deploy and version apps to Kernel\n- Invoke app actions (sync or async) and stream logs\n- Create, list, view, and delete managed browser sessions\n- Get a live view URL for visual monitoring and remote control\n- Search the web across providers and retrieve page content for results\n\n## Installation\n\nInstall the Kernel CLI using your favorite package manager:\n\n```bash\n# Using brew (recommended)\nbrew install onkernel/tap/kernel\n\n# Using pnpm\npnpm install -g @onkernel/cli\n\n# Using npm\nnpm install -g @onkernel/cli\n```\n\nVerify the installation:\n\n```bash\nwhich kernel\nkernel --version\n```\n\n## Quick Start\n\n1. **Create a new Kernel app:**\n\n ```bash\n kernel create\n ```\n\n2. **Authenticate with Kernel:**\n\n ```bash\n kernel login\n ```\n\n3. **Deploy your app:**\n\n ```bash\n kernel deploy index.ts\n ```\n\n4. **Invoke your app:**\n ```bash\n kernel invoke my-app action-name --payload '{\"key\": \"value\"}'\n ```\n\n## Authentication\n\n### OAuth 2.0 (Recommended)\n\nThe easiest way to authenticate is using OAuth:\n\n```bash\nkernel login\n```\n\nThis opens your browser to complete the authentication flow. Choose organization-wide access or restrict the login to one project. Your credentials are securely stored, automatically refreshed, and retain the selected scope until you log in again.\n\n### API Key\n\nYou can also authenticate using an API key:\n\n```bash\nexport KERNEL_API_KEY=\n```\n\nCreate an API key from the [Kernel dashboard](https://dashboard.onkernel.com).\n\n## Commands Reference\n\n### Global Flags\n\n- `--version`, `-v` - Print the CLI version\n- `--no-color` - Disable color output\n- `--log-level ` - Set log level (trace, debug, info, warn, error, fatal, print)\n- `--project ` - Scope requests to a project by ID or exact name (or set `KERNEL_PROJECT`). A non-empty flag overrides the environment variable. The selector is sent to the API as `X-Kernel-Project`, without a client-side project lookup. Project-scoped API keys and OAuth tokens cannot switch projects.\n\n## JSON Output\n\nMany commands support JSON output for scripting and automation. Use `--output json` or `-o json` to get machine-readable output:\n\n```bash\n# Get browser session details as JSON\nkernel browsers create -o json\n\n# List apps as JSON\nkernel app list -o json\n\n# Deploy with JSONL streaming output (one JSON object per line)\nkernel deploy index.ts -o json\n```\n\nCommands with JSON output support:\n- **Browsers**: `create`, `list`, `get`, `view`\n- **Browser Pools**: `create`, `list`, `get`, `update`, `acquire`\n- **Profiles**: `create`, `list`, `get`, `update`\n- **Extensions**: `upload`, `list`\n- **Proxies**: `create`, `list`, `get`, `update`, `check`\n- **API Keys**: `create`, `list`, `get`, `update`, `rotate`\n- **Auth Connections**: `timeline`\n- **Vaults**: `create`, `list`, `get`, `credentials create/update`, `items list/get/events/invoke` (including `collect`, `fill`, and `prepare_checkout`), `wallets create/payment-methods`, `cards create/update` (display-safe public fields only)\n- **Projects**: `update`\n- **Org**: `limits get/set`\n- **Apps**: `list`, `history`\n- **Deploy**: `deploy` (JSONL streaming), `history`\n- **Invoke**: `invoke` (JSONL streaming), `history`\n- **Browser Sub-commands**: `replays list/start`, `process exec/spawn`, `fs file-info/list-files`, `webmcp list`, `webmcp custom-tools list/add` (`webmcp invoke` always prints JSON output)\n- **Browser NDJSON streaming**: `telemetry stream`\n\n### Search\n\nSearch commands always return the full API response as JSON, including results,\nwarnings, provider attempts, usage, and expiry. They use the normal API key or\nOAuth authentication and global `--project` scope. Your organization must have\nSearch API access enabled.\n\n```bash\n# Discover currently configured providers and capabilities\nkernel search providers\n\n# Automatic routing\nkernel search \"Playwright browser automation\" --max-results 5\n\n# Retrieve a retained result without another provider call or search charge\nkernel search get srch_01jsearchresult\n\n# Use portable filters or other advanced request fields\nkernel search --request '{\"query\":\"browser automation\",\"include_domains\":[\"example.com\"],\"strict_params\":true}'\n\n# Fetch content for the top results of a retained search\nkernel search contents srch_01jsearchresult --limit 3 --content-source browser\n```\n\n- `--max-results` accepts 1–100; the API may clamp it to the provider cap.\n- `--request` accepts the complete Search API JSON object, including `max_results`,\n typed strategies (`auto`, `pinned`, or `fallback`), portable filters, `content`,\n `include_raw`, date/locale filters, and provider-specific options. It cannot be\n combined with a positional query, `--provider`, or `--max-results`. Provider-specific\n and advanced request validation is performed by the API.\n- Create requests are not automatically retried, to avoid duplicate billable\n searches after an ambiguous failure. If a request fails ambiguously, use\n `search get` only when the API returned a retained search ID.\n- Retained searches return 404 when missing, expired, or inaccessible.\n- `search contents ` retrieves content for selected results of a retained\n search. Provide exactly one of `--result-ids` (in desired response order) or\n `--limit` (top N results, 1–100). `--timeout-ms` sets the overall deadline\n (1000–120000). Content options: `--content-source` (`auto`, `provider`, or\n `browser`; default `auto`), `--content-format` (`markdown` or `text`),\n `--content-max-chars`, `--content-max-age-hours`, `--content-timeout-ms`,\n `--content-browser-id` (reuse an existing browser session), and\n `--content-browser-mode` (`curl` or `render`). When no browser ID is given and a\n result needs browser retrieval, Kernel creates a temporary browser for the\n request; it is billed like any other browser. Requests are not automatically\n retried.\n- To search for a literal query equal to a subcommand name (`get` or `providers`),\n use `--request '{\"query\":\"providers\"}'`.\n\n### Authentication\n\n- `kernel login [--force]` - Login via OAuth 2.0\n- `kernel logout` - Clear stored credentials\n- `kernel auth` - Check authentication status\n\n### App Creation\n\n- `--name `, `-n` - Name of the application\n- `--language `, `-l` - Sepecify app language: `typescript`, or `python`\n- `--template `, `-t` - Template to use:\n - `sample-app` - Basic template with Playwright integration\n - `captcha-solver` - Template demonstrating Kernel's auto-CAPTCHA solver\n - `stagehand` - Template with Stagehand SDK (TypeScript only)\n - `browser-use` - Template with Browser Use SDK (Python only)\n - `anthropic-computer-use` - Anthropic Computer Use prompt loop\n - `openai-computer-use` - OpenAI Computer Use Agent sample\n - `gemini-computer-use` - Implements a Gemini computer use agent (TypeScript only)\n - `openagi-computer-use` - OpenAGI Lux computer-use models (Python only)\n - `claude-agent-sdk` - Claude Agent SDK browser automation agent\n\n### App Deployment\n\n- `kernel deploy ` - Deploy an app to Kernel\n\n - `--version ` - Specify app version (default: latest)\n - `--force` - Allow overwriting existing version\n - `--env `, `-e` - Set environment variables (can be used multiple times)\n - `--env-file ` - Load environment variables from file (can be used multiple times)\n - `--output json`, `-o json` - Output JSONL (one JSON object per line for each event)\n\n- `kernel deploy logs ` - Stream logs for a deployment\n\n - `--follow`, `-f` - Follow logs in real-time (stream continuously)\n - `--since`, `-s` - How far back to retrieve logs. Duration formats: ns, us, ms, s, m, h (e.g., 5m, 2h, 1h30m). Timestamps also supported: 2006-01-02, 2006-01-02T15:04, 2006-01-02T15:04:05, 2006-01-02T15:04:05.000\n - `--with-timestamps`, `-t` - Include timestamps in each log line\n\n- `kernel deploy history [app_name]` - Show deployment history\n - `--limit ` - Max deployments to return (default: 100; 0 = all)\n - `--output json`, `-o json` - Output raw JSON array\n\n### App Management\n\n- `kernel invoke ` - Run an app action\n\n - `--version `, `-v` - Specify app version (default: latest)\n - `--payload `, `-p` - JSON payload for the action\n - `--payload-file `, `-f` - Read JSON payload from a file (use `-` for stdin)\n - `--sync`, `-s` - Invoke synchronously (timeout after 60s)\n - `--output json`, `-o json` - Output JSONL (one JSON object per line for each event)\n\n- `kernel app list` - List deployed apps\n\n - `--name ` - Filter by app name\n - `--version ` - Filter by version\n - `--output json`, `-o json` - Output raw JSON array\n\n- `kernel app history ` - Show deployment history for an app\n - `--limit ` - Max deployments to return (default: 100; 0 = all)\n - `--output json`, `-o json` - Output raw JSON array\n\n### Logs\n\n- `kernel logs ` - View app logs\n - `--version ` - Specify app version (default: latest)\n - `--follow`, `-f` - Follow logs in real-time\n - `--since
![\"Kernel](\"https://raw.githubusercontent.com/kernel/kernel-images/main/static/images/logo-kernel-light.svg\"){kind=logo}
\n![\"GitHub](\"https://img.shields.io/github/license/kernel/cli\")
![\"Discord\"](\"https://img.shields.io/discord/1342243238748225556?logo=discord&logoColor=white&color=7289DA\")
![\"Follow](\"https://img.shields.io/twitter/follow/juecd__\")
![\"Follow](\"https://img.shields.io/twitter/follow/rfgarcia\")