Everything in the console, from your terminal or your agent's.
One standalone CLI for people and agents. Install, sign in through your browser, choose an authorized organization, and inspect your identity. Then create workspaces, deploy, invite members, run jobs and query data, with structured JSON on supported commands.
Get started
curl -fsSL https://cloud.segmentstream.com/install.sh | shexport PATH="$HOME/.segmentstream/bin:$PATH"segmentstream --versionsegmentstream loginsegmentstream org list# Replace org_YOUR_ID with an organization ID from the list.segmentstream org use org_YOUR_IDsegmentstream whoamiAt a glance
- JSON login events and structured output on supported commands
- Account sign-in with your authorized workspace access
- Self-updating; keeps your agent docs current
- macOS and glibc Linux, ARM64 and x64
What it does
Open the complete login link
Login prints the server-provided complete verification link when available. Open that exact link in your browser and authorize SegmentStream CLI before the displayed UTC expiry. Check the application and API origin match your request. If the complete link is unavailable or does not work, open the printed base URL and enter the separate code. Keep the terminal process running until it reports success; browser approval alone does not finish local sign-in.
Choose an authorized organization
Account sign-in can succeed without an active organization. A provider-selected organization is retained; a single available membership is selected automatically. With multiple memberships, interactive login offers a choice or Enter to defer, and JSON login leaves selection for org use. Run org list to discover permitted memberships, then org use with an ID from that list. If there are none, ask an administrator for access or create an organization with org create NAME --country ISO. WorkOS may still require its hosted organization picker, SSO, MFA or consent. Switching uses session refresh without a new browser login when policy permits. Sign-in never grants access to other organizations.
Organization sign-in limits
Hosted device login can perform required SSO, MFA and consent. However, login --organization selects context after that login; it does not target the hosted device flow. If a later organization refresh reports authentication_reauthentication_required, the current CLI cannot continue that extra organization-specific sign-in. The saved session is retained, but repeating login --organization can return the same error. If a fresh hosted device login offers the target organization, select it and complete its required steps there; the CLI cannot force that choice. Otherwise use the SegmentStream web console for that organization's work, or contact SegmentStream support about CLI access. Web sign-in does not update the CLI session by itself. Do not weaken authentication policy to make a switch succeed.
Keep headless login running
Run login --output json in a process that stays alive while the person approves. Read stdout as newline-delimited JSON and immediately show verification_url from the device_authorization event to the person who requested sign-in, with application, api_url and expires_at. That event has status pending; the CLI polls and honors the provider's interval and backoff. Wait for the terminal login event with status succeeded before running the commands below. JSON login never prompts. org use has text output; org list and whoami support JSON. deploy does not currently support JSON.
segmentstream login --output json# After the login event reports status succeeded:segmentstream org list --output json# Replace org_YOUR_ID with an authorized ID from that result.segmentstream org use org_YOUR_IDsegmentstream whoami --output jsonRead login events
After authorization is issued, the device_authorization event includes verification_url, verification_uri, user_code, expires_in, expires_at (ISO 8601 UTC), interval, application and api_url, plus verification_uri_complete when the provider supplies it. Use verification_url unchanged; do not guess a provider URL format. The final login event has status succeeded with user_id, email and organization_id (possibly null), failed with code, detail, retryable and reference, or canceled after Ctrl-C. Exit codes are 0 for success, 1 for authentication failure and 130 for cancellation. Failure before authorization is issued may emit only the terminal event. Events are flushed as they happen; stderr carries diagnostics, so parse stdout separately. Only public authorization details are emitted, never secret device codes or session tokens.
Expiry, failures and interruption
While pending, leave the CLI running. authentication_authorization_expired means run login again for a fresh link. authentication_access_denied means authorization was denied; restart only if the person intends to approve. authentication_unavailable means check connectivity or provider availability and restart. Ctrl-C emits canceled with authentication_canceled. An abruptly killed process or ended host may emit no final event: do not assume success. Pending login state stays in memory and cannot be resumed from another process. Restart login, share only its new link, and keep that process alive. After success, whoami confirms the saved account and organization. Refresh sessions are stored under the operating-system user's writable home in ~/.segmentstream/credentials.json, separately from projects.
Use a network proxy
Network commands honor HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY, including SOCKS5 and SOCKS5H URLs; SOCKS support is bundled in the standalone CLI. Use your approved proxy address. Help and version need no network and do not initialize proxy clients. If a network command reports invalid_proxy_configuration, check these variables for malformed or unsupported URLs. Unset a proxy only if your network policy permits a direct connection.
export ALL_PROXY="socks5://127.0.0.1:1080"segmentstream --helpsegmentstream --versionsegmentstream whoami --output jsonInstall with a read-only home
The installer requires curl, tar, and sha256sum or shasum. It uses a private temporary verification home under TMPDIR (default /tmp), cleaned up on exit, so Cosign does not need your normal home to be writable. For a retained verification cache, set SEGMENTSTREAM_VERIFY_HOME to a writable directory. Set SEGMENTSTREAM_INSTALL_DIR too when the default ~/.segmentstream/bin is unwritable. Replace /writable/segmentstream below with an absolute path you own; the installer preflights temporary, installation and verification directories before downloading. These settings never disable signature or checksum verification and do not move CLI login credentials or change the caller's HOME.
# Replace this path with a writable directory you own.root="/writable/segmentstream"mkdir -p "$root/tmp" "$root/verify" "$root/bin"curl -fsSL https://cloud.segmentstream.com/install.sh | \ TMPDIR="$root/tmp" \ SEGMENTSTREAM_VERIFY_HOME="$root/verify" \ SEGMENTSTREAM_INSTALL_DIR="$root/bin" sh"$root/bin/segmentstream" --versionWorkspaces
A new workspace comes with a private git repository that already holds the starter project. Clone it, commit your changes and deploy; an existing workspace works the same way without the create step.
# Start a new workspacesegmentstream workspace create acme --region eu --subdomain acmesegmentstream workspace WORKSPACE-ID clone acme && cd acme# your agent writes the five foldersgit add -A && git commit -m "First version"segmentstream deploy# Work on an existing workspacesegmentstream workspace WORKSPACE-ID clone acme && cd acme# your agent makes the changegit add -A && git commit -m "Add purchase orders"segmentstream deployDeploy and inspect
Deploy the five folders together and inspect what is live.
segmentstream deploysegmentstream lineage show --output jsonsegmentstream lineage asset gold/revenue_summaryMembers, keys and MCP
Invite the people who use the app, give them roles, and create API keys for the systems that call it.
segmentstream ontology member invite ada@example.com --role salessegmentstream ontology member listsegmentstream ontology api-key create website --role intakesegmentstream ontology mcpJobs, backfills and schedules
Run and backfill jobs by date range, read run history and pause schedules.
segmentstream job run revenue_pipeline --start-date 2026-01-02 --end-date 2026-01-03segmentstream job runs revenue_pipeline --output jsonsegmentstream schedule pause revenue_morningData
Preview tables, run read-only SQL and ask the ontology for totals.
segmentstream warehouse preview gold revenue_summarysegmentstream warehouse query --sql 'SELECT COUNT(*) AS n FROM gold.orders'segmentstream ontology aggregate order --query query.jsonConnections, secrets and agent docs
Inspect connections and manage secrets without pasting them into code. sync keeps AGENTS.md, the docs and the skills your agent reads up to date.
segmentstream connection list --output jsonsegmentstream secret create api-token --value-file /secure/path/tokensegmentstream syncThe rest of the surface
Ontology SDK
@segmentstream-cloud/ontology
Entities, actions and roles; REST, OpenAPI and MCP from one model
App SDK
@segmentstream-cloud/app
Email-code sign-in, roles, records and warehouse data for Next.js
Pipeline SDK
segmentstream-pipeline (Python)
Connections, ingestion, models, checks and schedules in Python
Agent SDK
@segmentstream/agent
The company agent: ontology tools as the member, Telegram channel
MCP and API
/mcp and /api/ontology on every app
REST, OpenAPI and MCP on every app, per caller
Your company’s software, built by agents, owned by you.
$ segmentstream workspace create acme --region eu --subdomain acme
▸ Created workspace acme · database, warehouse and a private git repository
$ segmentstream workspace WORKSPACE-ID clone acme && cd acme
▸ your agent writes the five folders and runs the checks
$ git add -A && git commit -m "First version"
$ segmentstream deploy
▸ app, ontology API and MCP tools live for your invited members
Our engineers build the first version on your data in two weeks, at a fixed price.
Or join the waitlist for self-serve:
Self-serve opens to the waitlist first.