Vendor First-Party CLI Inventory

Purpose: Authoritative reference for which How-To-Harden vendors publish first-party command-line tools, used to drive accurate Code Pack creation under packs/{vendor}/cli/.

Method: Live verification via WebSearch + WebFetch against vendor docs. Last refreshed: 2026-04-25.

Status legend:

Master Vendor Inventory

# Vendor Status CLI Name Install (canonical) Covers Admin/Security Ops? Source
1 1Password GA-Official op brew install --cask 1password-cli Yes — vault/group provisioning, SCIM bridge, service accounts, secret injection https://developer.1password.com/docs/cli/
2 Abnormal Security None — — API-only https://abnormal.ai/
3 ADP None — — API-only (OAuth/cert) https://developers.adp.com/
4 Airtable Vendor-Adjacent block (@airtable/blocks-cli) npm i -g @airtable/blocks-cli No — extension publishing only https://www.npmjs.com/package/@airtable/blocks-cli
5 Amplitude Vendor-Adjacent ampli brew tap amplitude/ampli && brew install ampli No — tracking-plan sync only https://amplitude.com/docs/sdks/ampli/ampli-cli
6 Anthropic Claude GA-Official ant (Platform) and claude (Code) brew install anthropics/tap/ant; Code native installer Yes — ant org users/workspaces/analytics; claude local policy/MCP. ant 2.7.0 native help checked 2026-11-05; credential source status is not a health check. https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart
7 Asana None — — API-only https://developers.asana.com/
8 Atlassian (Jira/Confluence) GA-Official acli brew install atlassian/acli/acli Partial — work-item ops, OAuth scopes, Rovo Dev (beta); admin/SSO via REST https://developer.atlassian.com/cloud/acli/
9 Auth0 GA-Official auth0 + auth0-deploy-cli brew tap auth0/auth0-cli && brew install auth0 Yes — tenant config, log streams, action/rule deploy, branding, custom domains https://auth0.github.io/auth0-cli/
10 AWS IAM Identity Center GA-Official aws sso-admin (in AWS CLI v2) brew install awscli Yes — permission sets, account assignments, identity store ops https://docs.aws.amazon.com/cli/latest/reference/sso-admin/
11 Azure DevOps GA-Official az devops extension az extension add --name azure-devops Yes — service connections, OIDC federation, branch policies, variable groups, agent pools, PAT mgmt https://learn.microsoft.com/en-us/azure/devops/cli/
12 BambooHR None — — API-only https://documentation.bamboohr.com/
13 BeyondTrust Password Safe GA-Official ps-cli pip install beyondtrust-bips-cli Yes — safes, folders, secrets, managed accounts, ISA requests https://docs.beyondtrust.com/bips/docs/ps-cli-application
14 Bitbucket None — — No first-party CLI. Atlassian’s acli does NOT cover Bitbucket as of Apr 2026. Use REST API or Atlassian Terraform provider. https://developer.atlassian.com/cloud/bitbucket/rest/
15 Box GA-Official box (@box/cli) npm i -g @box/cli Yes — bulk user/group provisioning, collaboration roles, audit log retrieval, retention via API endpoints https://developer.box.com/guides/tooling/cli/
16 Braze None — — REST API + Cloud Data Ingestion only https://www.braze.com/docs/developer_guide/home
17 Buildkite GA-Official bk (+ buildkite-agent) brew tap buildkite/buildkite && brew install buildkite/buildkite/bk Yes — pipeline mgmt; agent CLI handles OIDC token requests, signed pipelines, secrets/artifacts https://buildkite.com/docs/platform/cli
18 ChatGPT workspace and Dots Unverified No current workspace/dots admin CLI contract verified; API Platform openai CLI is separate See API Platform row130; no CLI installation required for workspace controls Current Global policy API support is documented but its public schema was not verified. Compliance exports use api.chatgpt.com; API org audit events do not verify ChatGPT workspace policy. Use the documented Admin Console and supported local requirements (verified2026-11-05) https://learn.chatgpt.com/docs/enterprise/dots-admin-guide ; https://learn.chatgpt.com/docs/enterprise/managed-configuration
19 CircleCI GA-Official circleci brew install circleci Yes — contexts (secrets), orb signing, OPA policy mgmt, runner tokens https://circleci.com/docs/guides/toolkit/local-cli/
20 Clari None — — REST API only https://api-doc.copilot.clari.com/
21 Cloudflare GA-Official (split) wrangler, cloudflared, cf (new tech preview Apr 2026), flarectl (maintenance) npm i -g wrangler; npm i -g cf (preview) Yes — Workers env vars, Zero Trust tunnels/policies, DNS/WAF (flarectl, maintenance mode) https://developers.cloudflare.com/workers/wrangler/
22 SAP Concur None — — REST API + Joule AI agents https://help.sap.com/docs/SAP_CONCUR
23 Coupa None — — REST API (OAuth2) + flat file integrations https://compass.coupa.com/
24 CrowdStrike Vendor-Published / Not Officially Supported (toolkit) + sensor-only (falconctl) falcon-toolkit + falconctl (endpoint) pipx install caracara-cli; falconctl ships with sensor falconctl: sensor admin only. Falcon-Toolkit: tenant-wide scripting (NOT a formal product) https://github.com/CrowdStrike/Falcon-Toolkit
25 Cursor GA-Official (Beta) Cursor CLI / cursor-agent curl https://cursor.com/install -fsSL \| bash No — agent invocation; admin (SSO, MCP allowlist) via dashboard, and admin reads (members, audit logs, spend) plus preview model-access reads/writes (verified 2026-11-11) via the REST Admin API at api.cursor.com — use api/ packs, not cli/ https://cursor.com/cli
26 CyberArk Conjur GA-Official (Conjur only) conjur (conjur-cli-go) brew tap cyberark/tools && brew install conjur-cli Yes — for Conjur Secrets Manager. NOT for PAS/Privilege Cloud (which our HTH guide covers) — those use REST API + PowerShell SDK https://github.com/cyberark/conjur-cli-go
27 Databricks GA-Official databricks (Go-based, v0.205+) brew tap databricks/tap && brew install databricks Yes — workspace, IAM, Unity Catalog, secrets, cluster policies, audit log delivery https://docs.databricks.com/aws/en/dev-tools/cli/
28 Datadog GA-Official datadog-ci npm i -g @datadog/datadog-ci Yes (CI hardening) — SBOM upload, SCA, sourcemap upload, secret scanning. Account/RBAC via datadogpy SDK https://github.com/DataDog/datadog-ci
29 Docker / Docker Hub GA-Official + Experimental docker, docker scout, docker buildx, hub-tool (experimental) Docker Desktop / brew install docker Docker CLI: image signing/scout/attestations. Hub admin (orgs, teams, PATs): hub-tool is experimental; primary path is REST API https://docs.docker.com/reference/cli/docker/
30 DocuSign None — — Bash + PowerShell code-example launchers (not CLIs); use REST API https://github.com/docusign/code-examples-bash
31 Drata None — — REST API + native integrations https://developers.drata.com/
32 Dropbox Vendor-Published / Not Officially Supported dbxcli go install github.com/dropbox/dbxcli@latest Limited — team-admin commands (add/remove members, list groups). Disclaimer: not officially supported https://github.com/dropbox/dbxcli
33 Duo (Cisco) None (SDK with CLI invocation) duo_client_python (Python SDK) pip install duo-client Yes (via SDK calls) — users, integrations, logs, devices https://duo.com/docs/adminapi
34 Figma Vendor-Adjacent Code Connect CLI (figma connect) npm i -g @figma/code-connect No — design-system tooling only; admin/SSO via SCIM/REST https://developers.figma.com/docs/code-connect/
35 Fivetran Vendor-Adjacent fivetran Connector SDK CLI pip install fivetran-connector-sdk No — custom connector dev only; tenant admin via Terraform provider/REST https://fivetran.com/docs/connector-sdk/
36 Freshservice Vendor-Adjacent Freshworks FDK npm install https://cdn.freshdev.io/fdk/latest.tgz -g No — marketplace app dev only; tenant admin via REST https://developers.freshworks.com/docs/app-sdk/
37 FullStory None — — REST API + Data Direct https://developer.fullstory.com/
38 GitHub GA-Official gh (v2.88.1, March 2026) brew install gh Yes — branch protection, secrets, Dependabot/CodeQL alerts, runners, OIDC, attestation verification, SBOM https://cli.github.com/
39 GitLab GA-Official glab brew install glab Yes — protected branches, CI/CD vars, deploy tokens, runner registration, SAST/DAST report retrieval https://docs.gitlab.com/cli/
40 Gong None — — REST API only https://help.gong.io/
41 Google Workspace Vendor-Published / Not Officially Supported (gws); official CLI announced “coming soon” gws (v0.22.5, Mar 31 2026) npm i -g @googleworkspace/cli or brew install googleworkspace-cli Partial — dynamically-built from Discovery Service. Disclaimer: “not an officially supported Google product”; an official Workspace CLI is coming. GAM is community-only https://github.com/googleworkspace/cli
42 Gusto None — — REST API only https://dev.gusto.com/
43 Harness GA-Official harness (hcli) curl / brew tap Yes — secrets, connectors, RBAC, OPA governance, delegate registration https://developer.harness.io/docs/platform/automation/cli/install/
44 HashiCorp Vault GA-Official vault brew install hashicorp/tap/vault Yes — secrets engines, auth methods (OIDC/JWT/AppRole), policies, audit devices, namespaces, transit/PKI https://developer.hashicorp.com/vault/docs/commands
45 Heap None — — REST API only https://www.heap.io/
46 HubSpot GA-Official hs (@hubspot/cli) npm i -g @hubspot/cli Partial — auth/PAT, CMS deploy, projects/private apps; no portal SSO/audit ops https://developers.hubspot.com/docs/developer-tooling/local-development/hubspot-cli/
47 Intercom None — — REST API only (Fin CLI is unrelated AI agent config) https://developers.intercom.com/
48 Jamf GA-Official jamf (endpoint binary) + Jamf Pro Server Tools CLI Auto-installed at MDM enrollment; Server Tools via Jamf installer Yes (endpoint) — jamf policy, jamf recon, MDM profile, FileVault escrow, EA collection. Server tools: backup/restore https://learn.jamf.com/en-US/bundle/technical-articles/page/Installing_the_CLI.html
49 Jenkins GA-Official jenkins-cli.jar Download from <jenkins>/cli Limited — job config, credentials, plugins; modern security via JCasC YAML, not CLI https://www.jinkins.io/doc/book/managing/cli/
50 JFrog GA-Official jf (JFrog CLI v2) brew install jfrog-cli or curl -fL https://install-cli.jfrog.io \| sh Yes — build-info/SBOM publishing, Xray scans, signed evidence/attestations, OIDC token exchange https://docs.jfrog.com/integrations/docs/jfrog-cli
51 Jira Cloud GA-Official acli (Atlassian CLI) Same as #8 Same — issue ops, JQL, comments https://developer.atlassian.com/cloud/acli/
52 JumpCloud PowerShell-Only JumpCloud PowerShell module Install-Module JumpCloud Yes — user/MFA enforcement, system policies, SSO assignments, Directory Insights audit export https://jumpcloud.com/support/jumpcloud-powershell-module
53 Keeper GA-Official Keeper Commander + ksm pip install keepercommander; pip install keeper-secrets-manager-cli Yes — SSO/SCIM, MFA, role policies, device approvals, IP allowlists, advanced reports https://docs.keeper.io/en/keeperpam/commander-cli/overview
54 Klaviyo GA-Official klaviyo (klaviyo/klaviyo-cli) gh release download -R klaviyo/klaviyo-cli (binary) or go install github.com/klaviyo/klaviyo-cli/cmd/klaviyo@latest Yes — calls every public API operation as a typed command (webhooks, profiles, data-privacy deletion…); the API itself has no user, role, API-key, SSO or MFA operations. Replaced the retired file-based Headless Klaviyo CLI (re-verified 2026-10-04) https://developers.klaviyo.com/en/docs/klaviyo_cli
55 KnowBe4 None — — REST API only https://developer.knowbe4.com/
56 LangChain GA-Official langchain (langchain-cli, PyPI), langgraph (langgraph-cli, PyPI), langsmith (langsmith-cli, Go binary) pip install langchain-cli langgraph-cli (hash-pin via guide 7.1); langsmith: release tarball verified against its checksums.txt, or brew install langchain-ai/tap/langsmith-cli Partial — app scaffolding, LangGraph validate/build/deploy, LangSmith resource queries; org admin (SSO, RBAC/ABAC, service keys, audit logs) is REST API or the official langchain-ai/langsmith Terraform provider. Look-alike: the PyPI package named langsmith-cli is published by a third party (github.com/gigaverse-app), not langchain-ai (verified 2026-09-24) https://github.com/langchain-ai/langsmith-cli
57 LastPass GA-Official (consumer-vault scope) lpass brew install lastpass-cli No enterprise admin coverage — consumer vault only; SSO/MFA/SIEM via Enterprise API https://github.com/lastpass/lastpass-cli
58 LaunchDarkly GA-Official ldcli brew install launchdarkly/tap/ldcli Yes — flag CRUD, project/env, member/team RBAC, API token mgmt, audit log queries https://github.com/launchdarkly/ldcli
59 Linear None — — GraphQL API only https://linear.app/developers
60 Looker Vendor-Published / Not Officially Supported gzr gem install gzr Yes (limited) — users/groups/roles/content. Disclaimer: not officially supported https://github.com/looker-open-source/gzr
61 Lovable None — — No — no first-party CLI. Admin automation is the REST API (api.lovable.dev/v1, GA 2026-09-11, Business/Enterprise), SCIM 2.0 (Enterprise), and the OAuth-only Lovable MCP server https://docs.lovable.dev/integrations/lovable-api
62 Mailchimp None — — REST API only https://mailchimp.com/developer/
63 Marketo (Adobe) None — — REST API + Marketo MCP Server https://experienceleague.adobe.com/en/docs/marketo-developer/marketo/mcp-server
64 Microsoft 365 PowerShell-Only Microsoft.Graph, ExchangeOnlineManagement, MicrosoftTeams PowerShell modules Install-Module Microsoft.Graph; Install-Module ExchangeOnlineManagement; Install-Module MicrosoftTeams Yes — full M365 admin coverage. Note: AzureAD/MSOnline retired Oct 2025 https://learn.microsoft.com/powershell/microsoftgraph/
65 Microsoft Entra ID PowerShell-Only Microsoft.Entra + Microsoft.Graph PowerShell + az ad Install-Module Microsoft.Entra; Install-Module Microsoft.Graph; brew install azure-cli Yes — Conditional Access, MFA, app registrations, PIM, sign-in/audit log export https://learn.microsoft.com/powershell/entra-powershell/
66 Microsoft Intune PowerShell-Only Microsoft.Graph PowerShell + (legacy) Microsoft.Graph.Intune Install-Module Microsoft.Graph Yes — device enrollment, compliance/configuration policies, app deployment, wipe/retire https://github.com/microsoft/Intune-PowerShell-SDK
67 Mimecast None — — REST API 2.0 + community PowerShell modules https://integrations.mimecast.com/
68 Miro None — — REST API only https://developers.miro.com/
69 Mixpanel None — — REST API only https://docs.mixpanel.com/
70 monday.com Vendor-Adjacent mapps (@mondaycom/apps-cli) npm i -g @mondaycom/apps-cli No — app deploy on monday-code only; admin via GraphQL API https://developer.monday.com/apps/docs/command-line-interface-cli
71 MongoDB Atlas GA-Official atlas CLI brew install mongodb-atlas-cli Yes — cluster mgmt, network access lists, IAM, backups, audit logs, federated auth https://www.mongodb.com/docs/atlas/cli/
72 Netskope None — — REST API v2 only https://docs.netskope.com/
73 NetSuite GA-Official suitecloud (SuiteCloud CLI for Node.js) npm i -g --acceptSuiteCloudSDKLicense @oracle/suitecloud-cli Yes — SDF deploy/import/validate, role/permission XML, account auth https://www.npmjs.com/package/@oracle/suitecloud-cli
74 New Relic GA-Official newrelic-cli brew install newrelic-cli Yes — account/user provisioning (NerdGraph), agent install, entity tagging, workload mgmt https://docs.newrelic.com/docs/new-relic-solutions/build-nr-ui/newrelic-cli/
75 Notion None — — REST API only https://developers.notion.com/
76 Okta DEPRECATED (Jul 18, 2025) + active okta-aws-cli okta (deprecated); okta-aws-cli (active) brew install okta-aws-cli okta CLI deprecated; admin hardening via Terraform provider or Management API. okta-aws-cli is for AWS IdP federation only https://github.com/okta/okta-cli
77 Ona (formerly Gitpod) GA-Official ona Vendor verified installer/package; do not install without an approved deployment Environment/SSH/port/Automation/webhook/security-policy commands, authentication and local state. Verify SLSA provenance; explicit port admission creator_only fails closed while implicit older-runner fallback can be public. Connect API/provider cover additional administration. No product command run in this refresh (verified2026-11-05) https://ona.com/docs/ona/integrations/cli ; https://ona.com/docs/ona/reference/cli
78 OneLogin GA-Official onelogin + onelogin-aws-cli-assume-role brew tap onelogin/tap-onelogin && brew install onelogin Limited — apps, users, mappings, Smart Hooks; many MFA/policy ops still REST-only https://github.com/onelogin/onelogin
79 Oracle HCM None (HCM Data Loader transfer utility — not a true CLI) — API only https://docs.oracle.com/en/cloud/saas/human-resources/
80 Orca Security None — — REST API + official Terraform provider https://docs.orcasecurity.com/
81 Outreach None — — REST API + Outreach MCP Server https://developers.outreach.io/
82 PagerDuty None (community: pagerduty-cli by martindstone; python-pagerduty includes basic CLI) — — “PagerDuty doesn’t support [CLI] officially” https://github.com/martindstone/pagerduty-cli
83 Paylocity None — — REST API (OAuth2) https://developer.paylocity.com/
84 Pendo None — — REST API + MCP server https://developers.pendo.io/
85 Ping Identity GA-Official pingcli brew install pingidentity/tap/pingcli Yes — multi-product config (PingOne, PingFederate); export/import config https://github.com/pingidentity/pingcli
86 Postman GA-Official Postman CLI + Newman brew install --cask postman-cli; npm i -g newman Yes — collection runs in CI, signed test runs, governance lint, API security checks https://learning.postman.com/docs/postman-cli/postman-cli-installation
87 Power BI PowerShell-Only MicrosoftPowerBIMgmt PowerShell module Install-Module MicrosoftPowerBIMgmt Yes — tenant admin, workspace admin, audit log export, encryption keys, capacity mgmt https://learn.microsoft.com/powershell/power-bi/
88 Proofpoint None — — TAP/TRAP/SIEM/Email Protection APIs https://help.proofpoint.com/
89 Qualys None — — REST/SOAP APIs + community Python SDK https://qualysguard.qualys.com/qwebhelp/
90 Rapid7 None — — REST API v3 + community Python SDK https://docs.rapid7.com/
91 Replit None — — API-only — Enterprise Admin API (REST, beta, rpl_ keys) plus the in-app App Storage SDK; the complete docs index (docs.replit.com/llms.txt) lists no CLI and the replit GitHub org holds no CLI repo (only the archived ReplitClient.js library). Replit’s MCP server is an agent integration, not a CLI — verified 2026-09-24 https://docs.replit.com/teams/admin-api
92 Rippling GA-Official (Flux only) rippling-cli GitHub release / cargo install No (admin) — Flux integration developer workflow only https://github.com/Rippling/rippling-cli
93 SailPoint GA-Official sailpoint-cli brew install sailpoint-cli Yes — Identity Security Cloud API, transforms/rules/workflows, search, audit export https://developer.sailpoint.com/docs/tools/cli/
94 Salesforce GA-Official sf (v66.0 Spring ‘26) npm i -g @salesforce/cli Yes — user create, permset assign, profile/permset metadata deploy, ConnectedApp/IpRange/SamlSso metadata https://developer.salesforce.com/tools/salesforcecli
95 SAP SuccessFactors None — — OData API + SAP Cloud SDK https://help.sap.com/docs/SAP_SUCCESSFACTORS_HXM_SUITE
96 Segment (Twilio) None — — Public API SDKs (multi-language) + Terraform provider https://docs.segmentapis.com/
97 SendGrid (Twilio) Vendor-Adjacent (parent) twilio email (subset of Twilio CLI) brew tap twilio/brew && brew install twilio Limited — email send via SendGrid; account mgmt via Twilio CLI https://www.twilio.com/docs/twilio-cli/examples/send-email-sendgrid
98 Sentry GA-Official sentry-cli (v3.4.0 Apr 2026) brew install sentry-cli or npm i @sentry/cli Yes — release mgmt, source map/debug file upload, project/org admin, deploy markers https://docs.sentry.io/cli/
99 SentinelOne Vendor-Adjacent (endpoint only) sentinelctl Bundled with agent Endpoint-only — status, scan, config, restart (passphrase-gated). Console admin via REST API https://www.sentinelone.com/
100 ServiceNow GA-Official snc Windows installer / ServiceNow Store Yes — instance ops, app deploy, ATF tests, source control sync, custom component dev https://www.servicenow.com/docs/r/xanadu/application-development/servicenow-cli/
101 Shopify GA-Official shopify (@shopify/cli) npm i -g @shopify/cli@latest Yes — app/theme dev, store config, webhooks, OAuth scopes https://shopify.dev/docs/api/shopify-cli
102 Slack GA-Official slack (slackapi/slack-cli, v4.0.0 Apr 2026) brew install --cask slack-cli or curl install App dev focused — manifests, scopes, install/link. Workspace admin (SSO/audit/DLP) requires Admin & Audit Logs APIs https://docs.slack.dev/tools/slack-cli/
103 Smartsheet None (samples only, unmaintained) smartsheet-cli (5+ yrs since release) — API only; first-party direction is MCP server https://github.com/smartsheet-samples/smartsheet-cli
104 Snowflake GA-Official snow (Snowflake CLI) brew tap snowflakedb/snowflake-cli && brew install snowflake-cli Yes — account/warehouse, RBAC, network policies, masking policies, secrets, app deploy. snowsql is being phased out https://docs.snowflake.com/en/developer-guide/snowflake-cli/index
105 Snyk GA-Official snyk npm i -g snyk Yes — SCA, container, IaC, code (SAST) scans, SBOM, monitor projects https://docs.snyk.io/snyk-cli
106 Splunk GA-Official acs (Cloud), splunk (Enterprise) npm i -g @splunk/acs; bundled with Splunk Enterprise Yes — HEC token mgmt, IP allowlists, index admin, app install, user/role admin, SSO config https://help.splunk.com/…/acs-cli
107 Square None — — REST API only; community CLIs exist https://developer.squareup.com/
108 Stripe GA-Official stripe brew install stripe/stripe-cli/stripe Yes — restricted-key login, webhook listen/forward, event tail, log streams https://docs.stripe.com/stripe-cli
109 Tableau GA-Official tabcmd (2.0 Python rewrite) pip install tabcmd Yes — user/group/site admin, project mgmt, workbook publish, permissions, PAT auth https://help.tableau.com/current/online/en-us/tabcmd.htm
110 Tenable GA-Official (local) + SDK (cloud) nessuscli (local) + pyTenable (SDK) Bundled with Nessus; pip install pytenable Local Nessus admin via nessuscli; Tenable.io scan/asset mgmt via pyTenable https://developer.tenable.com/
111 Terraform Cloud / HCP GA-Official terraform + hcp brew install hashicorp/tap/terraform; brew install hashicorp/tap/hcp Yes — workspaces, vars, teams, projects, run triggers; OIDC dynamic credentials https://developer.hashicorp.com/hcp/docs/cli
112 Twilio GA-Official twilio-cli (v6.0+) brew tap twilio/brew && brew install twilio Yes — API key mgmt, subaccount admin, phone-number config, webhook config, plugins https://www.twilio.com/docs/twilio-cli
113 UKG None — — REST API only https://community.ukg.com/
114 Vanta None — — REST API only https://developer.vanta.com/
115 Vercel GA-Official vercel npm i -g vercel or brew install vercel-cli Yes — env vars (encrypted), deployment protection, domains/certs, team mgmt https://vercel.com/docs/cli
116 Webex None (general admin) xCommand UI (Control Hub, room devices); MSI flags (endpoints) — No general-purpose admin CLI https://help.webex.com/en-us/article/9lk0bf/
117 Wiz GA-Official wizcli brew install --cask wizcli Yes (shift-left) — IaC, container, secrets, SBOM, dir scan. Cloud posture admin via console/API/Terraform https://www.wiz.io/lp/wiz-cli
118 Workato GA-Official workato (Platform CLI) + Connector SDK CLI pip install workato-platform-cli Yes — project push/pull, recipe lifecycle, OAuth connection mgmt, API client/collection mgmt https://docs.workato.com/en/platform-cli.html
119 Workday Coming GA (announced Jun 2025) Workday Developer CLI TBD Project scaffolding, integration deploy (not yet broadly downloadable) Workday DevCon 2025
120 Zendesk GA-Official (Beta) zcli npm i -g @zendesk/zcli App dev/packaging, theme upload, profile/login mgmt https://developer.zendesk.com/documentation/apps/getting-started/using-zcli/
121 Zoom None — — REST API + MSI flags https://developers.zoom.us/
122 Zscaler Vendor-Adjacent (SDK + ZPA App Connector local) zscaler-sdk-python, zpa-api-tool; ZPA App Connector local CLI pip install zscaler-sdk-python No general admin CLI; primary path is official Terraform provider https://help.zscaler.com/
123 Grok Bot (SpaceXSI) Vendor-Adjacent (narrow scope) grok (Grok Build) curl -fsSL https://x.ai/cli/install.sh \| bash (Windows: irm https://x.ai/cli/install.ps1 \| iex) No — grok is Grok Build, SpaceXSI’s coding agent (login, logout, inspect, models, mcp, plugin, sessions, export, import, memory, worktree, dashboard, agent stdio, wrap, update, version, completions, and setup, which fetches managed configuration). It has no Grok Bot or org-admin subcommands. Grok Bot admin is the Cursor dashboard plus the Cursor Admin API (api.cursor.com/grok-bot/*) and Organization API (/organizations/teams/:teamId/grok-bot/operations), so use api/ packs, not cli/. Grok Business licenses are assigned in console.x.ai (directly or through SCIM role mappings); the xAI Management API has no seat or license routes (verified 2026-10-09) https://docs.x.ai/build/cli/reference
124 Devin GA-Official devin cloud drs, devin-remote, gateway Vendor CLI installer; Outposts worker distribution Partial — cloud blueprint/build/secret commands, Local Hands/SSH/forward, Outposts worker/fleet, and dedicated Connect gateway validate-config/doctor/serve; not SSO, enterprise PAT policy or IP-list management. Use API/Terraform for those documented admin surfaces (verified 2026-11-05) https://docs.devin.ai/cli/reference/commands
125 Devin CLI GA-Official devin First-party installation guide Partial — local permissions, sandbox and MCP configuration; enterprise managed controls are configured through the admin UI, not guessed CLI switches (verified 2026-11-05) https://docs.devin.ai/cli/reference/permissions
126 Devin Desktop Vendor-Adjacent bundled Devin Local / optional devin CLI Desktop command palette; enterprise may disable installation No Desktop policy-admin CLI — IDE managed policies/configuration and enterprise UI; Cascade and Devin Local have different controls (verified 2026-11-05) https://docs.devin.ai/desktop/controls
127 DeepWiki None — — Public/private MCP and Devin repository-indexing API/Terraform; no standalone first-party DeepWiki CLI documented (verified 2026-11-05) https://docs.devin.ai/work-with-devin/deepwiki-mcp
128 Factory GA-Official droid, droid daemon, droid computer Approved installer or exact npm version from CLI reference; package update defaults differ Partial — rules/MCP/plugin/tool/Computer/version inventories and companion registration/SSH/forward/update commands; org identity and managed policy use console/config/REST. update --check does not install; npm/standalone env and org update settings differ (checked 2026-11-05). https://docs.factory.com/droid-cli/cli-reference
150 Poke GA-Official npx poke Approved preinstalled local package; no automatic installation by HTH Partial — login/logout/whoami, custom MCP and attended tunnel; no documented enterprise account-policy CLI in fetched developer catalog (verified 2026-11-05). https://poke.com/docs/creating-recipes
151 Devin Federal GA-Official (portal SDK); Beta (air-gapped) windsurf_analytics.py; bundled devin Authorized portal SDK/bundle download Partial — SDK group/ACU read and write commands use federal service-key POST API; air-gapped CLI validates models, license/auth and endpoint diagnostics. No commercial-provider substitution (verified 2026-11-05). https://docs.devin.ai/federal/api/python-sdk
129 Tailscale GA-Official tailscale, tailscaled Approved first-party client package/release Partial — client preferences, system-policy diagnostics, daemon flags, Tailnet Lock, Serve/Funnel, Taildrive, DNS and local status/version; central identity/policy administration uses console/REST/Terraform. Per-command platform/version support matters (checked 2026-11-05). https://tailscale.com/docs/reference/tailscale-cli
130 OpenAI API Platform GA-Official openai Official openai/openai-cli release; reviewed package Current admin org/project roles, groups, keys, audit and service-account inventory. Pin reviewed release; pagination and authentication scopes remain command-specific. Does not administer ChatGPT workspace policy (verified2026-11-05) https://github.com/openai/openai-cli
131 ChatGPT Work Codex GA-Official Codex CLI; Codex Security CLI Approved vendor client distribution Native local requirements, sandbox/network/browser/computer controls, plugin inventory; Codex Security dry-run only in pack. Policy/version support differs across desktop/CLI/IDE/cloud; no local policy implies universal cloud enforcement (verified2026-11-05) https://learn.chatgpt.com/docs/enterprise/managed-configuration ; https://learn.chatgpt.com/docs/security/cli/reference
132 OpenAI Ads Unverified No current first-party Ads admin CLI contract verified N/A Advertiser API, supported SDK/browser measurement and native request schemas; exact missing CLI functionality remains unverified, not an absence claim (verified2026-11-05) https://developers.openai.com/ads
133 Statsig GA-Official Siggy Approved pinned @statsig/siggy package from the official CLI introduction Siggy manages configuration and its MCP mode can change project settings. Pack invokes version only; never start a credentialed MCP server as an audit. Console shared key acts as Admin regardless of user role (verified 2026-11-05) https://docs.statsig.com/statsigcli/introduction ; https://docs.statsig.com/statsigcli/commands
143 Claude Enterprise GA-Official ant Official Anthropic CLI distribution; reviewed version Yes — members, custom roles, spend and other organization resources; 2.7.0 native help verified 2026-11-05. Recording-state retrieve exists; the separate Security Center/effective-settings handles remain unverified in this version. https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart
140 Grok Build GA-Official grok Vendor install script in official docs; not run Yes — local inspect, MCP/plugin/session/worktree lifecycle and managed TOML configuration; no Grok Bot/team admin. Read CLI packs require explicit opt-in and disable auto-update; config packs prepare files without installing them (2026-11-05) https://docs.x.ai/build/cli/reference
141 Cursor Origin GA-Official (Early Beta) origin Official install instructions; not run Yes — native repository/namespace access, ruleset/app/mirror/SSH/API commands; independent of Cursor Agent CLI. Read packs constrain repository scope and reject custom endpoints (2026-11-05) https://cursor.com/docs/origin/cli/reference/commands
142 Grok / Grok API Vendor-Adjacent grok (Build) See row 140 No — Build CLI does not establish workspace/Management API administration; use documented console and first-party REST contracts (2026-11-05) https://docs.x.ai/llms.txt
160 HumanLayer GA-Official humanlayer (@humanlayer/cli) Approved already-installed release; remote daemon setup reference Partial — login/logout, daemon launch/self-update settings and automation run. Approval-free automation entitlement/GA remains unverified; no hosted org-policy/SSO admin contract established. Production/beta native identity and daemon supervision differ (checked 2026-11-05). https://docs.humanlayer.com/guide/remote-daemons
161 HumanLayer Linear companion GA-Official linear (@humanlayer/linear-cli) Approved first-party package from integration reference Yes — narrow Linear workflow-state/issue operations; list-workflow-states TEAM --output-format json read supported. Ensure-columns preview/write, remove-other-columns and destroy have distinct mutation effects; not HumanLayer hosted security admin (checked 2026-11-05). https://docs.humanlayer.com/guide/linear-integration
162 Mentlio Unverified Desktop agent documented; public CLI contract unverified Desktop setup flow; no public CLI install invoked Unknown — actual docs establish dashboard/desktop controls and integrations but no supported public CLI/daemon command reference. No unofficial CLI pack (checked 2026-11-05). https://www.mentlio.com/docs
163 Fenic (Typedef / Factory) GA-Official (version-scoped) fenic, fenic-serve Official Python package, reviewed v0.13.0; no server launched Partial — native library/agent utility and MCP catalog serving. fenic-serve has tool/table selection, result limits, transport/listener and SessionConfig input; no hosted Typedef/Factory SSO/admin CLI established. No launch command is used as a read-only security audit (checked 2026-11-05). https://docs.fenic.ai/latest/topics/fenic-mcp/ ; https://github.com/typedef-ai/fenic/blob/v0.13.0/pyproject.toml
164 Ramp GA-Official ramp brew install ramp-public/ramp/ramp-cli Partial — user-role-bound resource operations and read-only authentication mode; no verified SSO/MFA policy administration. --scope obsolete. CLI pack inspects an existing session only (checked 2026-11-08). https://docs.ramp.com/developer-api/v1/cli
165 ZipHQ Unverified No public first-party admin CLI contract verified No installation proposed Public docs/GitHub listing and authenticated 159-operation API/51-guide corpus checked 2026-11-08; no first-party CLI contract verified. Native REST and Entra collectors are not a Zip CLI. https://docs.ziphq.com/hc/en-us/articles/49398321531675-How-to-Access-API-Documentation ; https://github.com/ziphq
166 Claude Tag GA-Official ant Official Anthropic CLI distribution Yes — documented beta Tag workspace/channel and bundle-target management; exact commands source-verified 2026-11-11, native binary unavailable for live execution. https://platform.claude.com/docs/en/manage-claude/claude-tag-api

Vendors With Existing CLI Packs — Validation Status

The 22 vendor directories with existing packs/{vendor}/cli/ directories, mapped against verified CLI status:

Vendor Existing pack files Vendor first-party CLI? Pack is correct? Action needed
azure-devops 7 Yes (az devops) ✅ Yes (uses az/PowerShell + pipeline YAML) Leave as-is
bitbucket 3 No first-party CLI ❌ No — files are pipeline YAML + git-secrets Relocate to pipelines/; remove from cli/
circleci 7 Yes (circleci) ⚠️ Partial — files are .yml configs (CircleCI uses YAML); CLI invokes them Acceptable; consider renaming pack type to config/
cursor 12 Yes (Cursor CLI exists, beta) but packs use bash/jq on local config files ⚠️ Partial — admin scripts, not Cursor CLI ✅ Done — relocated to config/; Admin API packs live in api/ (2026-09-24)
cyberark 4 CyberArk Conjur CLI exists (Vault CLI doesn’t) ❌ No — .ini config snippets, NOT CLI invocations + violates extension rules Relocate to config/ and rename extension
databricks 2 Yes (databricks) ✅ Yes (uses databricks CLI) Leave as-is
dockerhub 6 Yes (docker + Scout/Buildx) ✅ Yes (uses docker scout, docker trust, etc.) Leave as-is
github 19 Yes (gh) Mostly YAML workflows + a few gh shell scripts Acceptable mix; .yml workflows are GitHub Actions configs, valid here
gitlab 7 Yes (glab) Mostly YAML pipelines + git/glab shell scripts Acceptable
google-workspace 5 gws is “not officially supported” by Google; GAM is community ⚠️ Existing scripts use GAM (community-only) Refactor to use gws (transparent disclaimer) OR gcloud + Admin SDK API
hashicorp-vault 11 Yes (vault) ✅ Yes (uses vault + .hcl config) Leave as-is
jfrog 4 Yes (jf) ✅ Yes (uses jf + GHA YAML) Leave as-is
microsoft-365 7 Yes (PowerShell modules) ✅ Yes (.ps1 scripts using Graph/Exchange modules) Leave as-is
microsoft-entra-id varies Yes (PowerShell + az ad) ✅ Yes Leave as-is
microsoft-intune varies Yes (PowerShell) ✅ Yes Leave as-is
okta 1 DEPRECATED Jul 2025; admin via Terraform/API ❌ No — sanitize-har-files.sh uses pure jq, NOT okta CLI Relocate to scripts/; do NOT add new okta-CLI packs
ping-identity varies Yes (pingcli) ✅ Yes Leave as-is
slack 1 Yes (slack slack-cli) but slack-cli is app-dev focused ❌ No — .regex data file, NOT CLI invocation + violates extension rules Delete or convert to API-based script
snowflake varies Yes (snow) ✅ Yes Leave as-is; consider migrating any snowsql references to snow
vercel varies Yes (vercel) ✅ Yes Leave as-is
wiz varies Yes (wizcli) ✅ Yes Leave as-is
workato 3 Yes (workato Platform CLI + Connector SDK CLI) ⚠️ Mixed — 7.03-workato-cli.sh valid; 4.03-deploy-opa.sh uses docker not workato; 4.03-agent-config.sh is comments-only Clean up: split docker-based deploy to scripts/; remove comments-only file; keep valid workato-cli.sh

Priority Corrective Actions (Driven by Verified Inventory)

Tier 1 — Forbidden extensions (CLAUDE.md violations, must fix)

  1. packs/cyberark/cli/*.ini (4 files) — .ini is forbidden
  2. packs/slack/cli/*.regex (1 file) — .regex is forbidden

Tier 2 — Non-CLI content in cli/ directory

  1. packs/bitbucket/cli/* (3 files) — Bitbucket has no first-party CLI; content is Pipelines YAML + git-secrets
  2. packs/cursor/cli/* (12 files) — bash scripts editing local Cursor config files; no Cursor CLI invocation — done: relocated to packs/cursor/config/, with Admin API packs in packs/cursor/api/ (2026-09-24)
  3. packs/okta/cli/hth-okta-7.01-sanitize-har-files.sh — pure jq script
  4. packs/workato/cli/hth-workato-4.03-agent-config.sh — comments only, no executable code
  5. packs/workato/cli/hth-workato-4.03-deploy-opa.sh — uses docker, not workato

Tier 3 — Third-party tool dependence

  1. packs/google-workspace/cli/* (5 files) — Use GAM which is community/non-Google. Refactor to gws (vendor-published, with disclaimer) or gcloud + Admin SDK API.

Open Questions for Future Work