The assurance CLI
python -m assurance <domain> <verb> — the same code the hosted API calls, runnable on your own machine first. Some domains talk to a deployment once you have one; kit and watch never do, by design.
Runs on your machine, into your own ledger
No account, no upload — every domain reads and writes local files unless it explicitly names an API call below.
Install and check
pip install -e '.[assurance-attest]' python -m assurance # lists every domain python -m assurance kit init plant/ # a runnable kit python -m assurance kit check plant/kit.json
Every domain, its verbs, and what it maps to
Checked against each domain's own --help output. Two domains — kit and watch — are offline-first and have no API equivalent; the rest call the same tier of the Assurance API listed on /developers.
| Domain | Verbs | What it does | API tier |
|---|---|---|---|
kit | initruncheck | Enrol a plant’s machines without anything leaving it — offline by design, no API equivalent. | Offline only |
machine | separationverifycheck | ISO/TS 15066 separation and recorded-run verification. | Validator — free |
machinery | record-manifestrecord-changediffcoveragepassportcheck | Annex III safety software manifests and the staleness join. | Cell — €1,290/mo |
fleet | listadvisorydeclaredeclaration | Advisory fan-out and Declaration binding across a fleet. | Cell — €1,290/mo |
attest | keygensignverifylog | Counter-signed head attestation — catches deletion, not just editing. | Cell — €1,290/mo |
watch | runstatus | The component that runs when nobody is looking — local only, no API equivalent. | Offline only |
supplier | keygenpublishwithdrawverifylist | Sign and publish advisories to a hosted feed. | Supplier — contact sales |
art14 | signalawarenesstriageavailabilitymeasurefilenotify-usersvalidatefieldscaseregisterverifyexport | Case triage and the two Article 14 deadline clocks. | Register — €390/mo |
bridge | art14 | Assembles the Article 14 export from local case state — local only. | Offline only |
collect | check-planproberun | Finds the vendor tool’s own volatile headers before they produce a year of false drift alarms. | Offline only |
The CLI today, MCP tomorrow
Every CLI verb above maps 1:1 to a FastAPI route or a local file operation — the same surface an MCP server would expose as tools. See the MCP connector page for the current tool table and what ships today versus what a future mcp/ package still needs.
Read the full route table next
Auth, the free-vs-paid split, and copy-paste curl/Python for the same API this CLI calls.