axiom inspect

axiom inspect turns a frontend, backend or combined workspace into canonical application evidence: a graph of semantic facts, relationships and the source or artifact evidence behind them. This page lists every subcommand in CLI 0.149.1.

Every subcommand runs locally. None needs Cloud login or network access, except the opt-in Jev planner used by ask and serve. For guided workflows, start with Axiom Inspector.

Diagram source

flowchart LR
  A[Workspace source] --> B[inspect overview]
  A --> C[inspect snapshot before.json]
  A --> D[inspect snapshot after.json]
  C --> E[inspect diff]
  D --> E
  E --> F[changes.json]
  C --> G[inspect impact --against]
  F --> H[inspect ask what changed]
  E --> I[CI gate with --fail-on]

The diagram shows a common review loop. You summarize the workspace with overview, write a snapshot before and after a change, compare them with diff, and fail CI on the change classes you choose. The diff report also feeds ask "what changed", and impact measures how far one fact's change reaches against the baseline snapshot.

axiom inspect

Inspect a workspace, a contract artifact or a packaged application. Without a subcommand, the command picks a view from the input type.

axiom inspect [PATH] [COMMAND]

axiom inspect .
axiom inspect api.axiom
axiom inspect dist/my-app-web.axiomapp

The legacy terminal inspector has an endpoint view and a model view. The endpoint pane shows compiled endpoint detail; the model view lists the models and enums in the artifact. It needs an interactive terminal and fails without one, for example in CI. In scripts, use axiom inspect overview or another subcommand with --format json.

The screen draws a search field, but text-search input is not part of the keyboard contract. Do not depend on it for validation. Layout and key hints can change between CLI versions.

Subcommands

Shared arguments and output

These conventions apply to most subcommands. Each entry lists its own options.

Application views

axiom inspect overview

Summarize discovered application facts and verification state. Start here for any workspace.

axiom inspect overview [OPTIONS] [PATH]

axiom inspect overview .
axiom inspect overview . --format json > overview.json

axiom inspect source

Inspect one saved source file, manifest or contract with the same passive capture the editor uses. The path must be a file; a directory is rejected.

axiom inspect source [OPTIONS] <PATH>

axiom inspect source frontend/main.acore

axiom inspect frontend

Inspect compiler-proven frontend modules, routes, pages, components, actions, state, effects and assets.

axiom inspect frontend [OPTIONS] [PATH]

axiom inspect ui

Inspect the semantic UI tree (routes, pages, components and primitives) and its action bindings.

axiom inspect ui [OPTIONS] [PATH]

axiom inspect styles

Inspect typed styles, variables and responsive branches.

axiom inspect styles [OPTIONS] [PATH]

axiom inspect state

Inspect state declarations and their proven readers and writers.

axiom inspect state [OPTIONS] [PATH]

axiom inspect accessibility

Inspect declared accessibility semantics.

axiom inspect accessibility [OPTIONS] [PATH]

Backend, data and server

axiom inspect backend

Inspect backend services, operations, data and policies.

axiom inspect backend [OPTIONS] [PATH]

axiom inspect operation

Trace one frontend or backend operation across contract boundaries.

axiom inspect operation [OPTIONS] <SELECTOR> [PATH]

axiom inspect data

Inspect models, fields, projections, relationships and validation rules, or the lineage of one fact.

axiom inspect data [OPTIONS] [PATH]

axiom inspect exposure

List explicit public and restricted backend exposure facts.

axiom inspect exposure [OPTIONS] [PATH]

axiom inspect cache

Inspect contract-owned cache policy and its operation associations.

axiom inspect cache [OPTIONS] [PATH]

axiom inspect server

Inspect the facts of a bound private server plan, its target assessment and an optional redacted startup observation. It does not capture requests. axiom server inspect shows the same target assessment without the startup observation.

axiom inspect server [OPTIONS] <CONTRACT> <PLAN>

axiom inspect server backend.axiom backend.server.json --deployment deployment.json --format json

Contracts and dependencies

axiom inspect dependencies

Show direct and transitive contracts, packages and executable extensions.

axiom inspect dependencies [OPTIONS] [PATH]

axiom inspect dependencies .

axiom inspect contract

Inspect one imported contract and, optionally, everything reachable from it.

axiom inspect contract [OPTIONS] <ALIAS> [PATH]

axiom inspect executable-closure

Show the executable code and authority reachable from one dependency: contracts, packages, third-party packages, extensions and their exports, permissions, implementation bindings, artifacts and releases.

axiom inspect executable-closure [OPTIONS] <ALIAS> [PATH]

axiom inspect provenance

Show provenance and evidence for one package, contract or extension.

axiom inspect provenance [OPTIONS] <SELECTOR> [PATH]

Graph queries and explanation

axiom inspect graph

Query a bounded graph neighborhood, optionally rooted at one fact.

axiom inspect graph [OPTIONS] [PATH]

axiom inspect node

Show one semantic fact and its immediate evidence neighborhood.

axiom inspect node [OPTIONS] <SELECTOR> [PATH]

axiom inspect evidence

Show the source or artifact evidence that supports one semantic fact.

axiom inspect evidence [OPTIONS] <SELECTOR> [PATH]

axiom inspect trace

Trace typed upstream, downstream or bidirectional paths from one fact. Use it to see what feeds a value or what a change can reach.

axiom inspect trace [OPTIONS] <SELECTOR> [PATH]

axiom inspect trace Home.total_label . --direction upstream

axiom inspect why

Explain a fact through the authoritative facts adjacent to it.

axiom inspect why [OPTIONS] <SELECTOR> [PATH]

axiom inspect access

Show who requests, receives or effectively holds access to a fact: requested, granted and effective access.

axiom inspect access [OPTIONS] <SELECTOR> [PATH]

axiom inspect reachability

Find the deterministic shortest downstream path between two facts.

axiom inspect reachability [OPTIONS] <FROM> <TO> [PATH]

axiom inspect lineage

Trace the currently available typed lineage around one fact.

axiom inspect lineage [OPTIONS] <SELECTOR> [PATH]

axiom inspect target-compare

Compare the target-scoped neighborhood of one fact across targets, for example web and ios.

axiom inspect target-compare [OPTIONS] --targets <TARGETS> <SELECTOR> [PATH]

axiom inspect target-diff

Alias for target-compare with the same arguments and output.

axiom inspect target-diff [OPTIONS] --targets <TARGETS> <SELECTOR> [PATH]

axiom inspect query

Execute a bounded, declarative axiom-query/v1 JSON document. Use it for repeatable queries in scripts and agents.

axiom inspect query [OPTIONS] <QUERY_FILE> [PATH]

Security and authority

axiom inspect security

Inspect deterministic security facts and findings.

axiom inspect security [OPTIONS] [PATH]

axiom inspect security . --format json

axiom inspect authority

Show the resolved direct and transitive bill of authority.

axiom inspect authority [OPTIONS] [PATH]

axiom inspect finding

Inspect one deterministic finding and its supporting evidence, or list every finding.

axiom inspect finding [OPTIONS] [SELECTOR] [PATH]

axiom inspect readiness

Show explicit blocker and warning counts without an opaque security score.

axiom inspect readiness [OPTIONS] [PATH]

Runtime sessions and audits

Runtime sessions are stored under .axiom/inspector/runtime/ in the workspace. The most recent session is latest.

axiom inspect record

Create a bounded local runtime session, or normalize an existing audit export into one.

axiom inspect record [OPTIONS] --target <TARGET> [PATH]

Without --input, the command creates an empty recording session. Events reach it through the local Inspector API started by serve.

axiom inspect record . --target web

axiom inspect runtime

Inspect a normalized local runtime session.

axiom inspect runtime [OPTIONS] [PATH]

axiom inspect export-audit

Export one canonical, redacted runtime audit bundle. The command prints the bundle's runtime SHA-256.

axiom inspect export-audit [OPTIONS] --output <OUTPUT> [PATH]

axiom inspect import-audit

Import an offline runtime session or extension audit export as a new normalized session.

axiom inspect import-audit [OPTIONS] <INPUT> [PATH]

Snapshots, changes and impact

axiom inspect snapshot

Write a canonical, content-addressed application evidence snapshot. The CLI also caches a copy under .axiom/inspector/snapshots/, named by graph revision.

axiom inspect snapshot --output <OUTPUT> [PATH]

axiom inspect snapshot . --output before.json

axiom inspect validate-snapshot

Verify a snapshot's schema compatibility, references, graph revision and canonical bytes.

axiom inspect validate-snapshot <SNAPSHOT>

axiom inspect diff

Compare two snapshots by semantic identity and classify each change. Use --fail-on to make it a CI gate.

axiom inspect diff [OPTIONS] <BEFORE> <AFTER>

axiom inspect snapshot . --output after.json
axiom inspect diff before.json after.json \
  --fail-on breaking,permission-increase --output changes.json

The human report shows counts of breaking, approval-required, warning and informational changes. When a listed class is present, the command reports that the semantic change policy gate failed and exits non-zero.

axiom inspect impact

Calculate the direct and bounded transitive impact paths of one fact against a baseline snapshot.

axiom inspect impact [OPTIONS] --against <AGAINST> <SELECTOR> [PATH]

axiom inspect impact Home.total_label . --against before.json

Questions and agents

axiom inspect ask

Ask a natural-language question about the workspace. The default deterministic planner runs locally and supports questions about writers, network access, execution, why, and what changed.

axiom inspect ask [OPTIONS] <QUESTION> [PATH]

axiom inspect ask "what changed" . --changes changes.json

The Jev planner Experimental is opt-in, probabilistic and remote. It sends the question (one printable line, at most 512 bytes) and a bounded candidate list through Vercel AI Gateway, and needs an AI Gateway API key in the AI_GATEWAY_API_KEY environment variable. Local evidence remains authoritative, and Jev can abstain. Never treat a planner probability as evidence confidence.

axiom inspect ask "who writes Home.total_label" . --planner jev --allow-remote

axiom inspect answer

Execute a pre-planned, validated axiom-inspector-question/v1 document. Use it when an agent or script has already built the question.

axiom inspect answer [OPTIONS] <QUESTION_FILE> [PATH]

Local dashboard

axiom inspect serve

Launch the secure loopback Axiom Inspector dashboard and its local API for one workspace. The dashboard presents application graphs, source evidence, UI and state, backend operations, dependencies, extension authority, security findings, runtime sessions, changes and Ask Axiom.

axiom inspect serve [OPTIONS] [PATH]

axiom inspect serve .

The server binds to 127.0.0.1 only and prints a URL that carries a random per-session capability token. It is read-only by default and watches the workspace for changes. While it runs, it writes an owner-only .axiom/inspector/live-connection.json so a running application can attach live runtime evidence, and removes it on exit. Press Ctrl-C to stop. See the local dashboard guide for live targets and agent use.

Offline exchange and release checks

axiom inspect export-inspector

Create an explicit, signed offline handoff of application evidence, optionally with runtime and change evidence. The help text names Axiom Studio and Cloud as consumers; Axiom Studio is Coming soon.

axiom inspect export-inspector [OPTIONS] --key <KEY> --output <OUTPUT> [PATH]

The command prints the payload SHA-256. Keep private signing keys owner-only and outside source control.

axiom inspect import-inspector

Verify and unpack a signed Inspector handoff without network access.

axiom inspect import-inspector --output-dir <OUTPUT_DIR> <INPUT>

The directory receives application-evidence.jcs.json, plus runtime-evidence.jcs.json and semantic-changes.jcs.json when the handoff contains them.

axiom inspect release-check

Measure local Inspector release budgets and privacy and offline invariants for a workspace.

axiom inspect release-check [OPTIONS] [PATH]

Machine output rules

Follow these rules when a script, CI job or AI agent consumes Inspector output:

• Use --format json for one complete result.
• Use --format jsonl where record-wise consumption is useful.
• Do not parse human tables or dashboard HTML.
• Treat a non-zero exit status as failure.
• Retain the schema format and graph revision with each result.
• Check completeness and truncation before claiming that something is absent.
• Use exact semantic IDs when a label can be ambiguous.
• Never treat a model planning probability as evidence confidence.

Related pages

• Axiom Inspector
• Inspect an application
• Trace relationships
• Changes and impact
• Runtime evidence, security and audits
• Ask questions
• CLI overview