> ## Documentation Index
> Fetch the complete documentation index at: https://docs.milkstraw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MilkStraw CLI

> Authentication, onboarding, and manage integration from the terminal.

The MilkStraw CLI (`@milkstraw/cli`) is a developer-friendly alternative to the web-based [Quickstart](/quickstart). Use it to start or maintain your MilkStraw integration without leaving your terminal.

<Note>
  **Prerequisites**

  * An active [MilkStraw AI](https://app.milkstraw.ai) account
  * The [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html#getting-started-install-instructions) installed and configured
  * AWS credentials with access to your AWS Organization management account
  * The Engineer, Admin, or Owner [role](/roles) to run commands for an organization
</Note>

## Configure AWS credentials

Set up credentials using one of:

```bash theme={null}
aws configure      # Access key + secret
aws configure sso  # SSO login (recommended)
```

Verify your credentials are working:

```bash theme={null}
aws sts get-caller-identity
```

## Quick start

Run `setup` to authenticate, setup and deploy the MilkStraw cross role through CloudFormation stacks into your AWS organization:

```bash theme={null}
npx @milkstraw/cli setup
```

## Commands

| Command | Description |
| - | - |
| `milkstraw login` | Interactive browser login |
| `milkstraw logout` | Revoke token and clear local auth |
| `milkstraw setup` | Complete onboarding and deploy stacks |
| `milkstraw status` | Check deployment status |
| `milkstraw update` | Update deployed stacks to latest templates |
| `milkstraw org list` | List accessible organizations |

### Inventory

| Command | Description |
| - | - |
| `milkstraw inventory ec2 list` | List EC2 on-demand instances |
| `milkstraw inventory rds list` | List RDS on-demand instances |
| `milkstraw inventory elasticache list` | List ElastiCache on-demand clusters |
| `milkstraw inventory opensearch list` | List OpenSearch on-demand clusters |
| `milkstraw inventory opensearch nodes list` | List OpenSearch nodes across all clusters |
| `milkstraw inventory eks list` | List EKS clusters |
| `milkstraw inventory eks nodegroups list` | List EKS node groups across all clusters |
| `milkstraw inventory ebs list` | List EBS volumes |

### Commitments

| Command | Description |
| - | - |
| `milkstraw commitments ec2 list` | List EC2 Reserved Instances |
| `milkstraw commitments rds list` | List RDS Reserved Instances |
| `milkstraw commitments elasticache list` | List ElastiCache Reserved Instances |
| `milkstraw commitments opensearch list` | List OpenSearch Reserved Instances |
| `milkstraw commitments savings_plans compute list` | List Compute Savings Plans |
| `milkstraw commitments savings_plans ec2_instance list` | List EC2 Instance Savings Plans |
| `milkstraw commitments savings_plans sage_maker list` | List SageMaker Savings Plans |
| `milkstraw commitments savings_plans database list` | List Database Savings Plans |

## Global options

| Option | Description |
| - | - |
| `--org <id>` | Specify organization ID |
| `--aws-profile <name>` | Override the AWS named profile |
| `--json` | Output as JSON |
| `--quiet` | Output data only |
| `--markdown` | Output as Markdown |
| `--verbose` | Enable verbose output |
| `--agent` | Agent-safe mode (no prompts, no spinners) |

## Environment variables

| Variable | Description |
| - | - |
| `MILKSTRAW_ORG` | Default organization ID |
| `MILKSTRAW_AWS_PROFILE` | Default AWS profile name |

## AWS credential resolution

The CLI uses the AWS SDK for JavaScript v3 credential provider chain.

Without `--aws-profile`, credentials are resolved in this order:

1. Environment variables: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`
2. SSO token cache at `~/.aws/sso/cache`
3. Shared credentials file at `~/.aws/credentials` (default profile)
4. Shared config file at `~/.aws/config`
5. ECS container or EC2 instance metadata

With `--aws-profile <name>` (or `MILKSTRAW_AWS_PROFILE`), the SDK skips environment variables and uses the named profile from `~/.aws/config` and `~/.aws/credentials`.

## Authentication

Tokens are stored at `~/.config/milkstraw-cli/token`. Login uses the OAuth device code flow via your browser.

Run `milkstraw logout` at any time to revoke the token and clear local auth.

Tokens expire after 90 days. You can also revoke a token in the app: open **Settings** > **Security**, find the token under **Access tokens**, and click **Revoke token**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.