All commands are in one binary. Run tacit help to see the same list in your terminal. If you run a command with wrong arguments, the command shows its own usage.

Set up and connect

Command	What it does
tacit init	Set up a registry on this machine: configuration, API key, starter techniques, semantic retrieval, and an owner to sign in as. At a terminal it then serves the registry and prints the sign-in link; in a script it returns. It installs no service — tacit secure does that when you turn on sign-in, or ask for one with --service auto. It is safe to run the command again. Flags: --embeddings (on, off, auto), --service (systemd, launchd, none, auto; default none), --owner (on, off, auto), --global-access (on, off, auto), --port, --start-over (set up a new registry where a merged one was).
tacit join <join-url>	Join a registry from an invite link. Then wire this machine's harnesses.
tacit connect [--registry URL --key K] [--harness NAME]	Point this machine at a registry and wire its AI tools (all tools found, or one). The command saves member settings in ~/.config/tacit/agent.env and makes sure that they are correct, then wires. With no flags, it reports where this machine points and re-wires. Also: --segment team=…,role=…, --session-salt, and --settings-only for a machine with no AI tool on it.
tacit disconnect [--harness NAME] [--registry --yes]	The opposite of connect: unwire harnesses and retire member settings. With --registry --yes, the command also removes this machine's registry service.
tacit invite [--ttl 24h] [--repo]	Make a join link that a teammate can run. --repo also commits a keyless registry marker to the repository.

Day to day

Command	What it does
tacit audit <source>	Audit a conversation against the organization's playbook. The source is a share URL, a transcript file, a captured session file, or - with --text. --live <session-id> audits a session turn by turn as it runs.
tacit feedback <technique-id> --stage <stage>	Record feedback for a technique. The stage is one of: shown, adopted, helped, or dismissed. helped also records the adoption. For a dismissal, add --reason (not-relevant, already-knew, didnt-work).
tacit revise <technique-id> --<field> <value> [--note …]	Propose a change to a technique as a revision draft. The command changes only the fields that you pass.
tacit usage [--window 30d]	Show your OWN OpenTacit activity from this machine's local log: queries, and suggestions shown, adopted, helped, and dismissed. It includes a breakdown for each technique. Use --json or --html for other formats. The dashboard's Usage view shows the same numbers.
tacit statusline	Show the status-line segment for your harness: session counters and health warnings.

Operate the registry

Command	What it does
tacit serve	Run the registry service in the foreground. Flags: --host, --port, --data, --db, --techniques, --docs.
tacit secure [--off]	Turn dashboard sign-in on with your identity provider, from the console of the registry machine. A single-owner registry can do the same thing with the Personal/Shared switch on Settings → Access & sign-in; this command is the way when the dashboard has no administrator, or when its sign-in already locks you out. The command derives the callback URL, tests the issuer's discovery document before it writes, completes all four TACIT_OIDC_* settings together, makes a session secret, and restarts. --off removes the settings and opens the dashboard again: it is the way back in when a sign-in configuration locks you out. Also: --dry-run, --issuer, --client-id, --client-secret, --callback, --admins, --yes, --no-restart. See Turn on sign-in.
tacit suggest [--n 10]	Research practices that match observed usage, and file them as drafts. The drafts are general, not org-scoped. The Suggest candidate techniques button on Review does the same.
tacit digest [--window 7d]	Make the team digest as markdown. --out writes a file. --slack <webhook> posts it.
tacit demo load [--scenario <key>]	Fill a registry with a month of demonstration usage. Without --force, the command refuses a busy target. Also: demo scenarios, demo generate.
tacit migrate-store --db <url>	Copy the embedded file store into Postgres. It is safe to run the command again. The command accepts --dry-run.
tacit feed export --channel <ch> --out <dir>	Export a federation channel as static files. You can host the files anywhere.

Diagnose and maintain

Command	What it does
tacit doctor [flags]	Is OpenTacit working here? Checks this machine's wiring in both roles. On a registry machine it also reports what the registry exposes: whether sign-in is on, and whether its settings are coherent. --harness <name> makes sure that one hook path operates end to end. --deliver arms the next turn to deliver one ◆ block, so you see whether suggestions render where you sit; --deliver-status reports what became of it. --fix repairs a rejected key. --probe is a bare liveness check: one request to /v1/health, exit 0/1, for container health checks and probes.
tacit upgrade [--version vX.Y.Z]	Replace this binary with a released build, and restart the service if one runs here. The command makes sure that the checksum is correct first. In a container, the command refuses. Pull a newer image tag instead.
tacit version	Print the build version.

Plumbing

You do not usually run these commands yourself. The plugins and services run them:

Command	What it does
tacit serve-hooks	Run the local in-harness agent. The relay starts it on demand. It stops after 15 minutes without activity.
tacit hook-relay <harness>	Forward one hook event to the local agent. If the agent is not active, the relay starts it. Harness hooks invoke this command.
tacit mcp	Run the MCP server (stdio). It gives these tools: tacit_search (pull retrieval), tacit_metrics (funnel / cohorts / map views), tacit_drafts and tacit_draft_action (review), and tacit_usage (this machine's own activity).

Configuration files

File	Role
~/.config/tacit/agent.env	Member settings. connect and join write this file
~/.config/tacit/registry.env	Registry settings. init and the setup form write this file
~/.tacit-key.env	Your optional model API key (TACIT_LLM_API_KEY) for the local agent

Both .env files are plain KEY=VALUE. Environment variables override them. Each command's own documentation has the full list of variables. Configure the registry shows the variables that you usually set by hand.