install & update
enigma install
Install or update the policy skills, memory and slash commands into the agents you select. Auto-detects installed agents; --all targets every supported one, --local installs into the current project instead of user level.
enigma update
Fetch the latest skills from GitHub (no package release needed), sync every deployment, and self-update the enigma-cli package. The new version’s skills, memory and commands are deployed at the end of the same run, so one enigma update leaves the CLI and the policies on the same release.
Launch a tool
Run a coding agent through enigma so it gets your skills, memory and managed settings. Resolution order: explicit account > active profile > the tool’s active account. Pass args to the tool after --.
enigma claude # launch Claude Code (default account)
enigma claude work # a named account
enigma codex -- --version # forward args to the tool
accounts & profiles
Several logins per tool without logging out, each in its own config dir. A profile pins one account per tool and drives every launch.
enigma account <list|add|use|login|rename|remove|provider|sessions|transfer>
Manage tool accounts. Defaults to Claude Code; target another with --tool <name>.
Reuse a session (no re-login)
The same Anthropic login stored in two config dirs (a managed account and a pack context, say) can drift apart: Claude rotates the OAuth refresh token on every refresh and invalidates the previous one, so whichever dir refreshes last keeps working and the other is silently signed out. Instead of re-running /login, reuse the live session - copy it into the signed-out account (its refresh token is all Claude Code needs). Claude only.
enigma account sessions # list reusable logins (accounts + pack contexts)
enigma account transfer work # pull the freshest live session into 'work'
enigma account transfer work pack:helio # or from a specific source
Packs do this automatically: enigma helio keeps its context and the managed account it seeds from on one shared session (freshest token wins on launch, and any refresh is copied back on exit), so enigma claude and the pack never fight. It is also available in the dashboard Accounts tab (“Reuse session” on a signed-out Claude account).
provider points a Claude Code account at another Anthropic-compatible backend (e.g. MiniMax) instead of the default - the default account always stays on Anthropic. Configurable here, in the dashboard Accounts tab, and the TUI (p on an account). The API key is stored encrypted.
enigma account provider work --preset minimax --token <key> # a built-in preset
enigma account provider work --base https://host/anthropic --model my-model --token <key>
enigma account provider work # show the current override
enigma account provider work --clear # back to Anthropic
enigma profile <list|add|use|set|unset|rename|remove>
Group one account per tool under a profile. use none deactivates.
skills
List skills and choose where each one deploys. A skill can be off everywhere (discarded) or off for one agent only - keep a skill for Claude Code but not opencode.
enigma skills <list|disable|enable> [agent]
No agent argument is the global on/off; with an agent it scopes to that agent.
autoskills
Detect the project’s tech stack and install the matching community skills, kept separate from the policy skills. See Autoskills for detail.
enigma autoskills [path]
Scans packages, config files, file types and gems; installs the matched, hash-verified skills into the project. --dry-run previews; -a <agent> limits targets.
recall
Local, searchable memory of your coding sessions, built from your own transcripts and exposed to agents over MCP. Off by default. See Recall for detail.
enigma recall <status|sync|search|list|show|timeline|sessions|context|enrich|prune|clear>
sync reads transcripts into the store; search (hybrid keyword+vector)/list/show/timeline/sessions/context query it; enrich runs optional LLM enrichment; prune bounds it; clear wipes it. Reads only your own local logs.
codegraph
enigma’s native codebase memory / code graph (structural code intelligence), exposed to your agents over MCP - no external tool. Off by default. See Codebase memory for detail.
enigma codegraph <status|on|off|index|projects|arch|search>
on/off toggle the tools; index [path] builds the graph for a project; projects lists indexed projects; arch [project] prints the architecture; search <name> finds symbols by name.
pack
Marketplace of optional, isolated harness packs (e.g. Helio for bug bounty). Each runs in its own agent context, so its skills and commands never load into your normal agent. See Packs for detail.
enigma pack <list|install|remove|update|setup|use|run>
install <id> fetches a pack; enigma <id> [account] (e.g. enigma helio) launches its isolated agent, seeded with the chosen/pinned/active login; use <id> <account|-> pins which account seeds the pack; setup <id> registers the pack’s MCP servers (needs Python); update/remove keep or delete it.
ssh
Save each server once (host, user, key or encrypted password, jump host, port forwards) and reach it with a short alias. See SSH connections for detail.
enigma ssh <alias|name> | <list|add|edit|remove|info|tunnel|forward>
enigma ssh <alias|name> connects (both are unique connect keys; --name sets the second); add/edit save credentials - a stored password is auto-filled with no extra tools (enigma acts as OpenSSH’s SSH_ASKPASS). Tunnels are standalone, bound to a server: enigma ssh tunnel add <name> <server> <spec>, then start/stop <name> bring the background ssh -N up and down, enigma ssh tunnels lists them with live status, edit/rm re-point or delete. info shows a connection; remove deletes one.
security & guard
A portable, dependency-free commit guard that blocks secrets, .env files and dependency dirs. Set it up once per repo and the whole team inherits it.
enigma security
Install the git security hooks into the current repo.
enigma guard [--all]
Run the commit guard over staged files, or --all for every tracked file.
compress
Shrink JSON, logs or text to fewer tokens, reversibly (the original is cached and recoverable via its hash). Reads a file or stdin.
enigma compress [file]
--retrieve <hash> restores an original, --stats shows cumulative savings, --clear wipes all dashboard data, --type forces the content type.
enigma mcp
Run the context-compression MCP server over stdio (used by the agents when compress is on).
guardrails
Enforce project conventions via a post-edit hook that feeds violations back to the agent, plus a turn-end sweep over the lines a change added. On by default. See Convention guardrails for detail.
enigma guardrails [cmd]
No argument lists the rules; check <file> runs them against a file; stats [days] reports which rules the agent keeps breaking, and whether it was stopped or the code shipped anyway, plus a separate table for how often a reply broke the output-style level; disable/enable <id> toggles a built-in; remove <id> drops a custom rule. Toggle the feature with enigma config guardrails on|off.
trim
Remove the blank line agents leave at the end of a file. On by default: it runs after each agent edit and, at commit time, over the staged files, re-staging what it fixed.
enigma trim [--all]
No argument fixes the staged files and re-stages them; --all sweeps every tracked file, which is how you clean a repo retroactively. A file is only changed when it has real content followed by one or more blank lines at the end, so an empty file, a file of only blank lines, and a last line with no closing newline are all left alone. A staged file that also has unstaged edits is fixed on disk but not re-staged, so git add never pulls unrelated work into the commit.
verify
Check that work reported as finished actually is. Runs automatically at turn end (on by default). See Verified completion for detail.
enigma verify [cmd]
No argument checks the current change for evidence of unfinished work, sweeps its added lines for convention violations, and runs the configured verification command; --all sweeps every tracked file; parity <source> <target> compares a codebase against a port or clone of it and reports what was never carried over. Exits non-zero when something is unfinished, so it doubles as a CI check.
api
Serve your local Claude Code over an OpenAI-compatible HTTP API - all of its tools, skills, MCP and sessions, reachable from any OpenAI client library. Loopback-only. See Local API for detail.
enigma api
Endpoints under /v1 (chat/completions, messages, models, sessions). --port <n> overrides the port (else the apiPort config, default 8000); --api-key <k> (or ENIGMA_API_KEY) gates every /v1 route; --tool <t> selects the backing agent. Ctrl+C to stop.
dashboard
A browser control panel for all of enigma - accounts, skills, settings, system cleanup - that also shows real Claude usage and measured savings. Loopback-only by default: nothing leaves your machine.
enigma dashboard
Alias enigma dash. Runs while open by default; enigma config dashboard always keeps a lightweight background daemon. stop shuts down whichever one is serving - a background daemon has no terminal to Ctrl+C.
On a server
With no browser to open (a host reached over SSH), enigma dashboard prints the tunnel command instead of failing. This is the recommended way in: the port stays on loopback and SSH already authenticates whoever reaches it.
ssh -N -L 24282:127.0.0.1:24282 user@host # then open http://localhost:24282
It also offers to expose the dashboard on the network - just this once, or always (dashboard-bind: lan). Because the dashboard can run agents with your credentials, kill processes and rewrite config, exposing it always requires a token: a non-loopback bind refuses to start without one, and every /v1-style /api/* request must carry it.
enigma dashboard --expose
Bind every interface for this run without persisting it, minting a token if needed. enigma config dashboard-bind lan makes it stick; custom + dashboard-bind-address pins one interface (e.g. a Tailscale IP). dashboard token prints the token, --new rotates it and kills every link already handed out.
The printed link carries the token as a URL fragment (http://host:24282/#token=...). A fragment is never sent to the server, so unlike a query string it cannot land in an access log or a Referer header; the page moves it into sessionStorage and strips it from the address bar. Treat that link as a password.
Exposing a dashboard directly to the public internet is not a supported setup - prefer the SSH tunnel or a private network (Tailscale), and put TLS in front of it if it must cross one.
gate
An experimental AI quality gate that validates a branch through a review/test/docs/lint/push/PR/CI pipeline in a disposable worktree before it reaches your push target. On by default; turn it off with enigma config gate off (add -l for this project only). See Quality gate for detail.
enigma gate <init|status|runs|rerun|doctor|eject|daemon|axi>
Enable it with enigma config gate on, then enigma gate init in a repo. init sets up the gate (and the gate git remote); status/runs inspect runs; rerun re-runs the branch; doctor diagnoses; eject removes it; axi is the machine interface the /gate skill drives.
fix-path & issue
enigma fix-path [tool]
Find a tool installed but not on PATH and make enigma <tool> (and the bare command) launch it.
enigma issue [bug|feature]
Open a prefilled GitHub issue with your environment autocompleted.