The aikidoctl CLI
aikidoctl is a command-line help tool that ships with Aikido Device Protection. It provides utilities to inspect, control, and troubleshoot the agent when something goes wrong.
Usage
aikidoctl [global options] command [command options]aikidoctl.exe [global options] command [command options]aikidoctl [global options] command [command options]Run aikidoctl help (or aikidoctl <command> --help) at any time to list the available commands and options. On Windows, use aikidoctl.exe.
Commands
Not every command is available on every platform. The Not available on column lists where a command is missing. An empty cell means it works everywhere.
| Command | Not available on | Description |
|---|---|---|
certs | Windows, Linux | Manage CA certificates. |
certconfig | Manage per-tool certificate trust configuration (node, git, java, etc.). | |
pause | Pause Aikido Device Protection for a specified duration. This fully disables all protection on the device while paused. | |
unpause | Resume Aikido Device Protection if it is currently paused. | |
sbom | Linux | Inspect the software bill of materials (SBOM) collection. |
secretscanning | Windows, Linux | Inspect on-device secret scanning. |
device-identity | macOS, Linux | Show or reset the identity the device registers with. Run device-identity reset on a machine created from a VM clone or snapshot. See Cloned VMs and images. |
diagnostics | Collect and submit diagnostics to Aikido. | |
request | List packages blocked pending admin approval, and send that request with aikidoctl request. See Request a Blocked Install from the Command Line. | |
restart-daemon | Linux | Restart the Aikido Device Protection daemon. |
version | Show the installed Device Protection version, build details, and service state. | |
help, h | Show a list of commands or help for one command. |
To add your organization's own CA to the certificate bundles Aikido builds, see Adding a Custom CA Certificate.
Cloned VMs and images
A device's identity is created when the agent first registers. If you install Device Protection on a VM and then clone or snapshot that VM, every machine created from it carries the same identity, so they all collapse into a single entry in your device list and you lose visibility on all but one.
On Windows, after deploying a clone or snapshot:
- Give the machine its own hostname.
- Reset the device identity:
aikidoctl.exe device-identity resetThe machine then registers as its own device on the next check-in. Remove the stale shared entry from your device list if one is already there.
On Linux, device identity follows /etc/machine-id instead. Truncate that file as the last step of your image build so each machine generates its own ID on first boot.
Global options
| Option | Description |
|---|---|
--simple | Print only the installed Device Protection version, for scripts. |
--help, -h | Show help. |
--version, -v | Print the version. |