Commands Reference

All commands follow the pattern:

thinkwork <command> [subcommand] [options]

The CLI has two command surfaces:

Deploy side — login, init, plan, deploy, bootstrap, destroy, doctor, status, outputs, config. Shells out to terraform and aws. Needs AWS credentials.
API side — login --stage, me, logout, user, member, thread, agent, inbox, routine, and everything else in the roadmap. Talks to the deployed GraphQL + REST APIs. Needs a Cognito or api-key session.

Run thinkwork <any-command> --help for the definitive, up-to-date flags and examples — every command ships interactive + scripted examples inline.

Global options

These are accepted on every command:

Flag	Description
`-p, --profile <name>`	AWS profile (overrides `$AWS_PROFILE` and the CLI’s `defaultProfile`)
`--json`	Emit machine-readable JSON on stdout. Logs/spinners stay on stderr.
`-h, --help`	Print help for the current command
`-v, --version`	Print CLI version (program-level only)

API-backed commands additionally accept:

Flag	Description
`-s, --stage <name>`	Stage to target. Falls back to `$THINKWORK_STAGE`, then the saved `defaultStage`.
`-t, --tenant <slug>`	Tenant slug. Falls back to `$THINKWORK_TENANT`, then the cached session tenant.
`-y, --yes`	Skip confirmation on destructive verbs.

Two modes, selected by --stage.

thinkwork login [options]
thinkwork login --stage <s> [options]

Without --stage — configure AWS credentials (arrow-key picker over ~/.aws/ profiles, with fall-through to access-key entry or aws sso login):

Flag	Description
`--profile <name>`	AWS profile to create/update (default: `thinkwork`)
`--sso`	Skip the picker and run `aws sso login`
`--keys`	Skip the picker and prompt for fresh access keys

With --stage <s> — sign in to the deployed Cognito user pool:

Flag	Description
`-s, --stage <name>`	Deployed stage to sign in to
`-r, --region <region>`	AWS region for the stack (default: `us-east-1`)
`--api-key <secret>`	Non-interactive; skip the browser and store the api_auth_secret as the session
`--tenant <slug>`	Cache this tenant slug on the session (with `--api-key`, or to override `bootstrapUser`’s default)
`--port <number>`	Override the Cognito OAuth loopback port (default: 42010)
`--no-browser`	Print the authorize URL instead of opening a browser (useful over SSH)

Examples:

# AWS profile picker (before deploy/destroy/list)
thinkwork login

# Skip picker, enter fresh keys
thinkwork login --keys --profile thinkwork

# AWS SSO
thinkwork login --sso --profile work-sso

# Cognito OAuth (opens browser, supports Google sign-in)
thinkwork login --stage dev

# Cognito over SSH — print URL, paste into a local browser
thinkwork login --stage dev --no-browser

# Non-interactive CI login with the api_auth_secret
thinkwork login --stage prod --api-key "$THINKWORK_API_KEY" --tenant acme

logout

Forget stored stack sessions. Touches only ~/.thinkwork/config.json; your AWS profile and Cognito pool are untouched.

thinkwork logout [options]

Flag	Description
`-s, --stage <name>`	Stage whose session to forget
`--all`	Forget every stage’s session

Examples:

thinkwork logout --stage dev       # one stage
thinkwork logout --all             # every stage
thinkwork logout                   # interactive picker

me

Print the identity behind the current session. Verifies the session works by round-tripping a live me GraphQL query.

thinkwork me [options]

Flag	Description
`-s, --stage <name>`	Stage to introspect
`-r, --region <region>`	AWS region (default: `us-east-1`)

Examples:

thinkwork me                                       # default stage
thinkwork me --stage prod
thinkwork me --stage dev --json | jq .tenantSlug   # scriptable

init

Scaffold a new ThinkWork deployment directory.

thinkwork init -s <stage> [options]

Flag	Description
`-s, --stage <name>`	Stage name (required)
`-d, --dir <path>`	Target directory (default: `.`)
`--defaults`	Skip interactive prompts, use all defaults

Example:

mkdir my-deploy && cd my-deploy
thinkwork init -s dev

Creates terraform.tfvars + terraform module scaffolding + ~/.thinkwork/environments/<stage>/config.json. See the CLI Overview for the registry layout.

plan

Preview Terraform changes.

thinkwork plan -s <stage> [options]

Flag	Description
`-s, --stage <name>`	Stage name (required)
`-c, --component <tier>`	`foundation`, `data`, `app`, or `all` (default: `all`)
`-p, --profile <name>`	AWS profile override

Example:

thinkwork plan -s dev
thinkwork plan -s dev -c app     # only the app tier

deploy

Apply the Terraform plan.

thinkwork deploy -s <stage> [options]

Flag	Description
`-s, --stage <name>`	Stage name (required)
`-c, --component <tier>`	`foundation`, `data`, `app`, or `all` (default: `all`)
`-y, --yes`	Skip confirmation (CI)
`-p, --profile <name>`	AWS profile override

Examples:

thinkwork deploy -s dev
thinkwork deploy -s prod --yes
thinkwork deploy -s dev -c app

bootstrap

Seed workspace defaults, the skill catalog, and per-tenant files for a deployed stack.

thinkwork bootstrap -s <stage>

Flag	Description
`-s, --stage <name>`	Stage name (required)

Idempotent — safe to re-run after every deploy.

doctor

Check AWS account prerequisites for a Thinkwork deployment (Bedrock access, IAM, etc.).

thinkwork doctor -s <stage>

Flag	Description
`-s, --stage <name>`	Stage name (required)
`-p, --profile <name>`	AWS profile override

destroy

Tear down the stack.

thinkwork destroy -s <stage> [options]

Flag	Description
`-s, --stage <name>`	Stage name (required)
`-c, --component <tier>`	`foundation`, `data`, `app`, or `all`
`-y, --yes`	Skip confirmation

status

Discover all deployed environments and their health.

thinkwork status [-s <stage>]

Without -s, prints a table of every deployed stage across the account.

With -s, prints the detailed view for one stage — Lambda counts, AgentCore, memory backends, etc.

Aliases: list, ls.

outputs

Print Terraform outputs for a deployed stage.

thinkwork outputs -s <stage> [options]

Flag	Description
`-s, --stage <name>`	Stage name (required)
`-c, --component <tier>`	Tier to read from (default: `all`)

Use --json to pipe the outputs to jq / terraform / other tools.

config

View or edit CLI configuration for a stage.

thinkwork config <subcommand> [options]

config list

thinkwork config list [-s <stage>]

Without -s: table of all initialized environments. With -s: full config for that environment (secrets masked).

config get

thinkwork config get <key> -s <stage>

config set

thinkwork config set <key> <value> -s <stage>

Updates terraform.tfvars. Run thinkwork deploy -s <stage> to apply.

user

User-management utilities for a deployed stack.

user invite

thinkwork user invite [email] [options]

Creates the Cognito user (Cognito emails a temporary password) and adds them as a tenant member. Prompts interactively for any missing fields.

Flag	Description
`-s, --stage <name>`	Deployment stage
`--tenant <slug>`	Tenant slug
`--name <name>`	Display name
`--role <role>`	`member` (default), `admin`, or `owner`
`--region <region>`	AWS region (default: `us-east-1`)

Examples:

# Fully interactive
thinkwork user invite

# Scripted
thinkwork user invite alice@example.com --tenant acme -s dev --role admin

# Mix
thinkwork user invite alice@example.com

user reset-password

thinkwork user reset-password <email> -s <stage>

Triggers Cognito’s admin-initiated forgot-password flow — useful when a user is locked out or in FORCE_CHANGE_PASSWORD.

mcp

Manage MCP servers (Model Context Protocol) for a tenant.

mcp list / add / remove / test / assign / unassign

thinkwork mcp list --tenant <slug> -s <stage>
thinkwork mcp add <name> --url <url> --tenant <slug> -s <stage> [options]
thinkwork mcp remove <server-id> --tenant <slug> -s <stage>
thinkwork mcp test <server-id> --tenant <slug> -s <stage>
thinkwork mcp assign <server-id> --agent <agent-id> -s <stage>
thinkwork mcp unassign <server-id> --agent <agent-id> -s <stage>

Run thinkwork mcp <sub> --help for the full options list on each subcommand, including --auth-type (none | tenant_api_key | oauth) and --transport (streamable-http | sse).

mcp key create / list / revoke

Per-tenant Bearer tokens for the admin-ops MCP server (served at mcp.thinkwork.ai/mcp/admin). Each token is scoped to one tenant; callers present it as Authorization: Bearer tkm_… against the admin-ops HTTP endpoint.

# Mint a new tkm_ token (printed ONCE — save it immediately)
thinkwork mcp key create -t <tenant-slug> [--name <label>] -s <stage>

# List existing keys for a tenant (metadata only; raw tokens never returned)
thinkwork mcp key list -t <tenant-slug> [--all] -s <stage>   # --all includes revoked rows

# Revoke a key by id (idempotent)
thinkwork mcp key revoke <key-id> -t <tenant-slug> -s <stage>

Server-side the token is stored as a SHA-256 hash in tenant_mcp_admin_keys; the raw value lives only in Secrets Manager at /thinkwork/<stage>/mcp/<tenantId>/<server-slug>. Rotate by creating a new key + revoking the old one.

mcp provision

One-shot idempotent provisioning of the admin-ops MCP for a tenant: mints a fresh tkm_ token, stores it in Secrets Manager, and upserts the matching tenant_mcp_servers row so agents can subscribe.

# Single tenant (interactive picker or -t)
thinkwork mcp provision -t <slug> [--url https://mcp.thinkwork.ai/mcp/admin] -s <stage>

# Backfill every tenant at once
thinkwork mcp provision --all -s <stage>

The raw token is not printed by provision — it only lives in Secrets Manager + the tenant_mcp_servers.auth_config row. Re-running provision rotates the “default” key and retires the previous one. After provisioning, each agent still needs the server assigned via thinkwork mcp assign (or the admin SPA’s MCP Servers tab).

The admin SPA’s Agent Templates → MCP Servers tab also exposes a Generate and save a new key button for tenant_api_key servers that calls the same provision path — admins don’t need the CLI for the common case.

tools

Manage credentialed tenant built-in tool configuration. Today this command manages Web Search provider keys; policy/template-gated built-ins such as Code Sandbox, Browser Automation, and Send Email are configured in the admin app.

thinkwork tools list
thinkwork tools web-search set|test|disable|clear

Run thinkwork tools --help for the full subcommand tree.

Use Admin → Built-in Tools to inspect the full built-in catalog, and Admin → Agent Templates to opt templates into execute_code, browser_automation, web_search, and send_email.

update

Upgrade the CLI’s bundled Terraform modules to match the installed CLI version.

thinkwork update -s <stage>

wiki

Admin-only. Operator controls for the Compounding Memory (wiki) compile pipeline. Enqueue compiles, rebuild from scratch, and inspect recent job activity from a terminal.

The underlying GraphQL mutations assert api-key or admin-promoted tenant membership — Cognito end-user sessions get a clear “admin access required” hint and exit code 2.

wiki compile

Enqueue a compile for one agent or fan out across every tenant agent.

thinkwork wiki compile [-t <tenant>] [--agent <id>] [--all] [--model <id>] [--watch] [--json]

--agent <id|slug|name> — single-agent mode. Bypasses the picker.
--all — fan out to every non-system agent in the tenant. One enqueue per agent; dedupe is handled server-side.
--model <id> — Bedrock model override for this run only (e.g. anthropic.claude-sonnet-4-6-v1:0). Defaults to the server’s BEDROCK_MODEL_ID. The override travels via the Lambda Event payload; if the invoke fails and a polling worker later claims the job, the env-default model is used.
--watch — after enqueue, poll wiki_compile_jobs until the job reaches a terminal state. Single-agent only; ignored with --all.

wiki rebuild

Destructive. Archive the agent’s active wiki pages, clear the compile cursor, then enqueue a fresh compile. Single-agent only — --all is rejected to avoid accidental tenant-wide rebuilds.

thinkwork wiki rebuild -t <tenant> --agent <id> [--model <id>] [--yes] [--watch] [--json]

Prompts for confirmation unless --yes or --json.
If the reset succeeds but the compile enqueue fails, the command exits 1 with the exact retry command (thinkwork wiki compile --agent <id>) so you don’t need to re-run the destructive step.

wiki status

Show recent compile jobs for a tenant, optionally filtered to a single agent.

thinkwork wiki status [-t <tenant>] [--agent <id>] [-n <limit>] [--watch] [--timeout <sec>] [--json]

Omit --agent for tenant-wide recent activity (useful for spotting stalled or repeatedly-failing agents).
--watch polls the most-recent job until it reaches a terminal state, with a 15-minute default timeout (--timeout).

Roadmap — scaffolded commands

The commands below are scaffolded in Phase 0 — thinkwork <cmd> --help shows the final flags and examples today, but the action bodies return not yet implemented (exit code 2) until each phase PR lands.

Phase	Commands
1 — Work & approvals	`thread`, `message`, `label`, `inbox`
2 — Agents & workspace	`agent`, `template`, `tenant`, `member`, `team`, `kb`
3 — Automation & integrations	`routine`, `scheduled-job`, `turn`, `wakeup`, `webhook`, `connector`, `skill`
4 — Memory & artifacts	`memory`, `recipe`, `artifact`
5 — Observability & spend	`cost`, `budget`, `performance`, `trace`, `dashboard`

The sections below summarize each group. For definitive, up-to-date flags + examples, run thinkwork <cmd> --help.

thread

Create, list, update, close, comment, checkout/release, escalate, delegate, and delete threads (tasks, chats, bugs, questions).

thinkwork thread list [--status] [--priority] [--assignee] [--search] [--agent]
thinkwork thread get <idOrNumber>
thinkwork thread create [title] [--type] [--priority] [--assignee] [--body] [--due] [--label ...]
thinkwork thread update <id> [--title] [--status] [--priority] [--assignee] [--due] [--body]
thinkwork thread close|reopen <id>
thinkwork thread checkout|release <id> [--agent]
thinkwork thread comment <id> [content] [--file]
thinkwork thread label assign|remove <threadId> <labelId>
thinkwork thread escalate|delegate <id> --to-agent <id>
thinkwork thread delete <id> [--yes]

message

thinkwork message send <threadId> [content] [--file] [--as-agent <id>]
thinkwork message list <threadId> [--limit] [--cursor]

label

thinkwork label list | create [name] [--color] [--description] | update <id> | delete <id>

inbox

Approval flows for agent-proposed changes.

thinkwork inbox list [--status PENDING] [--mine]
thinkwork inbox get <id>
thinkwork inbox approve <id> [--notes]
thinkwork inbox reject <id> [--notes]
thinkwork inbox request-revision <id> --notes <text>
thinkwork inbox resubmit <id> [--notes]
thinkwork inbox cancel <id>
thinkwork inbox comment <id> [content] [--file]

agent

Agent lifecycle + capabilities, skills, budgets, API keys, email, and version history. Largest command group.

thinkwork agent list | get <id> | create [name] [--template] [--role] [--type] [--system-prompt-file]
thinkwork agent update <id> | delete <id> | status <id> <status> | unpause <id>
thinkwork agent capabilities set <id> --capability <name> [--enabled|--disabled]
thinkwork agent skills set <id> --skill <id> [--enabled|--disabled] [--config <json>] [--rate-limit]
thinkwork agent budget set <id> --limit-usd <n> [--window] [--action PAUSE|ALERT]
thinkwork agent budget clear <id>
thinkwork agent api-key create <id> --name <n> [--expires]
thinkwork agent api-key list <id> | revoke <keyId>
thinkwork agent email enable <id> [--local-part] | disable <id> | allowlist <id> <senders...>
thinkwork agent version list <id> | rollback <id> <versionId>

template

Agent templates (reusable config for spawning agents) and template-linked sync.

thinkwork template list | get <id> | create [name] [--from-agent] [--system-prompt-file]
thinkwork template update <id> | delete <id>
thinkwork template diff <templateId> <agentId>
thinkwork template sync-agent <templateId> <agentId>
thinkwork template sync-all <templateId>

tenant

Tenant (workspace) CRUD + settings.

thinkwork tenant list | get <idOrSlug> | create [name] [--slug] [--plan] [--issue-prefix]
thinkwork tenant update <id> [--name] [--plan] [--issue-prefix]
thinkwork tenant settings get|set [--default-model] [--monthly-budget-usd] [--max-agents] [--auto-close-after-days] [--feature key=value]

member

thinkwork member list [--principal-type] [--role]
thinkwork member invite [email] [--role] [--name]
thinkwork member update <id> [--role] [--status]
thinkwork member remove <id> [--yes]

team

thinkwork team list | get <id> | create [name] [--description] [--budget-usd]
thinkwork team update <id> | delete <id>
thinkwork team add-agent|remove-agent <teamId> <agentId>
thinkwork team add-user|remove-user <teamId> <userId>

kb

Knowledge bases (Bedrock-backed RAG) and agent attachments.

thinkwork kb list | get <id> | create [name] [--s3-uri] [--embedding-model]
thinkwork kb update <id> | delete <id> | sync <id> [--wait]
thinkwork kb attach|detach <kbId> --agent <id> [--config <json>]

routine

Saved workflows with triggers and run history.

thinkwork routine list | get <id> | create [name] [--agent|--team] [--config-file]
thinkwork routine update <id> | delete <id>
thinkwork routine trigger <id> [--wait] [--input <json>]
thinkwork routine run list <routineId> | get <runId>
thinkwork routine trigger-config set <routineId> --type CRON|WEBHOOK|EVENT [--schedule]
thinkwork routine trigger-config delete <triggerId>

scheduled-job

AWS-Scheduler-backed recurring agent jobs. Alias: cron.

thinkwork scheduled-job list | get <id> | create [name] [--agent|--routine] --schedule <cron|rate>
thinkwork scheduled-job update <id> | delete <id> | run <id> [--wait]

turn

Inspect and cancel in-flight agent invocations (thread turns).

thinkwork turn list [--agent] [--routine] [--thread] [--status] [--limit]
thinkwork turn get <id>
thinkwork turn cancel <id> [--yes]

wakeup

Queued deferred agent invocations.

thinkwork wakeup list
thinkwork wakeup create --agent <id> [--thread] [--delay-seconds] [--payload <json>]

webhook

Inbound webhooks that dispatch agents or routines.

thinkwork webhook list | get <id> | create [name] --target-type AGENT|ROUTINE --target-id <id> [--rate-limit]
thinkwork webhook update <id> | delete <id>
thinkwork webhook test <id> [--payload <json>] | rotate <id> | deliveries <id> [--limit]

connector

Third-party integrations (Slack, GitHub, Linear, …).

thinkwork connector list [--enabled-only] | get <slug>
thinkwork connector enable <slug> [--config <json>] [--config-file]
thinkwork connector disable <slug> | test <slug>

skill

Browse the catalog, install, upgrade, or publish custom skills.

thinkwork skill catalog [--search] [--tag]
thinkwork skill list [--custom-only]
thinkwork skill install <slug> [--version]
thinkwork skill upgrade <slug>
thinkwork skill create [slug] [--name] [--description] [--manifest-file] [--endpoint]
thinkwork skill update <slug> | delete <slug>

memory

Inspect, search, and edit an agent’s managed memory (AgentCore / Hindsight) and memory graph.

thinkwork memory list --agent <id> [--namespace semantic|preferences|episodes|reflections]
thinkwork memory search --agent <id> --query <q> [--strategy] [--limit]
thinkwork memory get <recordId> | update <recordId> --content <text> | delete <recordId>
thinkwork memory graph --agent <id>

recipe

Saved MCP tool invocations (parameterized one-click actions).

thinkwork recipe list [--thread] [--agent] | get <id>
thinkwork recipe create [name] --tool <slug> [--params <json>] [--scope tenant|agent|thread]
thinkwork recipe update <id> | delete <id>

artifact

Agent-produced markdown outputs (reports, data-views, notes, plans, drafts, digests). Read-only in v1.

thinkwork artifact list [--thread] [--agent] [--type] [--status]
thinkwork artifact get <id> [--raw]

cost

thinkwork cost summary [--from] [--to]
thinkwork cost by-agent [--sort cost|requests]
thinkwork cost by-model
thinkwork cost series [--days]

budget

thinkwork budget list | status
thinkwork budget upsert --limit-usd <n> [--scope tenant|agent] [--agent] [--window] [--action PAUSE|ALERT]
thinkwork budget delete <id>

performance

thinkwork performance agents [--from] [--to] [--sort cost|errors|latency|requests]
thinkwork performance agent <id> [--days]

trace

thinkwork trace thread <threadId> [--since]
thinkwork trace turn <turnId> [--raw]

dashboard

thinkwork dashboard

One-screen snapshot — agents online, open threads, pending approvals, spend-to-date.