Commands Reference

All commands follow the pattern:

thinkwork <command> [options]

The -s / --stage flag selects the named environment profile. It’s required for most commands.

---

login

Create or update a named environment profile.

thinkwork login [options]

Options:

Flag	Description
--name <name>	Environment name (skips the prompt)
--region <region>	AWS region (skips the prompt)
--profile <profile>	AWS credentials profile (skips the prompt)

Interactive example:

thinkwork login
# ? Environment name: dev
# ? AWS region: us-east-1
# ? AWS credentials profile: default
# ✓ Environment "dev" saved to ~/.thinkwork/environments/dev.json

Non-interactive example (for scripting):

thinkwork login --name prod --region us-east-1 --profile prod-role

---

init

Scaffold a new ThinkWork deployment directory.

thinkwork init [options] [directory]

Options:

Flag	Description
-s, --stage <name>	Stage name (required)
--template <name>	Starter template: default, minimal, enterprise
--no-git	Skip creating .gitignore entries

Example:

mkdir my-deploy && cd my-deploy
thinkwork init -s dev

Creates in the current directory:

terraform.tfvars          # Pre-filled with your AWS account ID and region
.terraform.lock.hcl       # Provider version lock
.gitignore                # Ignores .terraform/, *.tfstate, terraform.tfvars
.thinkwork/
  stage.json              # Links this directory to the "dev" environment

Templates:

• default — Full deployment with all modules (recommended)
• minimal — Agents and Threads only, no Connectors or Automations
• enterprise — Full deployment with multi-AZ HA and Hindsight memory

---

plan

Preview Terraform changes without applying them.

thinkwork plan -s <stage> [options]

Options:

Flag	Description
-s, --stage <name>	Stage name (required)
--out <file>	Save plan to file (for use with deploy --plan-file)
--target <resource>	Limit plan to a specific resource (passed to terraform plan -target)

Example:

thinkwork plan -s dev

Planning changes for stage: dev (us-east-1)

~ 3 resources to update
+ 1 resource to add
- 0 resources to destroy

  ~ aws_lambda_function.agentcore — container_image_uri changed
  ~ aws_appsync_graphql_api.api — log_config changed
  ~ aws_cloudfront_distribution.admin — viewer_certificate changed
  + aws_ssm_parameter.new_setting

Plan saved. Run `thinkwork deploy -s dev` to apply.

---

deploy

Apply the Terraform plan and deploy ThinkWork.

thinkwork deploy -s <stage> [options]

Options:

Flag	Description
-s, --stage <name>	Stage name (required)
--auto-approve	Skip the confirmation prompt (for CI)
--plan-file <file>	Apply a saved plan from thinkwork plan --out
--target <resource>	Apply only a specific resource

Example — interactive:

thinkwork deploy -s dev
# Shows plan summary, prompts: "Apply? (yes/no)"

Example — CI (non-interactive):

thinkwork deploy -s prod --auto-approve

Example — targeted deploy:

thinkwork deploy -s dev --target aws_lambda_function.agentcore

Caution

--auto-approve bypasses the confirmation prompt. Do not use in scripts that run against production without gating on a manual approval step in your CI pipeline.

---

bootstrap

Create the S3 bucket and DynamoDB table for Terraform remote state.

thinkwork bootstrap -s <stage> [options]

Options:

Flag	Description
-s, --stage <name>	Stage name (required)
--bucket-name <name>	Override the default bucket name
--table-name <name>	Override the default DynamoDB table name

Example:

thinkwork bootstrap -s prod
# ✓ Created S3 bucket: thinkwork-prod-tfstate-123456789012
# ✓ Created DynamoDB table: thinkwork-prod-tfstate-lock
# ✓ Updated terraform.tfvars with backend configuration

Run this before the first deploy in a new environment. deploy runs bootstrap automatically if remote state isn’t configured, but running it explicitly is useful in CI to separate state setup from apply.

---

doctor

Run health checks against a deployed ThinkWork environment.

thinkwork doctor -s <stage> [options]

Options:

Flag	Description
-s, --stage <name>	Stage name (required)
--check <name>	Run only a specific check (e.g. aurora, bedrock, appsync)
--verbose	Print full check output including response bodies

Example:

thinkwork doctor -s dev

Checks performed:

Check	What it tests
terraform-state	Remote state bucket is readable
aurora	Database cluster status is available, migrations are current
cognito	User pool is Active, app client is configured
appsync	API endpoint returns 200 on introspection
api-gateway	Health endpoint returns 200
agentcore	Lambda invoke returns 200 (warm ping)
bedrock	Default model is accessible in the region
s3-skills	Skill catalog bucket is accessible
ses	Sending identity is verified
knowledge-base	Bedrock KB status is ACTIVE (if created)

---

destroy

Destroy all ThinkWork infrastructure for a stage.

thinkwork destroy -s <stage> [options]

Options:

Flag	Description
-s, --stage <name>	Stage name (required)
--auto-approve	Skip the confirmation prompt
--target <resource>	Destroy only a specific resource

Example:

thinkwork destroy -s dev
# ⚠ This will destroy ALL resources for stage "dev".
# Type the stage name to confirm: dev
# Destroying...

Caution

destroy deletes your Aurora database, all S3 data, and all application infrastructure. This is irreversible. Aurora deletion protection is enabled by default — if protect_aurora = true (the default), you must manually disable deletion protection in the AWS console before destroy will proceed.

---

status

Show the current status of all ThinkWork resources for a stage.

thinkwork status -s <stage>

Example:

thinkwork status -s dev

Stage: dev (us-east-1)
Last deployed: 2024-04-10 09:23 UTC

Resource status:
  Aurora cluster:    available
  AgentCore Lambda:  active (last invoked: 2m ago)
  AppSync API:       active
  API Gateway:       active
  CloudFront (admin): deployed
  Step Functions:    0 running executions

Agent summary:
  3 agents active
  12 threads open
  847 total turns (last 30 days)

---

outputs

Print the Terraform outputs for a deployed stage.

thinkwork outputs -s <stage> [options]

Options:

Flag	Description
-s, --stage <name>	Stage name (required)
--json	Output as JSON (useful for scripting)
--key <name>	Print only a specific output value

Example:

thinkwork outputs -s dev

appsync_api_url:      https://abc123.appsync-api.us-east-1.amazonaws.com/graphql
api_gateway_url:      https://xyz789.execute-api.us-east-1.amazonaws.com
admin_app_url:        https://d1234567.cloudfront.net
cognito_pool_id:      us-east-1_ABC123XYZ
cognito_client_id:    1abc2def3ghi4jkl
aurora_cluster_id:    dev-thinkwork-aurora
s3_skill_bucket:      dev-thinkwork-skills
audit_log_bucket:     dev-thinkwork-audit-logs

Scripting example:

API_URL=$(thinkwork outputs -s dev --key api_gateway_url)
curl -H "Authorization: Bearer $TOKEN" "$API_URL/health"

---

config

View and edit CLI configuration for a stage.

thinkwork config <subcommand> [options]

config list

thinkwork config list -s dev

Prints all configuration values for the stage (environment profile + terraform.tfvars parsed values).

config get

thinkwork config get -s dev <key>

Example:

thinkwork config get -s dev region
# us-east-1

thinkwork config get -s dev default_model_id
# anthropic.claude-3-5-sonnet-20241022-v2:0

config set

thinkwork config set -s dev <key> <value>

Updates a value in terraform.tfvars for the specified stage. The key must be a valid Terraform variable.

Example:

thinkwork config set -s dev enable_hindsight true
# ✓ Updated terraform.tfvars: enable_hindsight = true
# Run `thinkwork deploy -s dev` to apply.

thinkwork config set -s dev aurora_max_capacity 32
# ✓ Updated terraform.tfvars: aurora_max_capacity = 32

Note

config set only updates terraform.tfvars. It does not apply the change — run thinkwork deploy -s <stage> to apply the updated configuration.

---

mcp

Manage MCP (Model Context Protocol) servers for your tenant. MCP servers expose external tools that agents can call during conversations.

thinkwork mcp <subcommand> [options]

mcp list

List all registered MCP servers for a tenant.

thinkwork mcp list --tenant <slug> -s <stage>

mcp add

Register a new MCP server.

thinkwork mcp add <name> --url <url> --tenant <slug> -s <stage> [options]

Options:

Flag	Description
--url <url>	MCP server endpoint URL (required)
--tenant <slug>	Tenant slug (required)
--transport <type>	Transport: streamable-http (default) or sse
--auth-type <type>	Auth: none (default), tenant_api_key, or oauth
--api-key <token>	API key or bearer token (for tenant_api_key)

Examples:

# Register with API key auth
thinkwork mcp add my-tools \
  --url https://mcp.example.com/crm \
  --auth-type tenant_api_key \
  --api-key sk-abc123 \
  --tenant my-tenant -s dev

# Register with server-managed OAuth (users connect from mobile app)
thinkwork mcp add lastmile-crm \
  --url https://mcp-dev.lastmile-tei.com/crm \
  --auth-type oauth \
  --tenant my-tenant -s dev

mcp remove

Remove a registered MCP server. Also removes all agent assignments.

thinkwork mcp remove <server-id> --tenant <slug> -s <stage>

mcp test

Test connection to an MCP server and discover available tools.

thinkwork mcp test <server-id> --tenant <slug> -s <stage>

Example output:

  ✓ Connection successful.

  Discovered tools (4):

    search_contacts - Search CRM contacts by name or email
    get_account - Get account details by ID
    create_task - Create a new task
    list_opportunities - List open opportunities

mcp assign

Assign a registered MCP server to an agent.

thinkwork mcp assign <mcp-server-id> --agent <agent-id> -s <stage>

mcp unassign

Remove an MCP server from an agent.

thinkwork mcp unassign <mcp-server-id> --agent <agent-id> -s <stage>