> ## Documentation Index > Fetch the complete documentation index at: https://warden-re.io/llms.txt > Use this file to discover all available pages before exploring further. # CLI reference > Every warden command, its arguments, and what it does. The `warden` command is a thin shell over the library. Every command takes `--db ` to select the project database (default `warden.db`, or the `WARDEN_DB` environment variable). Run `warden --help`, or `warden --help`, for the authoritative, version-specific flag list. This page documents the commands as of the current release. ## Project lifecycle Print the installed WARDEN version. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden version ``` Create a project: a `.warden/` directory with the knowledge base inside it (`.warden/warden.db`). Every command run from anywhere in that directory tree then finds and uses that database automatically, so you never pass `--db`. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden init [--dir ] ``` Manage settings without juggling environment variables. There are two layers: a global file at `~/.config/warden/config.json` (your defaults) and a per-project file at `/.warden/config.json` (overrides for one project). Resolution is project over global, and the resolved keys and models are applied for you, so the backends just work. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden config set openrouter_api_key sk-or-... # global default warden config set openrouter_model xiaomi/mimo-v2.5-pro # global default warden config set --project openrouter_model moonshotai/kimi-k2.6 # this project only warden config get openrouter_model # value + which file it came from warden config list # every setting, value, and source warden config path # config file and database locations ``` Known keys: `openrouter_api_key`, `openai_api_key`, `anthropic_api_key`, `openrouter_model`, `openai_model`, `agent_model`. API key values are masked in `get` and `list`. Run the entire pipeline end-to-end on generated sample modules. No network or toolchain needed. The fastest way to see what WARDEN does. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden demo [--dir warden-demo] ``` ## Ingest and inspect Parse, fingerprint, and load a module version into the KB. Seeds names from the name section, exports, and imports. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden ingest [--glue ] [--label ] [--notes ] [--db ] ``` * ``: path to the `.wasm` file (required). * `--glue, -g`: optional Emscripten `.js` glue (recovers version, dynCall sigs, pthread shape). * `--label, -l`: version label (defaults to the filename stem). List all ingested module versions. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden versions [--db ] ``` Show symbol-coverage statistics for a version (named / by oracle / by human / by agent). ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden coverage List functions for a version with their current names and provenance. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden funcs Show everything known about a single function: type, stable id, calls, provenance, and evidence. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden show Set a human-verified name for a function. Human names are sovereign and locked against agent overwrite by default. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden set-name ## The Oracle Build (or extend) an Oracle signature store from labeled modules (modules that still carry a name section). ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden oracle build --out [--library musl] [--emver ] [--opt ] ``` * ``: one or more labeled `.wasm` files. * `--out, -o`: signature store path (default `oracle.json`). * `--emver`: the Emscripten version these were built with (recorded on each signature). * `--opt`: the opt level, e.g. `-O2`. Identify runtime/libc functions in a version against a signature store, and infer the Emscripten version from the distribution of matches. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden oracle identify ## Decompile and execute Decompile a single function (or every function in a module) to readable pseudo-C using the built-in pure-Python stack-machine lifter. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden lift Execute a single function in the built-in mini interpreter and print the return values. Covers the integer instruction subset; no external toolchain is required. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden exec Run the concurrency and struct-layout analyzers over a version and persist their findings as KB facts. This populates the `thread_model` and `structs` tables that were previously empty. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden analyze Generate a self-contained HTML reverse-engineering report for a version. The file has inline CSS and requires no server to view. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden report ## Agents, diff, verify, export Run one propose → verify → write-back sweep over unnamed functions. Auto-selects cheapest-first: OpenRouter (Kimi K2.6) when `OPENROUTER_API_KEY` is set, then OpenAI, then Anthropic, otherwise the deterministic offline backend. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden agent The per-function deep engine: one agent per function, walked bottom-up over the call graph (leaves first). Each function's agent is fed its disassembly facts, its decompiled C, and the recovered understanding of the functions it calls (read from the knowledge base, not the callees' raw bytes). It returns a name, a one-paragraph understanding, a variable rename map, the cleaned C, and whether the function is now closed. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden deep List agent backends, availability, required credentials, and default models. Use this before a provider-backed run to confirm what auto-selection will see. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden agent-backends ``` Diff two versions, carry annotations forward, and print the semantic changelog. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden diff [--no-carry] [--db ] ``` * `--no-carry`: classify only; do not port annotations forward. Export a deliverable. All formats are deterministic so they diff cleanly in git. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden export Import annotations from a previously exported CSV or JSON file and merge them into the KB. This is the return leg of the round-trip that begins with `warden export --format csv|json`. ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden import Verify ingestion determinism and report differential-equivalence readiness (whether a wasm2c/w2c2 + C toolchain is present). ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden verify ``` Serve the knowledge base over the Model Context Protocol (stdio). Requires `pip install -e '.[mcp]'`. See the [MCP reference](/reference/mcp). ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden mcp [--db ] ``` ## A full session ```bash theme={"theme":{"light":"github-light","dark":"github-dark"}} warden init warden ingest app_v1.wasm --glue app_v1.js -l v1 warden oracle build runtime_debug.wasm -o oracle.json --emver 3.1.55 --opt -O2 warden oracle identify v1 --store oracle.json --indexed warden agent v1 warden set-name v1 7 verify_license warden analyze v1 warden lift v1 --index 7 # inspect the decompiled pseudo-C for a single function warden export v1 --format pseudo --out v1.pseudo.txt warden report v1 --out v1_report.html # next release: warden ingest app_v2.wasm -l v2 warden diff v1 v2 warden report v2 --out v2_report.html ```