Tiger CLI reference

Tiger CLI is a command-line interface that you use to manage Tiger Cloud resources including VPCs, services, read replicas, and related infrastructure. Tiger CLI calls Tiger REST API to communicate with Tiger Cloud.

To install CLI, configure authentication, and create your first service, see Get started with the command line. This page is the reference for every CLI command and configuration parameter.

Commands

You can use the following commands with Tiger CLI. For more information on each command, use the -h flag. For example: tiger auth login -h

Command	Subcommand	Description
auth		Manage authentication and credentials for your Tiger Cloud account
	login	Create an authenticated connection to your Tiger Cloud account. For non-interactive login, use flags: --public-key: public key for authentication --secret-key: secret key for authentication You can also use environment variables TIGER_PUBLIC_KEY, TIGER_SECRET_KEY, and TIGER_PROJECT_ID
	logout	Remove the credentials used to create authenticated connections to Tiger Cloud
	status	Show your current authentication status and project ID. Possible flags are: --output, -o: set output format to json, yaml, or table
version		Show information about the currently installed version of Tiger CLI. Possible flags are: --check: force check for updates (regardless of last check time) --output, -o: set output format to table, json, yaml, or bare
config		Manage your Tiger CLI configuration
	show	Show the current configuration. Possible flags are: --output, -o: set output format to json, yaml, or table --no-defaults: do not show default values for unset fields --with-env: apply environment variable overrides
	set <key> <value>	Set a specific value in your configuration. For example, tiger config set debug true
	unset <key>	Clear the value of a configuration parameter. For example, tiger config unset debug
	reset	Reset the configuration to the defaults. This also logs you out from the current Tiger Cloud project
service		Manage the Tiger Cloud services in this project
	create	Create a new service in this project. Possible flags are: --name: service name (auto-generated if not provided) --addons: addons to enable. Possible values are time-series, ai. Set to none for vanilla PostgreSQL --region: region code where the service will be deployed. Free services (shared CPU/memory) must use us-east-1 --cpu: CPU allocation in millicores. Set to shared to create a free service. See the allowed CPU/memory configurations below. --memory: memory allocation in gigabytes. Set to shared to create a free service. See the allowed CPU/memory configurations below. --replicas: number of high-availability replicas --environment: environment tag. Possible values: DEV, PROD (default: DEV) --no-wait: don't wait for the operation to complete --wait-timeout: wait timeout duration (for example, 30m, 1h30m, 90s) --no-set-default: don't set this service as the default service --with-password: include password in output --output, -o: set the output format to json, yaml, env, or table Allowed CPU/memory configurations are: shared / shared (only available in us-east-1) 0.5 CPU (500m) / 2GB 1 CPU (1000m) / 4GB 2 CPU (2000m) / 8GB 4 CPU (4000m) / 16GB 8 CPU (8000m) / 32GB 16 CPU (16000m) / 64GB 32 CPU (32000m) / 128GB Note: You can specify both CPU and memory together, or specify only one (the other will be automatically configured).
	delete <service-id>	Delete a service from this project. This operation is irreversible and requires confirmation by typing the service ID
	fork <service-id>	Fork an existing service to create a new independent copy. Key features are: Timing options (exactly one required): --now: fork at current database state --last-snapshot: fork at last existing snapshot (faster) --to-timestamp: fork at specific point in time (RFC3339 format) Resource configuration: --cpu: CPU allocation in millicores. Set to shared to create a free service. If not specified, inherits from source service. See the allowed CPU/memory configurations in the create subcommand --memory: memory allocation in gigabytes. Set to shared to create a free service. If not specified, inherits from source service. See the allowed CPU/memory configurations in the create subcommand Naming and environment: --name <name>: defaults to {source-service-name}-fork --environment: environment tag. Possible values: DEV, PROD (default: DEV) Wait behavior: --no-wait: don't wait for operation to complete --wait-timeout: wait timeout duration (default: 30m) Default service and output: --no-set-default: don't set forked service as default --with-password: include password in output --output, -o: set output format to json, yaml, env, or table
	get <service-id> aliases: describe, show	Show detailed information about a specific service in this project. Possible flags are: --with-password: include password in output --output, -o: set output format to json, yaml, env, or table
	list	List all the services in this project. Possible flags are: --output, -o: set output format to json, yaml, or table
	update-password <service-id>	Update the master password for a service. Possible flags are: --new-password: new password for the tsdbadmin user --auto-generate: auto-generate a secure password (mutually exclusive with --new-password)
	start <service-id>	Start a service that is currently inactive. Possible flags are: --no-wait: don't wait for the operation to complete --wait-timeout: set the maximum wait time for this operation to complete. For example, 10m (default), 30m, 1h30m, 90s
	stop <service-id>	Stop a service that is currently active. After you run this command <service-id> no longer accepts connections. Possible flags are: --no-wait: don't wait for the operation to complete --wait-timeout: set the maximum wait time for this operation to complete. For example, 10m (default), 30m, 1h30m, 90s
	resize <service-id>	Resize a service by changing CPU and memory allocation. The service may be temporarily unavailable during the resize operation. Possible flags are: --cpu: CPU allocation in millicores. See the allowed CPU/memory configurations in the create subcommand --memory: memory allocation in gigabytes. See the allowed CPU/memory configurations in the create subcommand --no-wait: don't wait for the operation to complete --wait-timeout: set the maximum wait time for this operation to complete. For example, 10m (default), 30m, 1h30m, 90s Note: You can specify both --cpu and --memory together, or specify only one (the other will be automatically configured).
	logs <service-id> alias: log	View logs for a service. Log lines are colorized by severity when the global --color flag is enabled (default). Possible flags are: --tail: number of log lines to show (default: 100) --since: fetch logs after this timestamp (RFC3339 format, for example 2024-01-15T09:00:00Z) --until: fetch logs before this timestamp (RFC3339 format, for example 2024-01-15T10:00:00Z) --node: fetch logs from a specific service node by ordinal. Omit this flag to fetch logs from the current primary --output, -o: set output format to text, json, or yaml (default: text)
db		Database operations and management
	connect <service-id>	Connect to a service using psql. Possible flags are: --pooled: use connection pooling (default: false) --role: database role/username (default: tsdbadmin) --read-only: open the session in Tiger Cloud's immutable read-only mode, so writes and DDL are rejected by the server. The global read_only config option, or TIGER_READ_ONLY=true, also forces this behavior You can also pass additional flags to psql after --. For example: tiger db connect -- --single-transaction --quiet
	connection-string <service-id>	Retrieve the connection string for a service. Possible flags are: --pooled: use connection pooling (default: false) --role: database role/username (default: tsdbadmin) --with-password: include password in connection string (default: false, less secure) --read-only: emit a connection string that opens the session in Tiger Cloud's immutable read-only mode, so writes and DDL are rejected by the server. The global read_only config option, or TIGER_READ_ONLY=true, also forces this behavior
	create role <service-id>	Create a new database role. Possible flags are: --name (required): the name for the role you are creating --read-only: enable permanent read-only enforcement for --name using tsdb_admin.read_only_role --from: inherit grants from one or more roles. For example, --from app_role, --from readonly_role, --from app_role,readonly_role --statement-timeout: set the statement timeout for --name. For example, 30s, 5m --password: set the password for --name. If not provided, the CLI checks the TIGER_NEW_PASSWORD environment variable. If you have not defined TIGER_NEW_PASSWORD the CLI auto-generates a secure random password. -o, --output: set the output format to json, yaml, or table
	save-password <service-id>	Save the password for a service. Possible flags are: --role: database role/username (default: tsdbadmin) --password: password value (you can also use the TIGER_NEW_PASSWORD environment variable)
	test-connection <service-id>	Test the connectivity to a service. Possible flags are: --timeout, -t: connection timeout (default: 3s, use 0 for no timeout) --pooled: use connection pooling (default: false) --role: database role/username (default: tsdbadmin)
mcp		Manage Tiger MCP for AI Assistant integration
	install [client]	Install and configure Tiger MCP for a specific client. Supported clients: claude-code, codex, cursor, gemini, vscode, windsurf. If no client is specified, you'll be prompted to select one interactively
	list	List all available Tiger MCP tools, prompts, and resources. Possible flags are: --output, -o: set output format to json, yaml, or table
	get <name> aliases: describe, show	Get detailed information about a specific Tiger MCP capability (tool, prompt, or resource). Possible flags are: --output, -o: set output format to json, yaml, or table
	start	Start Tiger MCP. This is the same as tiger mcp start stdio
	start stdio	Start Tiger MCP with stdio transport (default)
	start http	Start Tiger MCP with HTTP transport. Includes flags: --port (default: 8080), --host (default: localhost)

Configuration parameters

By default, Tiger CLI stores your configuration in ~/.config/tiger/config.yaml. The location of the config directory can be adjusted via the --config-dir flag or the TIGER_CONFIG_DIR environment variable.

• Configuration options

  You set the following configuration options using tiger config set <key> <value>:

  Flag	Default	Description
  analytics	true	Enable or disable usage analytics
  color	true	Enable or disable colored output
  debug	false	Enable or disable debug logging
  docs_mcp	true	Enable or disable the Tiger Data documentation MCP proxy
  output	table	Set the output format to json, yaml, or table
  password_storage	keyring	Set the password storage method. Options are keyring, pgpass, or none
  read_only	false	Enable or disable read-only mode. When true, mutating CLI commands and Tiger MCP tools (service create, fork, start, stop, resize, update-password, and delete) are refused, and the database sessions opened by db connect, db connection-string, and db_execute_query run in Tiger Cloud's immutable read-only mode, so writes and DDL are rejected by the server. Read commands and tools are unaffected
  service_id	-	Set the default service to manage
  version_check_interval	24h	Set how often the CLI checks for a new version. Set to 0 to disable

  You can also set these configuration options as environment variables. Environment variables:

  • Take precedence over configuration parameters values.
  • Are in upper case and use the TIGER_ prefix. For example, TIGER_ANALYTICS

• Global Flags

  These flags are available on all commands and take precedence over both environment variables and configuration file values:

  Flag	Default	Description
  --analytics	true	Enable or disable usage analytics
  --color	true	Enable or disable colored output
  --config-dir	~/.config/tiger	Set the directory that holds config.yaml
  --debug	false	Enable or disable debug logging
  --help, -h	-	Print help about the current command. For example, tiger service --help
  --password-storage	keyring	Set the password storage method. Options are keyring, pgpass, or none
  --service-id	-	Set the default service to manage
  --skip-update-check	false	Skip checking if a new version of Tiger CLI is available

• Authentication parameters

  To authenticate without using the interactive login, either:

  • Set the following parameters with your client credentials, then login:

    TIGER_PUBLIC_KEY=<public_key> TIGER_SECRET_KEY=<secret_key> TIGER_PROJECT_ID=<project_id>\
    tiger auth login

  • Add your client credentials to the login command:

    tiger auth login --public-key=<public_key> --secret-key=<secret-key> --project-id=<project_id>