--- title: Tiger CLI reference | Tiger Data Docs description: Command reference for Tiger CLI, including every command, configuration parameter, and global flag for managing Tiger Cloud --- Tiger CLI is a command-line interface that you use to manage Tiger Cloud resources including VPCs, services, read replicas, and related infrastructure. Tiger CLI calls Tiger REST API to communicate with Tiger Cloud. To install CLI, configure authentication, and create your first service, see [Get started with the command line](/get-started/quickstart/cli-rest-api/index.md). This page is the reference for every CLI command and configuration parameter. ## Commands You can use the following commands with Tiger CLI. For more information on each command, use the `-h` flag. For example: `tiger auth login -h` | Command | Subcommand | Description | | ------- | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | auth | | Manage authentication and credentials for your Tiger Cloud account | | | login | Create an authenticated connection to your Tiger Cloud account. For non-interactive login, use flags:* `--public-key`: public key for authentication * `--secret-key`: secret key for authenticationYou can also use environment variables `TIGER_PUBLIC_KEY`, `TIGER_SECRET_KEY`, and `TIGER_PROJECT_ID` | | | logout | Remove the credentials used to create authenticated connections to Tiger Cloud | | | status | Show your current authentication status and project ID. Possible flags are:* `--output, -o`: set output format to `json`, `yaml`, or `table` | | version | | Show information about the currently installed version of Tiger CLI. Possible flags are:* `--check`: force check for updates (regardless of last check time) * `--output, -o`: set output format to `table`, `json`, `yaml`, or `bare` | | config | | Manage your Tiger CLI configuration | | | show | Show the current configuration. Possible flags are:* `--output, -o`: set output format to `json`, `yaml`, or `table` * `--no-defaults`: do not show default values for unset fields * `--with-env`: apply environment variable overrides | | | set `` `` | Set a specific value in your configuration. For example, `tiger config set debug true` | | | unset `` | Clear the value of a configuration parameter. For example, `tiger config unset debug` | | | reset | Reset the configuration to the defaults. This also logs you out from the current Tiger Cloud project | | service | | Manage the Tiger Cloud services in this project | | | create | Create a new service in this project. Possible flags are:* `--name`: service name (auto-generated if not provided) * `--addons`: addons to enable. Possible values are `time-series`, `ai`. Set to `none` for vanilla PostgreSQL * `--region`: region code where the service will be deployed. Free services (shared CPU/memory) must use `us-east-1` * `--cpu`: CPU allocation in millicores. Set to `shared` to create a free service. See the allowed CPU/memory configurations below. * `--memory`: memory allocation in gigabytes. Set to `shared` to create a free service. See the allowed CPU/memory configurations below. * `--replicas`: number of high-availability replicas * `--environment`: environment tag. Possible values: `DEV`, `PROD` (default: `DEV`) * `--no-wait`: don't wait for the operation to complete * `--wait-timeout`: wait timeout duration (for example, 30m, 1h30m, 90s) * `--no-set-default`: don't set this service as the default service * `--with-password`: include password in output * `--output, -o`: set the output format to `json`, `yaml`, `env`, or `table` Allowed CPU/memory configurations are:* shared / shared (only available in `us-east-1`) * 0.5 CPU (500m) / 2GB * 1 CPU (1000m) / 4GB * 2 CPU (2000m) / 8GB * 4 CPU (4000m) / 16GB * 8 CPU (8000m) / 32GB * 16 CPU (16000m) / 64GB * 32 CPU (32000m) / 128GBNote: You can specify both CPU and memory together, or specify only one (the other will be automatically configured). | | | delete `` | Delete a service from this project. This operation is irreversible and requires confirmation by typing the service ID | | | fork `` | Fork an existing service to create a new independent copy. Key features are:* **Timing options** (exactly one required): - `--now`: fork at current database state - `--last-snapshot`: fork at last existing snapshot (faster) - `--to-timestamp`: fork at specific point in time (RFC3339 format) * **Resource configuration**: - `--cpu`: CPU allocation in millicores. Set to `shared` to create a free service. If not specified, inherits from source service. See the allowed CPU/memory configurations in the `create` subcommand - `--memory`: memory allocation in gigabytes. Set to `shared` to create a free service. If not specified, inherits from source service. See the allowed CPU/memory configurations in the `create` subcommand * **Naming and environment**: - `--name `: defaults to `{source-service-name}-fork` - `--environment`: environment tag. Possible values: `DEV`, `PROD` (default: `DEV`) * **Wait behavior**: - `--no-wait`: don't wait for operation to complete - `--wait-timeout`: wait timeout duration (default: 30m) * **Default service and output**: - `--no-set-default`: don't set forked service as default - `--with-password`: include password in output - `--output, -o`: set output format to `json`, `yaml`, `env`, or `table` | | | get `` aliases: `describe`, `show` | Show detailed information about a specific service in this project. Possible flags are:* `--with-password`: include password in output * `--output, -o`: set output format to `json`, `yaml`, `env`, or `table` | | | list | List all the services in this project. Possible flags are:* `--output, -o`: set output format to `json`, `yaml`, or `table` | | | update-password `` | Update the master password for a service. Possible flags are:* `--new-password`: new password for the tsdbadmin user * `--auto-generate`: auto-generate a secure password (mutually exclusive with `--new-password`) | | | start `` | Start a service that is currently inactive. Possible flags are:* `--no-wait`: don't wait for the operation to complete * `--wait-timeout`: set the maximum wait time for this operation to complete. For example, `10m` (default), `30m`, `1h30m`, `90s` | | | stop `` | Stop a service that is currently active. After you run this command `` no longer accepts connections. Possible flags are:* `--no-wait`: don't wait for the operation to complete * `--wait-timeout`: set the maximum wait time for this operation to complete. For example, `10m` (default), `30m`, `1h30m`, `90s` | | | resize `` | Resize a service by changing CPU and memory allocation. The service may be temporarily unavailable during the resize operation. Possible flags are:* `--cpu`: CPU allocation in millicores. See the allowed CPU/memory configurations in the `create` subcommand * `--memory`: memory allocation in gigabytes. See the allowed CPU/memory configurations in the `create` subcommand * `--no-wait`: don't wait for the operation to complete * `--wait-timeout`: set the maximum wait time for this operation to complete. For example, `10m` (default), `30m`, `1h30m`, `90s`Note: You can specify both `--cpu` and `--memory` together, or specify only one (the other will be automatically configured). | | | logs `` alias: `log` | View logs for a service. Log lines are colorized by severity when the global `--color` flag is enabled (default). Possible flags are:* `--tail`: number of log lines to show (default: `100`) * `--since`: fetch logs after this timestamp (RFC3339 format, for example `2024-01-15T09:00:00Z`) * `--until`: fetch logs before this timestamp (RFC3339 format, for example `2024-01-15T10:00:00Z`) * `--node`: fetch logs from a specific service node by ordinal. Omit this flag to fetch logs from the current primary * `--output, -o`: set output format to `text`, `json`, or `yaml` (default: `text`) | | db | | Database operations and management | | | connect `` | Connect to a service using psql. Possible flags are:* `--pooled`: use connection pooling (default: `false`) * `--role`: database role/username (default: `tsdbadmin`) * `--read-only`: open the session in Tiger Cloud's immutable read-only mode, so writes and DDL are rejected by the server. The global [`read_only` config option](#configuration-parameters), or `TIGER_READ_ONLY=true`, also forces this behaviorYou can also pass additional flags to psql after `--`. For example: `tiger db connect -- --single-transaction --quiet` | | | connection-string `` | Retrieve the connection string for a service. Possible flags are:* `--pooled`: use connection pooling (default: `false`) * `--role`: database role/username (default: `tsdbadmin`) * `--with-password`: include password in connection string (default: `false`, less secure) * `--read-only`: emit a connection string that opens the session in Tiger Cloud's immutable read-only mode, so writes and DDL are rejected by the server. The global [`read_only` config option](#configuration-parameters), or `TIGER_READ_ONLY=true`, also forces this behavior | | | create role `` | Create a new database role. Possible flags are:* `--name` (required): the name for the role you are creating * `--read-only`: enable permanent read-only enforcement for `--name` using `tsdb_admin.read_only_role` * `--from`: inherit grants from one or more roles. For example, `--from app_role`, `--from readonly_role`, `--from app_role,readonly_role` * `--statement-timeout`: set the statement timeout for `--name`. For example, `30s`, `5m` * `--password`: set the password for `--name`. If not provided, the CLI checks the `TIGER_NEW_PASSWORD` environment variable. If you have not defined `TIGER_NEW_PASSWORD` the CLI auto-generates a secure random password. * `-o, --output`: set the output format to `json`, `yaml`, or `table` | | | save-password `` | Save the password for a service. Possible flags are:* `--role`: database role/username (default: `tsdbadmin`) * `--password`: password value (you can also use the `TIGER_NEW_PASSWORD` environment variable) | | | test-connection `` | Test the connectivity to a service. Possible flags are:* `--timeout, -t`: connection timeout (default: `3s`, use `0` for no timeout) * `--pooled`: use connection pooling (default: `false`) * `--role`: database role/username (default: `tsdbadmin`) | | mcp | | Manage Tiger MCP for AI Assistant integration | | | install `[client]` | Install and configure Tiger MCP for a specific client. Supported clients: `claude-code`, `codex`, `cursor`, `gemini`, `vscode`, `windsurf`. If no client is specified, you'll be prompted to select one interactively | | | list | List all available Tiger MCP tools, prompts, and resources. Possible flags are:* `--output, -o`: set output format to `json`, `yaml`, or `table` | | | get `` aliases: `describe`, `show` | Get detailed information about a specific Tiger MCP capability (tool, prompt, or resource). Possible flags are:* `--output, -o`: set output format to `json`, `yaml`, or `table` | | | start | Start Tiger MCP. This is the same as `tiger mcp start stdio` | | | start stdio | Start Tiger MCP with stdio transport (default) | | | start http | Start Tiger MCP with HTTP transport. Includes flags: `--port` (default: `8080`), `--host` (default: `localhost`) | ## Configuration parameters By default, Tiger CLI stores your configuration in `~/.config/tiger/config.yaml`. The location of the config directory can be adjusted via the `--config-dir` flag or the `TIGER_CONFIG_DIR` environment variable. - **Configuration options** You set the following configuration options using `tiger config set `: | Flag | Default | Description | | ------------------------ | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `analytics` | `true` | Enable or disable usage analytics | | `color` | `true` | Enable or disable colored output | | `debug` | `false` | Enable or disable debug logging | | `docs_mcp` | `true` | Enable or disable the Tiger Data documentation MCP proxy | | `output` | `table` | Set the output format to `json`, `yaml`, or `table` | | `password_storage` | `keyring` | Set the password storage method. Options are `keyring`, `pgpass`, or `none` | | `read_only` | `false` | Enable or disable read-only mode. When `true`, mutating CLI commands and Tiger MCP tools (`service create`, `fork`, `start`, `stop`, `resize`, `update-password`, and `delete`) are refused, and the database sessions opened by `db connect`, `db connection-string`, and `db_execute_query` run in Tiger Cloud's immutable read-only mode, so writes and DDL are rejected by the server. Read commands and tools are unaffected | | `service_id` | - | Set the default service to manage | | `version_check_interval` | `24h` | Set how often the CLI checks for a new version. Set to `0` to disable | You can also set these configuration options as environment variables. Environment variables: - Take precedence over configuration parameters values. - Are in upper case and use the `TIGER_` prefix. For example, `TIGER_ANALYTICS` - **Global Flags** These flags are available on all commands and take precedence over both environment variables and configuration file values: | Flag | Default | Description | | --------------------- | ----------------- | --------------------------------------------------------------------------- | | `--analytics` | `true` | Enable or disable usage analytics | | `--color` | `true` | Enable or disable colored output | | `--config-dir` | `~/.config/tiger` | Set the directory that holds `config.yaml` | | `--debug` | `false` | Enable or disable debug logging | | `--help`, `-h` | - | Print help about the current command. For example, `tiger service --help` | | `--password-storage` | `keyring` | Set the password storage method. Options are `keyring`, `pgpass`, or `none` | | `--service-id` | - | Set the default service to manage | | `--skip-update-check` | `false` | Skip checking if a new version of Tiger CLI is available | - **Authentication parameters** To authenticate without using the interactive login, either: - Set the following parameters with your [client credentials](https://console.cloud.tigerdata.com/dashboard/settings), then `login`: Terminal window ``` TIGER_PUBLIC_KEY= TIGER_SECRET_KEY= TIGER_PROJECT_ID=\ tiger auth login ``` - Add your [client credentials](https://console.cloud.tigerdata.com/dashboard/settings) to the `login` command: Terminal window ``` tiger auth login --public-key= --secret-key= --project-id= ```