The agentengine CLI reads a small set of environment variables that change how the CLI itself behaves. This page documents those inputs. Variables that configure a deployed agent, the local development stack, or the generated containers are documented with those features.
When a command exposes a flag for the same setting, the flag takes precedence over the environment variable.
Update check
Released binaries check for a newer version and print a notice to stderr when one exists. The check runs at most once every 24 hours and records its state in ~/.agentengine/update-check.json.
Set AGENTENGINE_NO_UPDATE_CHECK=1 to disable the check. The check is also skipped when the CI environment variable is set and when the binary is a local development build.
Telemetry
The CLI has two independent reporting channels. Both are on by default in released binaries and off in development builds and whenever CI is set.
AGENTENGINE_TELEMETRY_ENABLEDcontrols product-usage analytics sent to the Agent Engine gateway.AGENTENGINE_SENTRY_ENABLEDcontrols crash and error reports sent to Sentry. Reporting also requires a Sentry DSN embedded at build time, which release builds include.
Set either variable to 0, false, no, or off to disable that channel.
Product analytics also opt out automatically for a synthetic (canary/test) account: when a login resolves an account whose telemetry is disabled, the CLI records that on the install and stops sending product analytics — including pre-login events — until a later login as a real account clears it. The variables above still win, so setting AGENTENGINE_TELEMETRY_ENABLED=0 keeps telemetry off regardless.
Product-usage analytics record that features were used, not what you used them on: each CLI invocation is counted with its command path (for example agentengine dev up), a success/failure outcome, and a coarse error class on failures, alongside install, login, and feature-milestone events. Events never contain command arguments, file paths, secret values, or error message text. Runs before login are recorded under a pseudonymous anonymous ID that is linked to your account when you sign in.
For Sentry specifically, the CLI withholds the DSN embedded in release builds, so the containers it starts do not report until you opt in. Container reporting requires both AGENTENGINE_SENTRY_ENABLED=1 and an explicit AGENTENGINE_SENTRY_DSN in the environment, which the generated stacks translate into the names the containers read.
Logging
The CLI writes a session log to a file under the platform log directory. The following variables control that log. The flags --log-level, --log-file, and --no-log set the same behavior and take precedence when both are present.
Variable | Flag | Default | Effect |
|---|---|---|---|
|
|
| File verbosity: |
|
| timestamped path in the platform log directory | Write the log to this path |
|
| unset | Disable file logging |
| — |
| Number of log files to retain before the oldest are pruned |
| — | unset | Disable automatic log pruning |
Both of these booleans accept 1, true, yes, or on as true, case-insensitive. Any other value, including an unset variable, is false. The other variables on this page each state their own accepted values above.
Command output
Most commands print a context line at the top of their output showing the organization, project, workspace, and environment the command will act on. Set AGENTENGINE_NO_BREADCRUMB to any non-empty value to suppress that line, which suits scripts that parse command output.
Local dev TLS inspection
agentengine dev up builds local images that fetch packages from PyPI and npm. On a network that intercepts HTTPS with a company CA, set AGENTENGINE_CA_BUNDLE to the PEM file of that CA (or pass --ca-bundle). The CLI embeds it into the generated image before package installs, so uv and npm trust the re-signed traffic, and the agent's runtime HTTPS calls through the proxy work too. The CA is recorded per workspace under ~/.agentengine/ and reused on later runs on the same machine; a value in the workspace .env is ignored so a cloned repository cannot install a CA. See Corporate TLS inspection in local agentengine dev up.