Command-line tools

Coalesce Quality has three command-line tools. You can install and run all of them on your own infrastructure. They share credentials, so one login covers all three.

Tool	What it does	Guides
`synqcli`	Declares monitors, SQL tests and deployment rules as code, and reconciles a workspace with that declaration	Monitors as code · Agent workflow · CLI reference
`synq-recon`	Compares a dataset in one database against another and reports whether they agree, without moving row data	Overview · Getting started · Agent workflow · CLI reference
`synq-scout`	Runs the Scout agent, or serves its tools locally over MCP	Scout · Agent workflow · CLI reference

Each tool ships an AGENTS.md beside the binary. It is the operating guide, written for a coding agent to read from top to bottom. It has the same content as the “Agent workflow” page linked above, so an agent without web access still has it. Give this file to an agent that uses one of these tools.

Install

On macOS, install any of them with Homebrew, and upgrade with brew upgrade:

brew install getsynq/tap/synqcli
brew install getsynq/tap/synq-recon
brew install getsynq/tap/synq-scout

If Homebrew installed the binary, <tool> upgrade tells you to run brew upgrade and does not replace it. See Upgrade.

Homebrew covers macOS and Linux. In CI and on Windows, use the archives. Every release publishes them for macOS and Linux on both amd64 and arm64, plus a checksums.txt. synqcli and synq-scout also build for Windows on both architectures, and synq-recon builds for Windows on amd64. The archive filename contains the version. To get the current version, read the redirect of /releases/latest, which GitHub points at the newest release tag. Each tool’s own upgrade uses the same lookup.

synqcli
synq-recon
synq-scout

VERSION=$(curl -fsSLI -o /dev/null -w '%{url_effective}' \
  https://github.com/getsynq/synqcli/releases/latest | sed 's#.*/v##')
OS=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')

curl -fL "https://github.com/getsynq/synqcli/releases/download/v${VERSION}/synqcli_${VERSION}_${OS}_${ARCH}.tar.gz" \
  | tar -xz
sudo mv synqcli /usr/local/bin/
synqcli --version

On Windows, download the .zip for your architecture from the releases page and put synqcli.exe on your PATH.

VERSION=$(curl -fsSLI -o /dev/null -w '%{url_effective}' \
  https://github.com/getsynq/synq-recon/releases/latest | sed 's#.*/v##')
OS=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')

curl -fL "https://github.com/getsynq/synq-recon/releases/download/v${VERSION}/synq-recon_${VERSION}_${OS}_${ARCH}.tar.gz" \
  | tar -xz
sudo mv synq-recon /usr/local/bin/
synq-recon --version

On Windows, download synq-recon_<version>_windows_amd64.zip from the releases page and put synq-recon.exe on your PATH. It runs DuckDB like the other builds.It is also available as a container image. This is the quickest way to try it without a warehouse, as the walkthrough in Getting started runs against DuckDB:

docker pull europe-docker.pkg.dev/synq-cicd-public/synq-public/synq-recon:latest

VERSION=$(curl -fsSLI -o /dev/null -w '%{url_effective}' \
  https://github.com/getsynq/synq-scout/releases/latest | sed 's#.*/v##')
OS=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')

curl -fL "https://github.com/getsynq/synq-scout/releases/download/v${VERSION}/synq-scout_${VERSION}_${OS}_${ARCH}.tar.gz" \
  | tar -xz
sudo mv synq-scout /usr/local/bin/
synq-scout --version

On Windows, download the .zip for your architecture from the releases page and put synq-scout.exe on your PATH.For a long-running deployment, use the Kubernetes manifests in getsynq/synq-scout-k8s. See Scout on-premise setup.You do not need this binary to use Scout’s tools from an AI client: the MCP server is hosted. See MCP.

Verify a download against the checksums published with the release:

sha256sum -c checksums.txt --ignore-missing

On macOS a binary downloaded this way may be quarantined. If it refuses to start, xattr -d com.apple.quarantine /usr/local/bin/<tool> clears the flag. The Homebrew install does this for you.

Upgrade

A tool installed from an archive can replace itself:

synqcli upgrade --check      # what it would do, without doing it
synqcli upgrade

upgrade resolves the latest release, downloads the archive for your platform, verifies it against the release’s checksums.txt, and runs the new binary once to confirm it works before replacing anything. If the binary lives somewhere you cannot write, it says so and changes nothing. Run it again with sudo. An install owned by something else is left to its owner: a Homebrew install tells you to run brew upgrade, and a container or Kubernetes deployment should take a newer image rather than replace the binary inside it. Each tool also mentions a newer release on stderr, at most once a day. That check reads a tag from a public GitHub URL. It sends no credentials, workspace or identity. It never slows down the command and fails silently, so a machine without internet access behaves as if it is up to date. It is silent in CI, when output is not a terminal, and inside a container or a Kubernetes pod. To turn it off everywhere:

export QUALITY_NO_UPDATE_CHECK=1     # DO_NOT_TRACK=1 has the same effect

All three resolve credentials the same way, and take the first they find:

Client credentials in QUALITY_CLIENT_ID and QUALITY_CLIENT_SECRET, for servers, containers and CI. Create the pair under Settings → API.
An API token in QUALITY_TOKEN, the st-… token from your workspace.
A browser login with <tool> auth login, which caches a refresh token under ~/.synq/oauth/.

The cache is shared, so one auth login covers all three for the same deployment. To keep a login to one tool only, add --isolated. To sign in with your Coalesce account, add --coalesce (and --organization to pick the Coalesce organization).

synqcli auth login
synqcli auth status      # every stored credential, for every region

If your workspace is not in the EU, add --region us (or au), or set QUALITY_REGION. The flag works on every command, and a successful login is remembered, so later commands need neither it nor --endpoint. To switch between regions you have logged in to, run <tool> auth use <region>.

Confirm which workspace you are pointed at before running anything that writes. synq-scout auth whoami and synqcli auth status both print it. A synqcli deploy against the wrong region reconciles the wrong workspace, and a reconcile deletes what it does not find declared.

Get the command reference

Each tool’s full command and flag reference is generated from the tool itself, so it always matches the release you have:

--help on any command prints the same content locally, and every tool supports shell completion.

Field references for the YAML

Each tool’s configuration schema is published and versioned. It has two forms: a rendered page to read, and the JSON Schema for your editor.

Tool	Configures	Reference	Schema URL
`synqcli`	monitors, tests, deployment rules	config.html	`https://schemas.synq.io/synq-monitors/v1/config.schema.json`
`synq-recon`	suites, connections, comparisons	config.html	`https://schemas.synq.io/synq-recon/v1/config.schema.json`
`synq-recon`	the audit log a run writes	audit-log.html	`https://schemas.synq.io/synq-recon/v1/audit-log.schema.json`
`synq-scout`	`agent.yaml`	config.html	`https://schemas.synq.io/synq-scout/v1/config.schema.json`

Put the matching line at the top of your YAML and any editor with the YAML language server gives completion and validation as you type:

# yaml-language-server: $schema=https://schemas.synq.io/synq-recon/v1/config.schema.json

The data-warehouse agent publishes its config schema the same way.

Use them from CI

CI needs only client credentials and the archive download. No interactive login is involved. Pin the version in a pipeline: set VERSION to a literal instead of resolving /releases/latest. Then a release cannot change what your build runs without a commit. On a workstation, use the latest. In both cases, print <tool> --version into the build log, so you can compare a pipeline run with a local run. Before you set up a pipeline, read about synqcli deploy --auto-confirm and synq-recon exit codes. Need something not covered here? Get in touch.

Get Started

Alerts

Monitors

Monitors Types

Reconciliations

Data Products

Scout AI

Ownership

Incidents

Analytics

Query activity

Lineage

BI Integrations

Data Warehouse Integrations

Transactional databases

Code Integrations

dbt Integrations

SQLMesh Integrations

Coalesce Integrations

Orchestration Tool Integrations

Alerting Integrations

Catalogs

Google Cloud Integrations

Admin

Security

Support

Developer API

Install

Upgrade

Get the command reference

Field references for the YAML

Use them from CI

​Install

​Upgrade

​Sign in

​Get the command reference

​Field references for the YAML

​Use them from CI

Install

Upgrade

Sign in

Get the command reference

Field references for the YAML

Use them from CI