Oasis CLI
Oasis CLI is a harness that runs agent turns on the machine doing the work. It is a single static binary with no runtime to install, and its tool surface reaches past the filesystem and onto the plant: Modbus, OPC UA and EtherCAT are tool calls, not integrations to write later.
The binary is called oasis-agent.
What makes it different
A general-purpose coding agent can write industrial code. It cannot open a socket to the device, read the holding register, walk the EtherCAT SubDevices up to OP, and then tell you whether the machine it just configured meets a real-time budget. Oasis CLI can, and it records what it did.
| Capability | What it means for you |
|---|---|
| One binary, no runtime | Statically linked. No Node, no Python, no package manager. Copy one file onto an industrial PC and run it. |
| Your model, your endpoint | --base-url is required and has no default. The binary never dials a baked-in address, so nothing leaves your network unless you point it out. |
| Industrial tool surface | 14 protocol tools across three capability packs, callable exactly like Read or Bash. |
| Conformance checks and audit | 45 built-in checks across five modules, with confidence classes, framework mappings and written remediation. |
| Verification in the same loop | The agent that wrote the configuration is the one that reads the device back and checks it. |
| Audit trail | Every write produces one actor-stamped line in an append-only log. |
The tool surface
Twenty tools ship in the box. Every one runs behind a realpath sandbox with per-tool escalation.
| Group | Tools |
|---|---|
| Files | Read, Write, Append, Edit, MultiEdit |
| Shell | Bash, BashSession, Monitor |
| Search | Glob, Grep |
| Web and media | WebFetch, ViewImage |
| Planning | UpdatePlan, ExitPlanMode, AskUserQuestion |
| Assessment | Check, Audit |
| Delegation and reuse | Agent, Skill |
| Persistence | Memory (on by default; disable with --no-memory) |
Capability packs add protocol tools on top. See Capability Packs. MCP servers add more again.
Performance
The prompt cache is the design's first-class citizen, and the system prefix is protected accordingly. In practice that means a turn boundary costs milliseconds instead of seconds.
| Measure | Value |
|---|---|
| Prefix-cache reuse, steady state | 94–100%, turn boundaries included |
| Cost of a turn boundary at 100% reuse | 134 ms |
| Cost of a turn boundary at 0% reuse | 17.2 s |
| A turn in persistent mode | ~0.35 s |
| Cold start: process start → first inference request | 24 ms (p50), 26 ms (p95) |
Binary size (x86_64) | 9.24 MiB, statically linked |
How you run it
| Mode | Command | For |
|---|---|---|
| Interactive REPL | oasis-agent | A person at a terminal. Persistent conversation, permission prompts, background jobs. |
| One-shot | oasis-agent -p "…" | Scripts and CI. Prints the result and exits. |
| Background agent | oasis-agent --bg -p "…" | Work that should outlive the terminal. |
| Assessment | oasis-agent check / oasis-agent audit | Conformance runs. Needs no model and no network. |
| Control protocol | oasis-agent serve --stdio | Programmatic integration over OCP. |
Where to go next
- System Requirements: supported architectures and operating systems
- Installing & Updating: getting the binary, updating it, rolling back
- Permission Model: the five modes and three risk tiers
- Conformance Checks: what the agent can prove about a machine
- Limitations: what it does not do
Quick start
Install, point it at a model endpoint, and start a conversation.
# 1. Configure the endpoint once. This writes ~/.oasis/config.json.
oasis-agent setup
# 2. Start a conversation.
oasis-agentTo skip the prompts and pass the endpoint directly:
oasis-agent --base-url http://10.0.0.1:8080TIP
--base-url is required on every run. Set it once with oasis-agent setup, export OASIS_BASE_URL, or pass the flag each time. oasis-agent --show-config prints every resolved value and which layer supplied it.