Skip to content

CLI & Commands

synthkit ships several binaries under cmd/. All configuration is environment-driven (read from .env or the process environment) unless flags override specific values. Build everything with go build ./....

synthkit — the generator

The main binary. Loads all blueprints from the directory named by BLUEPRINTS (default ./blueprints), validates the set, and drives the two-cadence generator loop.

./synthkit [flags]
FlagDefaultDescription
-oncefalseRun one full cycle and exit.
-dumpfalseWith -once: print the full series/label inventory to stdout (diff against signals/).
-env <path>.envPath to the .env file (optional; falls back to process environment).

Verification modes (I32):

# Print the full inventory of distinct series names + label keys — push nothing.
DRY_RUN=true ./synthkit -once -dump

# One live cycle (DRY_RUN=false to push real data).
DRY_RUN=false ./synthkit -once

# The continuous loop (default).
./synthkit

DRY_RUN defaults to true. You must explicitly set DRY_RUN=false to push synthetic data to Grafana Cloud. See Configuration for the full environment variable reference, and Credentials for how the Grafana Cloud tokens are scoped.

The control plane is available at http://<bind>:<port>/control/ (default port 8088). See control-plane.md.

sm-provision — Synthetic Monitoring provisioner

One-shot idempotent provisioner for Synthetic Monitoring. Reads blueprints, registers the offline private probe, and creates/updates SM checks in Grafana Cloud. Safe to re-run.

GC_SM_URL=https://synthetic-monitoring-api.grafana.net \
  GC_SM_TOKEN=<sm-bearer-token> \
  DRY_RUN=false \
  go run ./cmd/sm-provision
Environment variableRequiredDescription
GC_SM_URLyesSM API base URL
GC_SM_TOKENyesSM API bearer token
BLUEPRINTSnoBlueprint directory (default ./blueprints)
PROBE_NAMEnoOffline probe name (default from sm.DefaultProbeName)
PROBE_REGIONnoProbe region string (default from sm.DefaultProbeRegion)
DRY_RUNnotrue (default) previews operations without calling the API

DRY_RUN=true (the default) prints the planned operations without making any API calls. See synthetic-monitoring.md for the two-phase startup procedure.

blueprint-schema — schema artifact generator

Regenerates the blueprint schema artifacts from the live Go types: BLUEPRINT-SCHEMA.md (the human reference) and internal/blueprintschema/fielddocs.json (the embedded field-description index used by the control-plane UI). Run this whenever a blueprint field or construct/workload config changes.

go run ./cmd/blueprint-schema
# or
make blueprint-schema

The gate test TestSchemaCurrent (run by go test ./...) fails if these artifacts drift from the live types. See blueprint-reference.md.

skcapture — environment snapshot tool

Inspects a Kubernetes environment via kubectl and writes a versioned, optionally age-encrypted inventory file for later processing by skforge.

skcapture [flags]
FlagDefaultDescription
--out <path>capture.ageOutput file path.
--passphrase-file <path>Path to a file containing the encryption passphrase. Required unless --plain.
--plainfalseWrite unencrypted JSON. Mutually exclusive with --passphrase-file.
--namespaces <list>(all)Comma-separated namespace allow-list.
--exclude-namespaces <list>kube-system,kube-node-lease,kube-publicComma-separated namespace deny-list.
--collectors <list>k8sComma-separated list of enabled collectors.
--include-secret-datafalseRead Secret data values (default: metadata only).
--include-configmap-datafalseRead ConfigMap data values (default: metadata only).
--versionPrint tool version and schema version, then exit.

skcapture imports only internal/capture and the Go standard library — it has no dependency on any blueprint, construct, or workload package. See tools.md for the full capture-to-blueprint workflow.

skforge — blueprint forge

Converts a captured inventory into a synthkit blueprint draft. Three subcommands:

skforge inspect <capture> --key <passphrase-file> [--plain]
skforge prompt  <capture> --key <passphrase-file> [--plain] [--report <path>]
skforge validate <blueprint.yaml>
SubcommandDescription
inspectDecrypt (or read plain) a capture file and print it as indented JSON.
promptDecrypt, map the deterministic skeleton, and emit a self-contained LLM prompt to stdout. Optionally write a coverage report to --report.
validateLoad a blueprint through the real registry + cardinality projection and print the result. Exits non-zero if invalid.
FlagApplies toDescription
--key <file>inspect, promptPath to the passphrase file. Required unless --plain.
--plaininspect, promptSkip decryption; treat the file as plain JSON.
--report <path>promptWrite a coverage report to this path.

See tools.md for the full skcapture → skforge → blueprint workflow.

synthkit-dash — dashboard generator

Generates Grafana v2 dashboards for a blueprint's synthetic telemetry. Resolves the blueprint, derives the signal manifest, runs registered templates, and writes dashboard JSON files.

go run ./cmd/synthkit-dash -blueprint <path> -out <dir> [flags]
FlagRequiredDescription
-blueprint <path>yesPath to the blueprint YAML.
-out <dir>yesOutput directory for generated JSON files.
-integrations <path>noOptional integrations config YAML for deep-link index.
-folder <uid>noGrafana folder UID to place every dashboard in (must already exist).

Always emits a thin index dashboard and a metrics dashboard. Per-blueprint templates produce additional dashboards when registered. Generated files are named <dashboard-uid>.json. Push and validate with gcx. See tools.md.

synthkit-control-dash — control dashboard generator

Generates the customer self-serve control dashboard: an Infinity-datasource-backed Grafana v2 dashboard exposing the master volume multiplier and incident scenario controls as read panels with native action buttons.

go run ./cmd/synthkit-control-dash -ds-name <name> -out <dir> [flags]
FlagRequiredDescription
-ds-name <name>yesInfinity datasource name.
-out <dir>yesOutput directory for generated JSON.
-write-base-url <url>noAbsolute browser-reachable base URL for action-button POSTs (per-deploy; defaults to tailscale-serve endpoint).
-blueprints <dir>noDirectory of *.yaml blueprints to enumerate scenarios from (default ./blueprints).

GET routes are open; POST routes use HTTP Basic auth so the browser handles the credential prompt natively — no token is embedded in the dashboard. See tools.md.

make targets

TargetDescription
make buildgo build ./...
make testgo test ./...
make vetgo vet ./...
make gateFull mandatory gate: build + vet + test + race + rw-proto-check + spdx-check + forbidden-words. Run before every commit.
make raceRace-detector test run over the whole module.
make blueprint-schemaRegenerate schema artifacts from live Go types. See blueprint-reference.md.
make dumpDRY_RUN=true go run ./cmd/synthkit -once -dump — full series/label inventory.
make rungo run ./cmd/synthkit
make dockerdocker compose up -d — pulls ghcr.io/rknightion/synthkit and starts the stack.
make docker-builddocker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build — build from source instead of pulling the published image.
make skills-syncRegenerate the cross-harness skill symlink farm (.claude/skills, .agents/skills, AGENTS.md) from plugins/synthkit/skills/.
make skills-checkVerify the symlink farm matches the canonical source. Safe for CI.
make protoRegenerate vendored RW2 protobuf Go types (requires protoc + protoc-gen-go).
make pyroscope-protoRegenerate vendored Pyroscope pprof + push protobuf Go types.
make rw-proto-checkDetect upstream RW2 proto drift (network; in gate).
make selfobs-dashboardBuild and push the self-obs dashboard to GCX_CONTEXT.
make uiBuild the control-plane UI assets (runs npm ci + npm run build).
make gate-uiControl-plane UI test + typecheck + build.
make spdx-checkVerify every .go file carries the AGPL-3.0-only SPDX header.
make forbidden-wordsContent guard for customer/deployment identifiers + credential shapes.
make hygienespdx-check + forbidden-words.
make secret-scanFull-history secret scan via gitleaks (requires Docker).
make noticesGenerate THIRD_PARTY_NOTICES.md from dependency licenses.
make sbomGenerate SPDX + CycloneDX SBOMs into dist/sbom/.
make e2eDocker-level end-to-end smoke test (requires Docker; //go:build e2e).
make ciLocal full-CI simulation: ci-go + ci-ui + ci-docker.
make env-checkEnv-surface drift guard: verifies all Go-read vars are documented in .env.example.