Onboarding CLI (`rdakt`)

The rdakt-ai CLI ships three subcommands aimed at the "first five minutes" of using rdakt: init (interactive wizard), validate (dry-run your config against sample payloads), and show (print the resolved config exactly as the middleware sees it).

All three are pure local commands — no API keys, no network. Run them freely in CI.

`rdakt-ai init` — interactive wizard

$ rdakt-ai init

Rdakt AI — Project Setup

? What providers do you call? (comma-separated indices, e.g. 1,2)
  1) OpenAI / OpenAI-compatible
  2) Anthropic
  3) Google Gemini
  4) LiteLLM router
  5) OpenRouter
  >  1,2

? Sample request body (path to JSON, or 'skip'): samples/openai_chat.json

  Detected the following PII in the sample:
    EMAIL: 2 instance(s) at $.messages[0].content
    PERSON: 1 instance(s) at $.messages[0].content

? Want field-specific ontology rules for structured paths? [y/N]: y

? For path "$.messages[*].metadata.user_id" — what is this?
  1) Internal ID (replace with synthetic)
  2) Domain identifier (custom regex)
  3) Skip — leave to global pipeline
  > 1
    Entity type name [USER_ID]:
    Synthetic format [user_id-{n:06d}]:

? Anonymization strategy [hybrid]: token
? Mode [active]:
? Set RDAKT_TOKEN now (optional, leave blank to skip):

✓ Wrote rdakt.yaml
  Run `rdakt-ai validate <path>` to dry-run the config against more samples.

The wizard:

Runs the existing RegexDetector over every string-leaf in your sample and reports per-(type, jsonpath) counts so you can see at a glance what would be redacted.
Suggests structured paths (anything ending in _id, _number, _code, _ref) for ontology rules. For each you can pick internal ID (whole-value synthetic), domain identifier (inline regex), or skip.
Validates the YAML through RdaktConfig before writing, so a typo'd rule fails at wizard time rather than at first request.

Non-interactive mode

$ rdakt-ai init --non-interactive
Wrote rdakt.yaml (non-interactive defaults).

Emits a sensible default config (regex pipeline, all built-in entities, hybrid strategy, memory store). Used by tests and CI scaffolding.

Flags

Flag	Effect
`-o, --output PATH`	Output yaml path (default `rdakt.yaml`)
`--no-overwrite`	Refuse if `rdakt.yaml` already exists
`--non-interactive`	Skip prompts, write defaults
`--sample PATH`	Pre-feed a sample JSON for analysis

`rdakt-ai validate <path>` — dry-run

Runs your config against one or more JSON files (or directories of JSON files) and prints what would be redacted, without touching the network.

$ rdakt-ai validate samples/

samples/openai_chat.json
  $.messages[0].content
    EMAIL      'alice@example.com'    -> '<EMAIL_1>'
    PERSON     'Alice Smith'          -> 'Beverly Olson'

samples/anthropic.json
  $.messages[0].content
    PHONE      '(555) 123-4567'       -> '<PHONE_1>'

2 file(s) processed, 3 entit(ies) redacted, 0 error(s).

Flag	Effect
`-c, --config PATH`	Config file (default `rdakt.yaml`)
`--summary`	Per-file totals only — suppress per-entity rows

Exit code is 0 if every file parsed, 1 if any file produced an error (malformed JSON, etc.), 2 if no JSON files were found. Safe to wire into CI as a regression check on your sample payloads.

The validate pass uses the same OntologyApplier as the runtime middleware, so per-field synthetic / hash / detect-subset rules show up exactly as they would in production.

`rdakt-ai show` — resolved config

Prints the config the middleware would actually load, after all defaults are filled in. Useful when you're debugging why a rule isn't firing.

$ rdakt-ai show
# Effective config (rdakt.yaml + defaults applied)

mode: active
on_error: warn_and_forward
pipeline:
  - regex
session:
  store: memory
placeholders:
  template: <{TYPE}_{N}>
  case: preserve
ontology:
  fields:
    - path: $.messages[*].metadata.user_id
      replace_with_synthetic:
        type: USER_ID
        format: user-{n:06d}
entities: {}

Use --format json for tooling-friendly output. Credentials embedded in URLs (e.g. redis://user:password@host) are masked as redis://***@host so you can paste the output into bug reports without leaking secrets.

Recommended onboarding flow

$ rdakt-ai init                        # wizard, writes rdakt.yaml
$ rdakt-ai validate samples/           # confirm it does what you expect
$ rdakt-ai show                        # debug if a rule isn't firing

Onboarding CLI (`rdakt`)

rdakt-ai init — interactive wizard

Non-interactive mode

Flags

rdakt-ai validate <path> — dry-run

rdakt-ai show — resolved config

Recommended onboarding flow

On this page

`rdakt-ai init` — interactive wizard

`rdakt-ai validate <path>` — dry-run

`rdakt-ai show` — resolved config