> For the complete documentation index, see [llms.txt](/llms.txt).
> A full single-fetch corpus is available at [llms-full.txt](/llms-full.txt).
---
title: Serverless commands
description: Reference for scaffolding, validating, syncing, inspecting, and controlling AGNT5 serverless endpoints.
category: CLI
last_verified: 2026-07-09
---

The **`agnt5 serverless`** command group manages provider-hosted AGNT5 endpoints. Local scaffolding and validation do not require AGNT5 project state; registration, sync, status, dispatch controls, and provider links require authentication and a linked project.


**Command group**: `agnt5 serverless <command> [arguments] [options]`
**Commands**: `init`, `validate`, `register`, `sync`, `status`, `disable`, `enable`, `provider-link create`, `provider-link list`, `provider-link delete`
**Aliases**: `pause` for `disable`; `resume` for `enable`; `provider-links` for `provider-link`
**Project required**: `register`, `sync`, `status`, `disable`, `enable`, and all `provider-link` commands
**Machine output**: `--output json`


## Command summary

| Command | Purpose |
| --- | --- |
| `serverless init` | Add provider-native AGNT5 handler files to an existing project. |
| `serverless validate` | Validate a local or deployed endpoint without registering it. |
| `serverless sync` | Create or reuse an immutable AGNT5 deployment from a provider version. |
| `serverless register` | Attach an endpoint to the latest existing AGNT5 deployment. |
| `serverless status` | Inspect registration metadata and live manifest health. |
| `serverless disable` | Stop new dispatch while preserving deployment state. |
| `serverless enable` | Resume dispatch after health and compatibility checks. |
| `serverless provider-link` | Manage signed provider webhook automation. |

## `agnt5 serverless init`

```bash
agnt5 serverless init [options]
```

`init` generates handler files for an existing provider project. It never overwrites a generated path unless you pass `--force`.

| Flag | Description |
| --- | --- |
| `--provider <name>` | Target `vercel`, `cloudflare`, `node`, or `fastapi`; auto-detected when possible. `python` is accepted as an alias for `fastapi`. |
| `--dir <path>` | Project directory. Default: current directory. |
| `--name <name>` | Service name. Default: normalized directory name plus provider. |
| `--force` | Replace generated files that already exist. |
| `--dry-run` | Print generated paths without writing files. |

```bash
agnt5 serverless init --provider cloudflare --name hello-agnt5
agnt5 serverless init --provider vercel --dry-run
```

## `agnt5 serverless validate`

```bash
agnt5 serverless validate <endpoint> [options]
```

`validate` fetches the manifest and checks the endpoint URL, response type, protocol, service identity, component declarations, and manifest hash. It accepts HTTPS endpoints and loopback HTTP URLs such as `http://127.0.0.1:8787`.

| Flag | Description |
| --- | --- |
| `--manifest-path <path>` | Manifest path relative to the endpoint. Default: `/.well-known/agnt5`. |
| `--invoke-header <name=value>` | Provider access header; repeatable. |
| `--invoke-header-env <name=ENV_VAR>` | Provider access header read from an environment variable; repeatable. |
| `--timeout <duration>` | Endpoint validation timeout. Default: `10s`. |

```bash
agnt5 serverless validate https://hello-agnt5.example.workers.dev
agnt5 serverless validate https://preview.example.app \
  --invoke-header-env x-vercel-protection-bypass=VERCEL_AUTOMATION_BYPASS_SECRET
```

## `agnt5 serverless sync`

```bash
agnt5 serverless sync <endpoint> [options]
```

`sync` creates or reuses an immutable AGNT5 deployment, fetches its manifest, imports components, stores secret references, and optionally activates component routes in an environment.

| Flag | Description |
| --- | --- |
| `--provider <name>` | Provider identifier, such as `cloudflare`, `vercel`, or `node`. |
| `--immutable-ref <id>` | Provider version or deployment ID. For Vercel, defaults to `VERCEL_DEPLOYMENT_ID` when available. |
| `--env <name>` | AGNT5 environment. Default: `production`. |
| `--env-id <id>` | Environment ID; overrides `--env`. |
| `--name <name>` | AGNT5 deployment display name. |
| `--version <label>` | Deployment version label. Default: immutable reference. |
| `--git-sha <sha>` | Git or provider commit reference. |
| `--commit-message <text>` | Commit or deployment message stored with the deployment. |
| `--activate <bool>` | Activate imported component routes. Default: `true`; use `--activate=false` for promotion checks. |
| `--manifest-path <path>` | Manifest path relative to the endpoint. Default: `/.well-known/agnt5`. |
| `--signing-secret <value>` | HMAC signing secret. Prefer an environment variable or secret reference. |
| `--signing-secret-env <name>` | Environment variable containing the HMAC signing secret. |
| `--signing-secret-ref <ref>` | Existing AGNT5 secret reference containing the HMAC signing secret. |
| `--invoke-header <name=value>` | Provider invoke header; repeatable. |
| `--invoke-header-env <name=ENV_VAR>` | Provider invoke header read from an environment variable; repeatable. |
| `--invoke-headers-ref <ref>` | Existing AGNT5 secret reference containing provider invoke headers. |
| `--request-timeout-ms <ms>` | AGNT5 invoke request timeout. |
| `--yield-before-timeout-ms <ms>` | SDK yield margin before the provider timeout. |
| `--replace-route-owners` | Replace conflicting active component route owners. |

```bash
agnt5 serverless sync https://hello-agnt5.example.workers.dev \
  --provider cloudflare \
  --env production \
  --immutable-ref <cloudflare-version-id> \
  --signing-secret-env AGNT5_SERVERLESS_SIGNING_SECRET \
  --activate=false
```

## `agnt5 serverless register`

```bash
agnt5 serverless register <endpoint> [options]
```

`register` attaches an endpoint to the latest deployment in the linked project. Use `sync` for normal provider deployments because sync creates or reuses the immutable AGNT5 deployment version.

| Flag | Description |
| --- | --- |
| `--manifest-path <path>` | Manifest path relative to the endpoint. Default: `/.well-known/agnt5`. |
| `--provider <name>` | Provider identifier. Default: `http`; use `cloudflare` for Cloudflare Workers. |
| `--immutable-ref <id>` | Provider version or deployment ID. For Vercel, defaults to `VERCEL_DEPLOYMENT_ID` when available. |
| `--signing-secret <value>` | HMAC signing secret. Prefer an environment variable or secret reference. |
| `--signing-secret-env <name>` | Environment variable containing the HMAC signing secret. |
| `--signing-secret-ref <ref>` | Existing AGNT5 secret reference containing the HMAC signing secret. |
| `--invoke-header <name=value>` | Provider invoke header; repeatable. |
| `--invoke-header-env <name=ENV_VAR>` | Provider invoke header read from an environment variable; repeatable. |
| `--invoke-headers-ref <ref>` | Existing AGNT5 secret reference containing provider invoke headers. |
| `--request-timeout-ms <ms>` | AGNT5 invoke request timeout. |
| `--yield-before-timeout-ms <ms>` | SDK yield margin before the provider timeout. |
| `--replace-route-owners` | Replace conflicting active component route owners. |

`register` does not accept environment, version-label, commit metadata, or activation flags.

## `agnt5 serverless status`

```bash
agnt5 serverless status [options]
```

| Flag | Description |
| --- | --- |
| `--deployment-id <id>` | Deployment to inspect. Default: latest deployment in the linked project. |
| `--verify` | Exit nonzero unless manifest health, dispatch, signing, protocol, and manifest compatibility checks pass. |

```bash
agnt5 serverless status \
  --deployment-id <agnt5-deployment-id> \
  --verify \
  --output json
```

## `agnt5 serverless disable`

```bash
agnt5 serverless disable [options]
```

Alias: **`agnt5 serverless pause`**.

| Flag | Description |
| --- | --- |
| `--deployment-id <id>` | Deployment to disable. Default: latest deployment in the linked project. |
| `--reason <text>` | Reason stored with the dispatch gate. |

Disabling blocks new dispatch resolution but preserves endpoint registration, health, manifest, and durable state.

## `agnt5 serverless enable`

```bash
agnt5 serverless enable [options]
```

Alias: **`agnt5 serverless resume`**.

| Flag | Description |
| --- | --- |
| `--deployment-id <id>` | Deployment to enable. Default: latest deployment in the linked project. |
| `--allow-incompatible` | Resume despite failed live manifest health or compatibility checks. |

## `agnt5 serverless provider-link create`

```bash
agnt5 serverless provider-link create [options]
```

Provider links accept signed deployment callbacks and sync provider versions into an AGNT5 environment.

| Flag | Description |
| --- | --- |
| `--provider <name>` | Provider identifier. |
| `--env <name>` | AGNT5 environment. Default: `production`. |
| `--env-id <id>` | Environment ID; overrides `--env`. |
| `--provider-account-id <id>` | Provider account or team identifier. |
| `--provider-project-id <id>` | Provider project or site identifier. |
| `--provider-service-name <name>` | Provider script, service, or application name. |
| `--provider-environment <name>` | Provider environment name. |
| `--endpoint-template <url>` | Endpoint template used when callback payloads omit the endpoint. |
| `--activation-policy <policy>` | `manual`, `auto_activate`, or `sync_only`. Default: `manual`. |
| `--signing-secret <value>` | Endpoint HMAC secret. Prefer an environment variable or secret reference. |
| `--signing-secret-env <name>` | Environment variable containing the endpoint HMAC secret. |
| `--signing-secret-ref <ref>` | Existing AGNT5 endpoint signing-secret reference. |
| `--invoke-header <name=value>` | Provider invoke header; repeatable. |
| `--invoke-header-env <name=ENV_VAR>` | Provider invoke header read from an environment variable; repeatable. |
| `--invoke-headers-ref <ref>` | Existing AGNT5 provider-header secret reference. |
| `--webhook-secret <value>` | Provider callback verification secret. Prefer an environment variable or secret reference. |
| `--webhook-secret-env <name>` | Environment variable containing the callback verification secret. |
| `--webhook-secret-ref <ref>` | Existing AGNT5 callback verification-secret reference. |
| `--disabled` | Create the provider link disabled. |

## `agnt5 serverless provider-link list`

```bash
agnt5 serverless provider-link list [options]
```

| Flag | Description |
| --- | --- |
| `--provider <name>` | Filter by provider. |
| `--env <name>` | Filter by AGNT5 environment name. |
| `--env-id <id>` | Filter by AGNT5 environment ID. |
| `--enabled <boolean>` | Filter by enabled state: `true` or `false`. |

## `agnt5 serverless provider-link delete`

```bash
agnt5 serverless provider-link delete <provider-link-id>
```

Deleting a provider link stops future callback automation. It does not delete AGNT5 deployments already created by that link.

## Next steps

- [Deploy to Cloudflare Workers](/docs/integrations/cloudflare-workers.md): use the commands in a new provider project.
- [Operate serverless endpoints](/docs/run/operate-serverless-endpoints.md): follow the safe promotion and rollback lifecycle.
- [Serverless endpoints](/docs/run/serverless-endpoints.md): review the protocol, host matrix, and beta limits.
- [CLI overview](/cli): browse the rest of the AGNT5 command reference.