CLI

The Mirops CLI brings the mirror into a pipeline. It has one command — mirops scan — that reads the mirror report and runs the checks its inputs ask for:

• A namespace's current state (-n / MIROPS_NAMESPACE) — one, a list, or all. Informational; it never blocks.
• The upgrade verdict (--upgrade / MIROPS_UPGRADE=true) — from the analysis report at --upgrade-source / MIROPS_UPGRADE_SOURCE. With --enforce it fails the pipeline when the upgrade isn't safe.

export MIROPS_SOURCE=s3://my-reports/prod/default.mirops
mirops scan -n payments

MIROPS_UPGRADE=true MIROPS_UPGRADE_SOURCE=s3://my-reports/prod/to-1-35.mirops \
  mirops scan --enforce
# exit 1 when decision.allow == false (CRITICAL)

What it shows

• Namespaces — each requested namespace's components at risk, their status, where their risk comes from, how many depend on them, and the risk. With all, only the namespaces with something at risk, plus a count of the healthy ones.
• Upgrade — the full analysis as headed tables: the verdict, score breakdown, add-on compatibility, namespace risk, workloads, and a closing verdict block. When the cluster already runs the analysis's target version it prints no upgrade pending instead.

Color is used on a real terminal (disabled when piped or with NO_COLOR). --output json prints one document with a schemaVersion for other tools.

Sources

--source and --upgrade-source accept local and remote reports, each read with the pipeline's own credentials:

Scheme	Example
Local file	./default.mirops
HTTP	http://mirops-reports.mirops:8084/reports/default.mirops?kind=ClusterMirror
S3	s3://bucket/prod/default.mirops
Azure Blob	azure://account/container/default.mirops

Cloud credentials resolve automatically (IRSA / Workload Identity / env vars / az login).

Gating

Setting	Effect
(none)	Reports only — exits 0 unless it couldn't evaluate.
--enforce	Fails (exit 1) when the upgrade verdict is blocked (CRITICAL).
--enforce --enforce-level warning	Stricter — also fails on WARNING.

Exit 2 means it couldn't evaluate — never a pass. Every flag has an environment-variable equivalent (MIROPS_SOURCE, MIROPS_UPGRADE, …). See the CLI reference for the full list.

Install

Download the release binary for your platform, make it executable, and put it on your PATH. No sudo required — the same steps work on a laptop or in a CI pipeline.

# 1. Download the binary for your platform (see the table below for the name)
curl -fsSL -O https://github.com/miropshq/mirops-cli/releases/latest/download/mirops-darwin-arm64

# 2. Install it on a user-writable dir on your PATH
mkdir -p "$HOME/.local/bin"
cp mirops-darwin-arm64 "$HOME/.local/bin/mirops"
chmod +x "$HOME/.local/bin/mirops"

# 3. Ensure the dir is on your PATH (add to your shell rc to persist)
export PATH="$HOME/.local/bin:$PATH"

# 4. Verify
mirops --version

Platform binaries

Platform	Binary
macOS (Apple Silicon)	mirops-darwin-arm64
macOS (Intel)	mirops-darwin-amd64
Linux (x86_64)	mirops-linux-amd64
Linux (arm64)	mirops-linux-arm64
Windows (x86_64)	mirops-windows-amd64.exe

Swap the binary name in the curl URL for your platform.

Latest vs. pinned version

# Always the newest release
curl -fsSL -O https://github.com/miropshq/mirops-cli/releases/latest/download/mirops-linux-amd64

# Pin a version (reproducible — recommended for CI)
curl -fsSL -O https://github.com/miropshq/mirops-cli/releases/download/v0.2.0/mirops-linux-amd64

Verify the checksum (optional)

curl -fsSL -O https://github.com/miropshq/mirops-cli/releases/latest/download/checksums.txt
shasum -a 256 --check --ignore-missing checksums.txt   # macOS
sha256sum --check --ignore-missing checksums.txt        # Linux

See Use it in CI/CD for a pipeline example.

• Source: github.com/miropshq/mirops-cli