[[command]]
name = "render"
description = "Render's hosting-platform CLI (render CLI v2.19.0) for managing services, datastores, deploys, jobs, blueprints, workflows, and workspaces on the Render PaaS via its HTTPS API. Structure is `render <group> <action>` with a global --output (interactive|json|yaml|text), --confirm, and per-command flags. OBSERVE subs query the control-plane API and return remote state without changing it: whoami, workspaces, projects, environments, services (+ instances), deploys list, jobs list, logs — plus workspace current (reads LOCAL config) and blueprints validate (checks a render.yaml before deploy). login runs a browser OAuth flow and writes the resulting token under ~/.render/ (stored locally, never printed to the caller). The state-changing surface talks to the production control plane: services create/update (provision or reconfigure a service), deploys create/cancel and restart (trigger or stop a deploy, reboot a running service), jobs create (runs a caller-supplied startCommand on a one-off job instance derived from the service — remote code execution), and jobs cancel. ssh opens a shell on a running instance; psql/pgcli/kv-cli open interactive client sessions (arbitrary read AND write, including DDL/DML) against a managed Postgres or Key Value datastore — all effectively remote command execution. workspace set rewrites the active-workspace pointer in local config, redirecting every subsequent command's account context. skills install/update/remove/list manage Render agent-skill files inside local AI coding tools. workflows is a group (create/start/cancel, tasks runs, versions release/list) that provisions and runs Render Workflows tasks on remote infra. Upstream note: `render pg get` and `render kv get` accept --include-sensitive-connection-info, which PRINTS datastore credentials — those subs are NOT in coverage and must not be added without a credential-read classification. The CLI iterates moderately frequently, adding flag groups as platform features ship."
url = "https://render.com/docs/cli-reference"
researched_version = "render CLI v2.19.0 (render.com/docs/cli-reference), 2026-07-16"
bare_flags = ["--help", "--version", "-h", "-v"]
examples_safe = [
"render whoami",
"render workspaces",
"render workspace current",
"render projects",
"render services",
"render deploys list",
"render jobs list",
"render logs",
"render blueprints validate render.yaml",
"render whoami -o json",
]
examples_denied = [
"render services create my-service",
"render services update srv-abc",
"render deploys create srv-abc",
"render deploys cancel dep-abc",
"render jobs create srv-abc",
"render restart srv-abc",
"render ssh srv-abc",
"render psql dpg-abc",
"render kv-cli red-abc",
"render workspace set ws-abc",
]
[[command.sub]]
name = "login"
level = "SafeWrite"
standalone = ["--help", "-h"]
[[command.sub]]
name = "whoami"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "workspaces"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "workspace"
[[command.sub.sub]]
name = "current"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub.sub]]
name = "set"
candidate = true
[[command.sub]]
name = "projects"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "environments"
bare = false
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "services"
nested_bare = true
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub.sub]]
name = "instances"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub.sub]]
name = "create"
profile = "remote-create"
fact = "Creates a new service on Render (non-interactive mode), provisioning it on the control plane via the HTTPS API; the service is billed per its instance type."
source = "https://render.com/docs/cli-reference — `render services create`"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub.sub]]
name = "update"
profile = "remote-mutate"
fact = "Updates configuration for an existing service on the Render control plane via the API."
source = "https://render.com/docs/cli-reference — `render services update`"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "deploys"
[[command.sub.sub]]
name = "list"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub.sub]]
name = "create"
profile = "remote-control"
fact = "Triggers a deploy for the specified service on Render and streams logs in real time; rolls new code/config to the running service."
source = "https://render.com/docs/cli-reference — `render deploys create`"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub.sub]]
name = "cancel"
profile = "remote-control"
fact = "Cancels a running deploy for a service via the Render API."
source = "https://render.com/docs/cli-reference — `render deploys cancel`"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "jobs"
[[command.sub.sub]]
name = "list"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub.sub]]
name = "create"
profile = "remote-exec"
fact = "Creates a one-off job for a service; the required startCommand specifies the command Render runs on a job instance that inherits the base service's build artifact and environment variables."
source = "https://render.com/docs/one-off-jobs — Create job (startCommand); https://render.com/docs/cli-reference — `render jobs create`"
judgment = "Runs caller-supplied code on Render infra with the service's full environment — arbitrary remote command execution, not merely a control signal."
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub.sub]]
name = "cancel"
profile = "remote-control"
fact = "Cancels a running one-off job for a service via the Render API."
source = "https://render.com/docs/cli-reference — `render jobs cancel`"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "logs"
standalone = ["--confirm", "--help", "--tail", "--text", "-h"]
valued = [
"--direction", "--end", "--host", "--instance", "--level",
"--limit", "--method", "--output", "--path", "--resources",
"--start", "--status-code", "--task-id", "--task-run-id",
"--type",
"-o", "-r",
]
[[command.sub]]
name = "blueprints"
[[command.sub.sub]]
name = "validate"
bare = false
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "--workspace", "-o", "-w"]
[[command.sub]]
name = "restart"
profile = "remote-control"
fact = "Restarts a running service by resource ID, rebooting it via the Render control plane."
source = "https://render.com/docs/cli-reference — `render restart`"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "ssh"
profile = "remote-exec"
fact = "Opens an interactive SSH terminal session to a running service instance."
source = "https://render.com/docs/cli — SSH into a service instance; https://render.com/docs/cli-reference — `render ssh`"
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "psql"
profile = "remote-exec"
fact = "Opens an interactive psql session to a managed Render Postgres database; can run arbitrary SQL (read and write, including DDL/DML) and accepts --command to execute SQL non-interactively."
source = "https://render.com/docs/cli — psql; https://render.com/docs/cli-reference — `render psql`"
judgment = "An interactive DB shell against remote data is arbitrary remote read/write; classified as remote code execution against the datastore, not a mere read."
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "pgcli"
profile = "remote-exec"
fact = "Opens an interactive pgcli session to a managed Render Postgres database; arbitrary SQL read/write against remote data."
source = "https://render.com/docs/cli-reference — `render pgcli`"
judgment = "Same as psql: interactive remote DB shell = arbitrary remote read/write."
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "kv-cli"
profile = "remote-exec"
fact = "Opens an interactive redis-cli or valkey-cli session for a managed Render Key Value instance; arbitrary command read/write against the remote store."
source = "https://render.com/docs/cli-reference — `render kv-cli`"
judgment = "Interactive remote Key Value shell = arbitrary remote read/write."
standalone = ["--confirm", "--help", "-h"]
valued = ["--output", "-o"]
[[command.sub]]
name = "skills"
candidate = true
[[command.sub]]
name = "workflows"
candidate = true