CLI Finder

pulumi · Pulumi

Pulumi CLI for AI Agents

Preview and apply infrastructure programs with structured output and explicit stack controls.

Official toolOperational risk: R0–R3docs-verified
Install for an AgentReport broken data
Agent readiness
87/100
Evidence confidence
docs-verified
Documentation checked
2026-07-10
Independently tested version
Not independently tested

Install for an Agent

Choose an official installation path that matches the runtime. Pin a version for team or CI use, then record the version before the first task.

HomebrewRecommended
macos · linux
$ shell
brew install pulumi/tap/pulumi
winget
windows
$ shell
winget install Pulumi.Pulumi
Authentication and Minimum Permissions
Grant only the permissions the task needs. Pass credentials through environment variables or a platform secret store, never through prompts, repositories, or logs.
Authentication requiredHeadless authentication supported

Select the exact stack and use read-only cloud credentials for previews.

Methods
Pulumi access token, DIY backend, provider credentials
Secret environment variables
PULUMI_ACCESS_TOKEN, PULUMI_CONFIG_PASSPHRASE
Credential storage
For headless runs, inject PULUMI_ACCESS_TOKEN, PULUMI_CONFIG_PASSPHRASE from the CI or platform secret manager at process start. For local interactive use, prefer the CLI or operating-system credential store when the official client supports one. Never save values in repository files.
Agent and Environment Compatibility
Confirm shell access first, then check the platform, network boundary, and credential path.
claude-codecodexgemini-clicopilot-cli
Environments
local, ci, container, headless, remote
Platforms
macos, linux, windows

Structured Output for Reliable Automation

Prefer a machine-readable format. Treat stdout as the result channel and stderr as diagnostics so the agent can parse failures separately.

json · text
Use --json or --diff where supported and keep diagnostic logs on stderr.
--json--diff

No independently captured output sample

Structured-output support currently comes from official documentation. CLI Finder does not show a guessed example or invented schema before a bounded, non-destructive execution captures stdout.

R0–R3 Command Risk Guide

Risk is assigned per command. R0 is local or remote read-only, R1 is reversible local write, R2 changes remote state, and R3 can be irreversible or production-impacting.

Read-only does not mean public

R0 only means the command does not change local or remote state. A read-only command may still return secrets, identity data, configuration, or production data. Expose only the minimum needed for the task, and never place it in logs, prompts, or commits.

R0Read stack outputs
Reads outputs from the explicitly selected stack.
$ shell
pulumi stack output --json --stack ORG/PROJECT/STACK
IdempotentSensitive output
R0Preview changes
Calculates infrastructure changes without applying them.
$ shell
pulumi preview --json --stack ORG/PROJECT/STACK
Idempotent
R2Apply an update
Changes remote infrastructure in the selected stack.
$ shell
pulumi up --stack ORG/PROJECT/STACK
Confirmation requiredMay repeat a change
R3Destroy a stack
Deletes managed resources from the selected stack.
$ shell
pulumi destroy --stack ORG/PROJECT/STACK
Confirmation requiredMay repeat a change

How the Agent Readiness Score Is Built

Readiness describes how reliably an agent can operate the tool. It does not make every command safe and it does not replace an independent execution test.

Documentation indicates an agent-readiness score of 87/100. No local execution test has been recorded.

Structured output
Use --json or --diff where supported and keep diagnostic logs on stderr.
18/20
x
Headless operation
Official documentation describes a non-interactive authentication or execution path.
14/15
x
Safety controls
The documented command surface includes a dry-run, preview, plan, or check path.
14/15
x
Determinism
Commands use explicit arguments and documented output controls where available.
8/10
x
Authentication
Select the exact stack and use read-only cloud credentials for previews.
8/10
x
Documentation
This entry cites official documentation checked on 2026-07-10.
9/10
x
Installation
Official installation paths cover macOS, Linux, and Windows.
8/8
x
Maintenance
An official source repository is linked for release and maintenance review.
6/7
x
Agent artifacts
CLI Finder can generate registry-derived skills and policies; the tool itself was not credited with shipping them.
2/5
x

Generate a Skill or Agent Policy

Choose an agent and safety mode to generate a copyable artifact with installation, allowed commands, approval boundaries, and the evidence limitation.

Generated artifact preview
SKILL.md
---
name: pulumi-agent-workflow
description: Use Pulumi CLI for infrastructure as code, stack previews, typed cloud programs with explicit command risk and evidence boundaries.
---

# Pulumi CLI agent workflow

Use this skill when the task needs infrastructure as code, stack previews, typed cloud programs, deployment history.

## Evidence boundary

- Registry confidence: `docs-verified`
- Documentation checked: `2026-07-10`
- Locally tested version: `not tested`
- Do not describe this CLI as locally verified until its commands have actually been executed in an isolated environment.

## Executed smoke checks

- No local execution record is available.

## Installation

- Homebrew (macos, linux): `brew install pulumi/tap/pulumi`
- winget (windows): `winget install Pulumi.Pulumi`

## Authentication

- Methods: Pulumi access token, DIY backend, provider credentials
- Secret environment variables: `PULUMI_ACCESS_TOKEN`, `PULUMI_CONFIG_PASSPHRASE`
- Minimum permissions: Select the exact stack and use read-only cloud credentials for previews.
- Credential storage: For headless runs, inject PULUMI_ACCESS_TOKEN, PULUMI_CONFIG_PASSPHRASE from the CI or platform secret manager at process start. For local interactive use, prefer the CLI or operating-system credential store when the official client supports one. Never save values in repository files.
- Never print, persist, or commit credential values.

## Allowed commands (read-only)

- `pulumi stack output --json --stack ORG/PROJECT/STACK` — R0: Reads outputs from the explicitly selected stack.
- `pulumi preview --json --stack ORG/PROJECT/STACK` — R0: Calculates infrastructure changes without applying them.

## Commands requiring explicit approval (read-only)

- None recorded.

## Forbidden commands (read-only)

- R2 `pulumi up --stack ORG/PROJECT/STACK` — Changes remote infrastructure in the selected stack.
- R3 `pulumi destroy --stack ORG/PROJECT/STACK` — Deletes managed resources from the selected stack.

## Execution rules

1. Mode boundary: R0 exact commands may be used; R1, R2, and R3 commands are forbidden.
2. Confirm the selected account, project, context, database, namespace, or environment before any command.
3. Prefer structured output using `--json`, `--diff`.
4. Capture the exact command, exit code, stdout, and stderr separately.
5. A generated prefix policy must prompt unless that exact prefix is explicitly marked suffix-safe; do not infer safety from the executable name.
6. Never broaden credentials or disable safety controls to make a command succeed.

## Official sources

- [Pulumi CLI documentation](https://www.pulumi.com/docs/iac/cli/)
- [Pulumi CLI documentation source repository](https://github.com/pulumi/pulumi)

CLI vs MCP vs API for This Task

CLI
Use the CLI on a developer machine, in CI, or in a container when the task should reuse existing shell state, credentials, and scripts and remain directly observable.
MCP
Consider MCP when the agent benefits from controlled tool definitions, delegated identity, or centrally governed server-side access.
API
Use the direct API for persistent application integrations, high-volume requests, or event-driven work where starting a process adds unnecessary overhead.
Read the full CLI vs MCP guide

Verification History and Official Evidence

CLI Finder records documentation review separately from real execution. Installation, help, exit codes, and output cannot be called Verified until they were run.

Current evidence boundary
Official documentation was reviewed, but installation, help output, exit codes, headless behavior, and structured output were not executed locally.
Evidence confidence
docs-verified
Independently tested version
Not independently tested
Test environment
Not recorded
Official sources
Open the official material to confirm the current version and command behavior.

Alternatives and Related Paths

Operations and Infrastructure
Observe applications and plan infrastructure changes safely.
Terraform CLI
Format, validate, plan, and apply infrastructure while keeping plan and apply risk distinct.
OpenTofu CLI
Plan and manage open-source infrastructure state with explicit approval for remote changes.
Search application logs
Constrain the time, service, file, and pattern first; then collect only the lines needed to explain the incident.
Codex CLI stack
Pair Codex with deterministic local tools and add remote CLIs only when the sandbox and approval policy allow the task.
CLI vs MCP
Choose CLI for shell-native local and CI work; choose MCP when typed discovery and mediated remote permissions matter more.

Questions About Pulumi CLI for AI Agents

Back to all CLI tools