opschain admin agent show

packs:agents

opschain admin agent show <agent> [--server <url>] [--auth-token <token>]

Shows one agent in full (v2 AgentService.GetAgent): identity, manifest facts, lifecycle, channel and host inventory. The default rendering is a two-column field table; -o json or -o yaml prints the raw detail document.

<agent> is the agent's member id (the ID column of opschain admin agents list), <project>/<code>, or a bare agent code when exactly one project holds it. A bare code that several projects hold is refused with the project/code candidates to pick from, and a reference matching no agent is refused by name. A revoked id answers 404 exactly like an unknown one: the tombstone is never exposed.

Fields

• ID / NAME / CODE / PROJECT / GROUP — identity: the member id, display name, per-project-unique code, project path and fleet group.
• OWNED BY — the agent's accountable owner (a user or group from the identity catalog), set via opschain admin agent owner; - when unowned.
• STATE — the roll-up the list view shows: halted (optionally (group)) wins, then stopped, then quiesced (drain — with (group) or (agent+group) scope), then ready when online, else - (never seen).
• ONLINE — ✓ when the agent said hello within the liveness window (3 minutes) and has not said goodbye; - otherwise.
• CHANNEL — the live carriage: stream (attached stream), poll (poller seen within two poll windows), or - when not connected to this replica.
• LAST SEEN / STOPPED / REGISTERED / DRAIN REQUESTED / HALTED — lifecycle timestamps (UTC RFC 3339; - when unset).
• GROUP DRAINING / HALT REASON — group-level drain, and the effective halt reason (the agent's own, else its group's).
• SPEC VERSION / AGENT VERSION / TYPE / CAPABILITIES / MAX CONCURRENT / ENDPOINT URL / SOURCE — manifest facts: the minimum-spec version, the agent build, its declared type (service or ai; ai marks an AI-type agent, whose enrolment required the packs:agent-governance + packs:ai-agents entitlements; - when untyped), its declared capabilities (sorted), concurrency cap, advertised endpoint and manifest source.
• PURPOSE / MODEL / ADAPTER / TOOL SURFACE / CUSTODY / DISCLOSED BY — the manifest disclosures: the declared purpose/label (any type), and for an ai-type agent the model (provider/name@version), the adapter/SDK (name@version), the disclosed estate tool surface (sorted, comma-joined) and the model-credential custody mode (agent-host or vault-to-host). DISCLOSED BY reads release (frozen) when the set renders from the enrolment-bound signed release's frozen manifest (authoritative — a contradicting live declaration refuses registration), else manifest. - when nothing is disclosed (only possible for non-ai types: the AI disclosures are attested at enrolment).
• MODEL PROVIDER — the model-provider catalog entry the agent's model calls are brokered through: the manifest's provider reference by catalog code, with the entry's kind and current standing — demo-anthropic (anthropic, enabled), demo-anthropic (anthropic, disabled) (every gateway call refuses until re-enabled) or demo-anthropic (missing from the catalog) (deleted since enrolment — every gateway call refuses). - (no brokering: <custody> custody) when the manifest names no provider (agent-host or vault-to-host custody). Exactly one entry, bound by code and never resolved by kind: with several anthropic entries registered, this row says which one. Distinct from the MODEL row, whose provider segment is the vendor the agent discloses (anthropic), not a catalog code. In the JSON detail: model_provider_code, model_provider_kind, model_provider_state (ok / disabled / missing).
• RELEASE / RELEASE STAGE / RELEASE ID — the enrolment-bound signed release: name@version, its current promotion stage, and its id (release_id/release_name/release_version/release_stage in the JSON detail); - when the agent was not enrolled from a release.
• INSTANCE ID / LANE / INSTANCES — this row's durable instance id and the lane it serves, then every instance of the agent (this one included) as release lane instance-id state, grouped by release and lane (instance_id, lane, instances in the JSON detail); opschain admin agent instances <agent> tabulates them.
• HOSTNAME / CPUS / GO / AGENT BUILD / PID / STARTED / STATE DIR — host inventory reported by the agent process.
• OBSERVED REMOTE — the remote address the server saw the agent register from.
• KEY FINGERPRINT — the fingerprint of the agent's public key; the key itself is never rendered.
• SERVICE ACCOUNT / SERVICE ACCOUNT ID — the agent's durable identity principal (svc-agent-<project>-<code>, auth provider kind agent): the fleet→identity cross-link into the users surfaces, where the same row badges agent and links back here. - on compositions without an identity backend.

Flags

Flag	Meaning
--server <url>	Server base URL. Default: the active context, then OPSCHAIN_SERVER.
--auth-token <token>	Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login for that server.

Exit codes

Code	Meaning
0	The agent was found and printed.
1	The server refused or failed the request (including a rejected admin token, or an unknown/revoked id).
2	Usage — wrong arguments, or no server / admin token resolvable.

Named errors

• a server is required — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>' — exit 2.
• this command needs a login or an admin token — run 'opschain login', pass --auth-token, set OPSCHAIN_ADMIN_TOKEN, or store one with 'opschain admin login' — exit 2.
• the server rejected the credential — run 'opschain login' again, or check the admin token — exit 1.
• agent <id> is not known to this estate — admin agent verbs take the ocr_ member id from 'opschain admin agents list' (a UUID is usually the identity-side service_account_id, not the member id) — the unknown or revoked id 404, exit 1.
• agent code "<code>" is ambiguous across projects — name it as project/code: <candidates> — a bare code several projects hold; exit 1.
• no agent matches "<ref>" — use the ocr_ member id, project/code, or an agent code from 'opschain admin agents list' — exit 1.

See also

• opschain docs cli/admin-agents-list — the fleet view this drills into.
• opschain docs cli/admin-agent-activity — the agent's audit timeline.
• opschain docs cli/admin-agent-trust-review — the agent's governance posture.