Deployment drift CLI

The mongoui-drift executable runs a saved Environment Compare → Deployment policy against two MongoDB deployments. It is local-first: the executable connects directly to both deployments, and the report contains bounded structural evidence rather than connection strings, credentials, documents, validators, or commands.

Export a policy

In the desktop app, save a deployment review profile, choose an explicit known-good baseline, and export the policy. Commit that policy JSON with the service or infrastructure it protects.

Run the gate

Download the native archive for your platform from the current release metadata, extract it, then provide both connection strings through environment variables:

MONGOUI_SOURCE_URI='mongodb://source.example/...' \
MONGOUI_DESTINATION_URI='mongodb://destination.example/...' \
./mongoui-drift \
  --policy mongoui-production.policy.json \
  --report mongoui-drift-report.json

The executable includes its runtime. Node.js, npm, tsx, and a Mongoui source checkout are not required.

Exit code 0 means the evidence is stable or only contains resolved drift. Exit code 1 means new or changed drift or incomplete coverage. Exit code 2 means the policy, arguments, connection, or runtime failed.

Update a baseline

Replace the policy baseline only after reviewing a complete known-good comparison:

MONGOUI_SOURCE_URI='mongodb://source.example/...' \
MONGOUI_DESTINATION_URI='mongodb://destination.example/...' \
./mongoui-drift --policy mongoui-production.policy.json --update

The update is explicit and writes only the same bounded structural baseline used by the desktop workflow.

Verify the download

Each archive's SHA-256, platform, architecture, and signing status are published in version.json. macOS executables are Developer ID signed and their archives are notarized. Windows and Linux archives are currently unsigned, so verify their SHA-256 before running them.