The qry operator CLI

qry is a single binary for the people who run a Qry installation. It checks a deployment before and after an upgrade, audits which model each setting really uses, and gathers a support bundle that already says what is wrong. It is cut from the same release as the platform, so its checks match the version they talk to.

Install and update

curl -fsSL https://get.qry.dev/install.sh | bash               # the latest release
QRY_VERSION=0.187.0 curl -fsSL https://get.qry.dev/install.sh | bash   # a specific one

qry update replaces the binary in place with the latest release (--version X.Y.Z for a specific one, --check to only report). Every download is checked against the release's published SHA-256 before it is installed.

Sign in

qry login --url https://qry.your-company.com

qry login uses the deployment's own sign-in, so the CLI acts as you: it has your permissions and can never do more than you can in the web. Credentials are kept in ~/.config/qry/config.yaml (mode 0600 — the file is refused if it is readable by others), one profile per deployment. For a scheduled run, QRY_URL and QRY_TOKEN provide a single deployment instead of a config file.

Check a deployment: qry doctor

qry doctor groups its checks by what each needs to run, so a run that cannot reach your cluster says so once instead of failing every cluster check.

Plane	Needs	Checks
product (default)	a qry login	what the API can see: licence, scheduled jobs failing repeatedly, model settings, prices
cluster	a kubeconfig, kubectl, helm	pods, restarts and out-of-memory kills, database migrations, the JWT secret
release	a kubeconfig	the preconditions for a helm upgrade: the target chart exists, the release is not stuck, every component is on the same tag
prerequisites	az login	an Azure AI Foundry environment before Qry is installed — whether Entra identity can actually reach each model endpoint

qry doctor                                              # the product plane
qry doctor --plane cluster -n qry-app
qry doctor --plane all --target-version 0.187.0 -n qry-app   # before an upgrade
qry doctor --explain                                    # what it would check, without checking
qry doctor --output json

A check that cannot run is reported as could not run, never as a pass. The exit status is 1 when a finding is an error (or any finding, with --strict), so qry doctor --strict in a nightly job fails as soon as something needs attention.

Checks are data, not code — a YAML file of endpoints or commands with an expression each — and you can supply your own with --checks FILE.

Model settings: qry models

A setting that names a model whose row was removed, or a disabled model, is silently replaced by a fallback at run time. qry models audit lists every admin setting that names a model and says which one it really runs. qry models bump moves settings to the vendor's named successor (a preview until --apply); a setting edited since the audit is skipped, never overwritten.

Upgrade: qry tenant upgrade

qry tenant upgrade --version 0.187.0 -n qry-app          # preflight, prints the helm command
qry tenant upgrade --version 0.187.0 -n qry-app --apply  # runs it, waits for the rollout, checks again

It runs the release-plane checks first, uses --reset-then-reuse-values (never --reuse-values, which fails on any value a new chart adds) and moves every component's image to the version. It changes nothing without --apply.

Support bundle: qry bundle

qry bundle -n qry-app --since 12h

Collects logs, events and the state of the deployment into one archive, with the result of qry doctor inside — so whoever receives it can see what is wrong without running anything. Kubernetes Secrets are never collected; ConfigMaps and Helm values only with --include-config, passed through a redactor that masks anything that looks like a credential — review the archive before you send it.

Everything else

Command	What it does
qry smoke	asks a real question end to end and reports each step
qry pricing apply	compares model prices with the published ones; --apply corrects them
qry config diff A B	what differs between two deployments' configuration
qry token list · qry token revoke <id>	your command-line tokens
qry profiles · qry logout	the deployments you are signed in to

Only qry pricing apply, qry models bump and qry tenant upgrade change anything, and none of them does without --apply.