Introducing the Coralogix CLI: Headless Observability for Every Agent

This article is a high-level overview of the Coralogix CLI. For a deeper look at how it works in practice, read the full technical deep dive here.

Agent-driven investigation sounds simple: read the alert, query the data, return the cause. In reality, most agents either overload their context window with raw logs or guess at queries and return incorrect results.

Today Coralogix is releasing the cx CLI, a single binary that gives any agent direct, structured access to your telemetry from the terminal. It runs aggregations server-side so the heavy work happens where the data already lives. It returns results in a token-optimized format that carries the same information as JSON in roughly 90% fewer tokens. The combination turns a class of investigation that was previously reliable only for human engineers into something an agent can run repeatedly and accurately.

This is what Headless Observability looks like in practice. The interface to production data is moving away from dashboards and toward tool-based access that fits directly into automated workflows. Install cx once, and any agent with shell access can investigate your stack at the depth an engineer can from a terminal.

What the CLI does

Server-side aggregation via DataPrime 

Agent-driven investigation breaks first on cardinality. The volume of logs an agent needs to reason over does not fit in any context window, and pulling raw rows is the wrong operation entirely. cx runs the aggregation server-side on Coralogix’s Distributed Query Engine. An agent can query 200 million logs, get a ranked breakdown of errors, and receive back just a few rows. The heavy lifting happens where the data lives, not inside the context window.

Token-optimized output 

Even the right shape of result can cost more tokens than it should. By combining dead-weight reduction (removing low-value metadata) with the TOON output format, the CLI can reduce token usage by up to 90%. On data-heavy queries, that is the difference between an agent that finishes the investigation and one that runs out of context partway through.

Semantic field search

An agent does not know your schema, and asking it to guess produces queries that miss the data, return errors, or burn tokens on retries. The Coraligx CLI maps a natural-language description of what the agent is looking for to the actual fields in your telemetry, even when naming differs across services. The agent can ask about the data before it queries the data, and the cost of asking is small.

Multi-team fan-out 

The Coralogix CLI runs a single query across every team and region in parallel, merges the results, and tags each row with its origin. An agent investigating a global incident gets one unified result set instead of having to reconcile multiple separate ones. Multi-region resolution becomes a property of the platform, not a problem the agent has to solve.

Pre-built skills for 40+ agents 

cx ships with pre-built skills for Claude Code, Cursor, Codex, and more than 40 other coding agents, covering logs, spans, metrics, alerts, and RUM. Engineers do not have to write tool schemas or train an agent on DataPrime syntax. The agent picks up the skill, calls CX, and gets back results it can use.

What agents can do with it

Reliable production investigations 

The combination of server-side aggregation and TOON output changes what is economically possible for agent-driven investigations. Instead of ingesting thousands of raw log lines or guessing at queries, agents receive compact, structured results they can reliably reason from.

Cross-signal insights without infrastructure knowledge 

Agents can analyze error rates, SLO burn rates, deployment impact, cost attribution, and cross-service behavior without needing to understand how the underlying data is stored, queried, or structured across teams and regions.

Portability across every agent and model 

A single binary install puts cx on every developer machine and CI runner. The same binary works inside incident-response runbooks, automated remediation flows, and developer agents at the terminal. It runs under Claude, Cursor, Codex, and whatever comes next. The model layer will keep moving and the telemetry layer underneath should not have to move with it.

Full platform coverage 

Every Coralogix capability that previously required the UI or direct API calls is now accessible through a single, consistent interface. Beyond querying logs, spans, and metrics, agents and engineers can manage dashboards, SLOs, and incidents; configure data pipelines, routing rules, and archive settings; and administer users, teams, quotas, and integrations. 

The bigger picture

Observability became infrastructure for engineers a decade ago. It is now becoming infrastructure for the agents working alongside them, and the platform underneath has to be ready for both. The teams that move first will have agents capable of running a real investigation across logs, spans, metrics, alerts, and RUM, with token economics that keep the work repeatable. The teams that wait will keep getting the investigation handed back.

The cx CLI is available today. Install it once, point your agents at it, and let the next investigation finish in the terminal.

Read the docs: https://coralogix.com/docs/external/cx-cli/
Source on GitHub: https://github.com/coralogix/cx-cli 

Learn more about the cx CLI.