The tolmo query command proxies requests to your organization’s connected services. Credentials are resolved on the backend — they never leave the server, and your local machine never sees a token or secret key. Tolmo supports GitHub, AWS, Linear, Sentry, Datadog, and any additional providers your org connects. All subcommands accept the global --org flag to target a specific organization.
Discover available services
Before querying a service, use tolmo query list to see which providers are connected for your organization.
Providers are discovered dynamically from the backend. New backend adapters become available without any CLI update on your end.
GitHub (REST)
Send REST requests directly to the GitHub API. Tolmo injects the org’s GitHub App credentials on the backend.
GitHub CLI passthrough
tolmo query -- gh ... runs your locally installed gh CLI with a short-lived token injected by the backend via a Unix socket proxy. This gives you the full gh feature set — including pagination, --jq, --template, and gh api — backed by the org’s GitHub App credentials rather than your personal token.
The -- separator between tolmo query and gh is mandatory. Without it, the Cobra argument parser strips unknown flags (like --repo, --limit, or --state) before they ever reach gh, causing unexpected errors or silent failures.
AWS CLI passthrough
tolmo query -- aws ... runs your locally installed AWS CLI with credentials injected by the backend proxy. You get full AWS CLI functionality without any local credential configuration.
The -- separator is mandatory here too. Without it, flags like --region and --output are stripped before reaching the AWS CLI.
Linear (GraphQL)
Send GraphQL queries to Linear. Pass the query inline as a string or load it from a file.
Sentry (REST)
Send REST requests to the Sentry API. The path is appended to the Sentry base URL.
Datadog (REST)
Send REST requests to the Datadog API. The path is appended to the Datadog base URL.
Multiple integrations
When your organization has more than one integration for the same provider (for example, two separate GitHub App installations), pass --integration <id> to tell Tolmo which credentials to use. Integration IDs are shown in the output of tolmo query list.
