--remote and --db from the CLI

The same team token works from a terminal or any other CI. --remote sends the migration to the hosted service (BOLVRK_TOKEN authenticates; BOLVRK_API_URL overrides the endpoint, default https://bolvrk.com/api). On Free, --remote runs the free rules in the service — useful for the run log and PR comments; the full corpus needs Startup. --db gives the check live-schema context, and the service applies that snapshot on Startup and above. The CLI opens a READ ONLY transaction and only reads catalogs — point it at a replica or shadow database; we do not verify that it is one. Add --show-payload (requires --remote) to print the exact request body and exit without sending.

# through the hosted service — the run log records the check; the full corpus on Startup and above
BOLVRK_TOKEN=blv_... npx bolvrk check migrations/*.sql --remote

# live-schema (tier-2) context from your own shadow database, structure only — Startup and above
npx bolvrk check migrations/*.sql --db=$SHADOW_DB

# both: introspect locally, push only structure — never rows, never a credential
BOLVRK_TOKEN=blv_... npx bolvrk check migrations/*.sql --db=$SHADOW_DB --remote

bolvrk explain migration.sql --db=… plans the file's own statements with EXPLAIN inside a READ ONLY transaction that is rolled back — never executed — and reports sequential scans of large tables, nested loops and large sorts.

Never the primary: the security page documents the exact boundary — catalogs only, read-only transaction, nothing retained.