SST CLI for coding agents

A coding agent with shell access to an SST project can use the sst command-line interface to inspect infrastructure changes before deployment. SST lets you describe cloud resources in project code, then use its CLI to develop, deploy, and manage those resources.

A coding agent can run these commands with access to the project directory and a shell where the SST CLI is installed; no special integration is required. Ask the agent to run sst diff for an initial check. The command compares the project with a deployed stage, an environment such as development or production, and previews infrastructure changes. The command makes network calls to the configured cloud provider; it does not perform the deployment.

Set up the CLI and credentials

The SST CLI reference covers installation and commands. In an existing Node.js project, install the Ion-tagged package with:

npm install sst@ion

Then run the CLI through the project’s package runner:

npx sst

A coding agent should run SST commands from the project directory that contains sst.config.ts, the file that defines the project’s cloud resources. SST needs credentials for the cloud provider configured in that project. For AWS, configure credentials on the agent’s machine or in its runtime environment before starting the agent. Do not paste access keys or other secrets into the agent prompt.

SST Console login and cloud-provider credentials serve different purposes. A Console account supports SST’s hosted features; AWS credentials authorize access to AWS resources. Follow the project’s existing setup and the provider’s credential guidance rather than asking the agent to create or expose credentials.

Preview changes with sst diff

Use sst diff when an agent needs to check what the project would change in a deployed stage:

npx sst diff

The command compares the local SST configuration with the selected deployed stage and prints a diff describing planned infrastructure changes. The exact output depends on the project and stage. It can show resources that SST would add or update, as well as resources it would remove. Review the result before asking the agent to deploy. The SST CLI documentation covers the command and its options.

sst diff contacts the cloud provider to inspect the deployed stage but does not apply changes. If the project has multiple stages, check which one the CLI targets before relying on the preview. A diff for a development stage does not establish what a production deployment would change.

A realistic agent prompt is:

From the SST project directory, run npx sst diff and summarize the planned resource changes. Do not deploy, remove resources, or change secrets. Tell me which stage the command inspected.

The agent can report the command’s output, but a human should decide whether the proposed changes match the intended release.

Keep write commands separate

SST also provides commands to deploy an app and remove a stage. Other commands manage secrets or inspect logs. Those commands have different effects. In particular, sst deploy applies infrastructure changes, while stage removal deletes deployed resources. An agent should not run either as an automatic follow-up to a diff. Give it a separate request only after someone has reviewed the preview and approved the target stage.

SST has changed its CLI across releases. In a reported package-tag issue, a user on SST 3.0.37 said sst@latest resolved to an older SST version, while the @ion tag selected the Ion release. That report concerns a specific version and does not establish behavior for every release. Check the current CLI documentation and project lockfile when installation produces an unexpected version.