diff --git a/README.md b/README.md
index 6f7e50b..43c3f90 100644
--- a/README.md
+++ b/README.md
@@ -130,6 +130,22 @@ cargo run -- run examples/reference-leaky.yml
 
 It exits `1` because the raw item is deleted while a derived artifact remains observable. The report identifies the failing probe and profile.
 
+### CLI commands
+
+The Rust binary exposes a small command surface for local setup, adapter inspection, scenario execution, and evidence verification:
+
+| Command | Purpose |
+| --- | --- |
+| `init [path]` | Create a starter ForgetProof project and reference scenarios. |
+| `adapters list` | List the built-in and Python adapters. |
+| `doctor --adapter <name>` | Inspect an adapter's protocol and capabilities without mutating a backend. |
+| `expand <input> --output <file>` | Freeze deterministic lexical and semantic probe variants. |
+| `run <scenario>` | Execute a scenario and write an evidence bundle. |
+| `verify <bundle>` | Recompute checksums and verify bundle integrity. |
+| `report <bundle>` | Regenerate the HTML and JUnit reports from `results.json`. |
+
+For scenario authoring, start with [`examples/reference-clean.yml`](examples/reference-clean.yml) and validate the shape against [`schemas/scenario.schema.json`](schemas/scenario.schema.json). Keep production credentials in environment variables; use `--allow-network` only when the scenario is explicitly authorized to reach a non-loopback backend.
+
 ## 🏅 Conformance profiles
 
 | Profile | Plain-English meaning |
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 999596c..b02b014 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -130,6 +130,22 @@ cargo run -- run examples/reference-leaky.yml
 
 它会以退出码 `1` 结束，因为原始记录虽然被删除，但衍生工件仍然可观察。报告会指出失败的探针和认证档案。
 
+### CLI 命令
+
+Rust 二进制提供了用于本地初始化、适配器检查、场景执行和证据校验的简洁命令集：
+
+| 命令 | 用途 |
+| --- | --- |
+| `init [path]` | 创建 ForgetProof 项目骨架和参考场景。 |
+| `adapters list` | 列出内置适配器和 Python 适配器。 |
+| `doctor --adapter <name>` | 在不修改后端的情况下检查适配器协议和能力。 |
+| `expand <input> --output <file>` | 冻结确定性的词法和语义探针变体。 |
+| `run <scenario>` | 执行场景并生成证据包。 |
+| `verify <bundle>` | 重新计算校验和并验证证据包完整性。 |
+| `report <bundle>` | 根据 `results.json` 重新生成 HTML 和 JUnit 报告。 |
+
+编写场景时可以从 [`examples/reference-clean.yml`](examples/reference-clean.yml) 开始，并用 [`schemas/scenario.schema.json`](schemas/scenario.schema.json) 对照字段结构。生产凭据应放在环境变量中；只有在明确授权访问非本机后端时，才使用 `--allow-network`。
+
 ## 🏅 认证档案
 
 | 档案 | 通俗解释 |