# The cs CLI in ten minutes: login, keys, tools, usage (/blog/the-cs-cli-in-ten-minutes)

![Illustration: A small friendly robot with a round camera-eye head sits at a plain table holding up a folding pocket multitool whose blades fan out into a key, a small wrench and a tiny magnifying glass.](/blog/the-cs-cli-in-ten-minutes/hero.webp)

`cs` is CoreSpeed's command-line tool. Run it with `npx @corespeed/cs` on Node 20 or Bun; it has no runtime dependencies. It signs you in through the browser, mints and rotates API keys, prints MCP configuration for your agent, administers connectors and remote MCP servers, calls tools from the terminal, and reports credit usage. Every command runs against the same gateway your agents use.

**Ten minutes with cs**

1. **Install and sign in** (npx @corespeed/cs; cs login opens the browser) — The session is stored under CS\_CONFIG\_DIR, default \~/.config/cs.
2. **Check who you are** (cs whoami; cs switch changes the organization)
3. **Mint a key for a job** (cs keys create production prints sk-cs- once) — cs keys list, rotate and revoke manage it later.
4. **Point an agent at CoreSpeed** (cs mcp-config prints an mcpServers block) — cs token prints a session JWT for scripts.
5. **Find and call a tool** (cs mcp search, cs mcp get, cs mcp call) — Exit code 6 means a person's approval is pending; do not re-send.
6. **Read usage and exit codes** (cs usage; scripts branch on the exit code)

Every command runs against the same gateway your agents use.

## How do you install and sign in? \[#how-do-you-install-and-sign-in]

1. Install it globally, or run it through `npx` without installing:

```bash
npm install -g @corespeed/cs     # or: npx @corespeed/cs --help
cs login                          # browser sign-in; choose an organization
cs whoami                         # the signed-in user and the active organization
```

2. `cs login` opens the browser, lets you choose an organization, and stores a member session on this machine under `CS_CONFIG_DIR`, which defaults to `~/.config/cs`. A separate directory keeps a separate sign-in, such as a second account.
3. `cs switch` changes the active organization without signing in again. `cs logout` removes the stored session.

Run the install command again to update. The stored session is the same session JWT the dashboard holds; the four credentials are compared on the [Authentication](/docs/authentication) page.

## How do you manage API keys? \[#how-do-you-manage-api-keys]

4. `cs keys create production` mints an `sk-cs-` member key named `production` and prints the secret once. Store it in an environment variable where the job runs; never commit it.
5. `cs keys list` shows the keys. `cs keys rotate` with a key id replaces the secret. `cs keys revoke` with a key id ends it.

A member key acts as you: it reaches your private connections and the organization's shared ones, and role checks bind to you. For an unattended agent, create an agent principal in the dashboard and give it an `sk-csa-` key, which reaches shared connections only.

## How do you point an agent at CoreSpeed? \[#how-do-you-point-an-agent-at-corespeed]

6. `cs mcp-config` prints an `mcpServers` block for `/mcp` that carries your session token. Paste it into a client that reads that map.
7. `cs token` prints a fresh session JWT for scripts. It goes to `stdout`, so it pipes cleanly: `curl https://api.corespeed.io/connectors -H "Authorization: Bearer $(cs token)"` lists the connectors your sign-in can use and the state of each connected account.

Interactive clients such as Claude Code, Codex and Cursor need neither. They sign in through the browser themselves, as described on the [MCP server](/docs/mcp) page.

## How do you connect apps and call tools? \[#how-do-you-connect-apps-and-call-tools]

8. `cs connectors list` prints the connectors available to you. `cs connectors connect notion` opens the connect flow for one app. `cs connectors accounts list` shows connected accounts and their aliases.
9. `cs remote add` registers your organization's own MCP server as a remote connector and needs an org admin. `cs remote list` shows the registered ones. Their tools appear under the `org__` prefix, followed by the slug and the tool name.
10. Find a tool, read its schema, and call it as yourself:

```bash
cs mcp search remember facts
cs mcp get memory__search_memory
cs mcp call memory__search_memory '{"query": "rollout window"}'
```

`cs mcp call` runs a metered tool at the same rate your agent would pay, and memory calls are free. If Smart Approval holds the call for a person's decision, the command exits with code 6 and the call has not run. Do not re-send it; a fresh call is a new request and can raise a second card. See [Approvals](/docs/approvals).

## How do you read usage and exit codes? \[#how-do-you-read-usage-and-exit-codes]

11. `cs usage` shows available credit and the plan.
12. In scripts, read the exit code rather than parsing the message. Results go to `stdout`; prompts, warnings and errors go to `stderr`. A failure prints `Error:` followed by the message.

| Code | Meaning                                                                                                       | What a script should do               |
| ---- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
| 0    | Success                                                                                                       | Continue                              |
| 1    | A usage error, or the request was refused (not found, conflict, invalid input)                                | Fix the call; do not retry as is      |
| 3    | Not signed in, or the session was rejected                                                                    | Run `cs login`                        |
| 4    | The account cannot do this now: no active organization, payment required, suspended, or the admin role needed | A person fixes the account state      |
| 5    | CoreSpeed unreachable, rate-limited, or answering badly                                                       | Retry later                           |
| 6    | A `cs mcp call` is waiting for a human's approval and has not run                                             | Wait for the decision; do not re-send |

A refusal the CLI has no message of its own for prints the API's message with the HTTP status and error code. Every command and flag is listed in the [CLI reference](/docs/cli).

## Can CI use the CLI? \[#can-ci-use-the-cli]

No. `cs login` needs a browser, and every other command runs under that sign-in; the CLI takes no API key. For CI and headless agents, mint a key once with `cs keys create` and send it directly from the job, in the `Authorization: Bearer` header on `https://api.corespeed.io/mcp`. The CLI itself is not part of the job. Attribution still holds: activity with a key is recorded through the key's owning identity.

## FAQ \[#faq]

**How do I update?** Run the install command again.

**Can I sign in to two accounts?** Yes. Point `CS_CONFIG_DIR` at a different directory for the second one.

**Does `cs mcp call` bill my organization?** Metered tools are priced in credits at the rates on the pricing page; memory operations and discovery are free. Every charge lands itemized in the organization ledger.

**What does exit code 4 with payment required mean?** The organization wallet is past its billing threshold. An org admin adds credit on the billing page, and later metered calls run again.