CLI

cs is CoreSpeed's command-line tool. It signs you in through the browser, mints and rotates keys, writes agent configuration, administers connectors and remote MCP servers, and calls tools directly — everything against the same authenticated gateway your agents use. It needs Node.js 20 or Bun and has no runtime dependencies.

npx @corespeed/cs --help          # one-off, no install — ideal for agents and CI
npm install -g @corespeed/cs      # or install globally and use `cs`
bunx @corespeed/cs --help         # Bun equivalent

Sign in

cs login      # opens the browser, completes PKCE, stores tokens under ~/.config/cs
cs whoami     # the signed-in user and the active organization
cs token      # prints a fresh session JWT — `Authorization: Bearer $(cs token)`

cs login is a member session: the same principal as browser sign-in from an agent, so everything a signed-in member may do — including the session-gated manage__* tools — is available. The session token is short-lived (five minutes), and the CLI refreshes it silently for its own calls.

API keys

cs keys create <name>     # mints an sk-cs- key; the secret is shown once
cs keys list
cs keys rotate <id>       # new secret, same name, cap, and month-to-date usage
cs keys revoke <id>

Keys act as you and are what belongs in a configuration file that outlives a session. See Authentication for how member and agent keys differ.

Agent configuration

cs mcp-config     # prints an mcpServers block for https://api.corespeed.io/mcp

The block carries your session token, so it works immediately and expires in five minutes — right for a quick test, wrong for anything that stays configured. For a durable setup paste an API key instead, as in the Getting started.

Call tools from the terminal

cs mcp list                                   # the tools this identity can see
cs mcp call memory__search_memory '{"query": "rollout window"}'

cs mcp list is tools/list for your identity, and cs mcp call is one tools/call. Both are handy for checking what an agent will see before you hand it the configuration.

Connectors and accounts

cs connectors list                                    # connectors plus your connection status
cs connectors connect <id> [--org <id>]               # opens the dashboard connect flow
cs connectors disconnect <id> [--account <alias-or-id>]
cs connectors accounts list                           # every connected account, with aliases
cs connectors accounts rename <connector> <current-alias> <new-alias>
cs connectors accounts remove <connector> <alias>

Account commands act on your active organization (cs whoami); --org pins a connect flow to another one. Aliases are the account argument connector tools take when several accounts are connected. A shared account can be removed only by its creator or an org admin — see Connectors.

Remote MCP servers

cs remote add <slug> --url <https://…> --auth oauth|static_bearer|none \
  [--name "Display Name"] [--client-id <id>] [--header <name>]… [--yes]
cs remote list
cs remote show <slug>          # url, auth mode, last snapshot
cs remote refresh <slug>       # re-pull tools/list (admin, 60-second cooldown)
cs remote remove <slug>        # registration, snapshots, and credential

Secrets — a static bearer token, a client secret, header values — are prompted on stdin, never passed on the command line. --auth oauth auto-detects dynamic client registration; when the server offers none, pre-register a client and pass --client-id. The registration model is on Remote MCP servers.

Balance

cs usage      # available credit and plan

Environment

The CLI targets production by default. Override these to point it elsewhere:

CS_API_URL and CS_WORKOS_CLIENT_ID must agree: each environment pins its own issuer, so a token minted against one environment is rejected by the other on every authenticated call. Keys are per environment as well.