# CLI (/docs/cli)

`cs` runs every command against the same authenticated gateway your agents
use. It needs Node.js 20 or Bun and has no runtime dependencies.

## Installing \[#installing]

**npm**

```bash
npm install -g @corespeed/cs
```

**pnpm**

```bash
pnpm add -g @corespeed/cs
```

**yarn**

```bash
yarn global add @corespeed/cs
```

**bun**

```bash
bun install -g @corespeed/cs
```

Run the same command again to update.

## Running without installing \[#running-without-installing]

Agents and CI jobs can run any command through `npx` or `bunx`:

```bash
npx @corespeed/cs --help
bunx @corespeed/cs --help
```

## Non-interactive environments \[#non-interactive-environments]

`cs login` needs a browser, and every other command runs under that sign-in —
the CLI takes no API key, except [`cs tie`](/docs/cli/tie) with `CS_API_KEY`
set. For CI and headless agents, mint a key once with
[`cs keys create`](/docs/cli/keys) and send it directly, as in
the [MCP server](/docs/mcp#without-a-browser) page; the CLI itself is not part of the
job.

## Available commands \[#available-commands]

### login \[#login]

Sign in through the browser, choose an organization, and store a member session
on this machine.

```bash
cs login
cs login --org <org-id>
```

[Learn more about the login command](/docs/cli/login)

### logout \[#logout]

Remove the session stored on this machine.

```bash
cs logout
```

[Learn more about the logout command](/docs/cli/logout)

### whoami \[#whoami]

Show the signed-in user, the active organization, and the permissions you hold there.

```bash
cs whoami
```

[Learn more about the whoami command](/docs/cli/whoami)

### switch \[#switch]

Change the active organization without signing in again.

```bash
cs switch
cs switch <org-id>
```

[Learn more about the switch command](/docs/cli/switch)

### token \[#token]

Print a fresh session JWT for scripts.

```bash
cs token
curl https://api.corespeed.io/connectors -H "Authorization: Bearer $(cs token)"
```

[Learn more about the token command](/docs/cli/token)

### keys \[#keys]

Create, list, rotate, and revoke `sk-cs-` API keys. A key holds no
organization permissions unless you give it ones you hold.

```bash
cs keys create production
cs keys create ops --permission keys:org
cs keys list
cs keys rotate <id>
cs keys revoke <id>
```

[Learn more about the keys command](/docs/cli/keys)

### mcp-config \[#mcp-config]

Print an `mcpServers` block for `/mcp` that carries your session token.

```bash
cs mcp-config
```

[Learn more about the mcp-config command](/docs/cli/mcp-config)

### connectors \[#connectors]

List connectors, open the dashboard to connect one, and manage connected
accounts.

```bash
cs connectors list
cs connectors connect notion
cs connectors accounts list
```

[Learn more about the connectors command](/docs/cli/connectors)

### remote \[#remote]

Register and administer your organization's own MCP servers.

```bash
cs remote add acme --url https://mcp.acme.internal/mcp --auth oauth
cs remote list
```

[Learn more about the remote command](/docs/cli/remote)

### mcp \[#mcp]

Find a tool for a task, read its schema, and call it as yourself.

```bash
cs mcp search remember facts
cs mcp get memory__search
cs mcp call memory__search '{"query": "rollout window"}'
```

[Learn more about the mcp command](/docs/cli/mcp)

### tie \[#tie]

Tie this computer to your organization, so your agents can use its shell,
files and local MCP servers, and switch what it shares.

```bash
cs tie --name "Hao's MacBook"
cs tie provider shell on --root ~/code
cs tie status
```

[Learn more about the tie command](/docs/cli/tie)

### usage \[#usage]

Show available credit and plan.

```bash
cs usage
```

[Learn more about the usage command](/docs/cli/usage)

## Output and exit codes \[#output-and-exit-codes]

Results go to `stdout`; prompts, warnings, and errors go to `stderr`, so
`cs token` and `cs keys list` pipe cleanly. A failure is reported as
`Error: <message>`, and the exit code tells a script what to do about it
without parsing the text:

| Code | Meaning                                                                                                        |
| ---- | -------------------------------------------------------------------------------------------------------------- |
| `0`  | Success.                                                                                                       |
| `1`  | A usage error, or the request was refused (not found, conflict, invalid input).                                |
| `3`  | Not signed in, or the session was rejected — run `cs login`.                                                   |
| `4`  | The account cannot do this now: no active organization, payment required, suspended, or the admin role needed. |
| `5`  | CoreSpeed unreachable, rate-limited, or answering badly — retry later.                                         |
| `6`  | A [`cs mcp call`](/docs/cli/mcp#call) is waiting for a human's approval and has not run.                       |

A refusal the CLI has no message of its own for prints the API's message with
the HTTP status and [error code](/docs/reference/errors).

When no HTTP answer came back, the message names the network's reason, for
example `could not reach CoreSpeed (POST /mcp): fetch failed: other side
closed (UND_ERR_SOCKET)`. Credentials in it are redacted. A connection that
closed after the request went out may still have reached CoreSpeed, so check
before you retry a `cs mcp call` that changes something.

## Environment variables \[#environment-variables]

| Variable        | Default        | Purpose                                                                                                                                                                                                    |
| --------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `CS_CONFIG_DIR` | `~/.config/cs` | Where the session is stored. A separate directory keeps a separate sign-in, such as a second account.                                                                                                      |
| `DO_NOT_TRACK`  | unset          | Set to `1` to send a bare `cs` user agent instead of the product/version string. Nothing else changes: authorization and protocol headers remain, and activity, billing, and audit records are unaffected. |

Signing in on a remote machine takes one more: see
[`cs login`](/docs/cli/login#signing-in-on-a-remote-machine).