Authsia CLI

Bring Authsia to your terminal. Install, wire a workspace, connect an MCP client, guard a terminal, approve agents, then audit. Commands stay short; each guide carries the rules.

Use cases

Keep plaintext out of repos

Initialize commit-safe authsia:// refs and resolve them in the child process.

Workspace CLI

Connect local coding agents

Six fixed MCP tools and no secret-return path. The client launches Authsia.

MCP

Manage and protect local MCP

Use the local portal for existing STDIO protection and authenticated localhost Streamable HTTP.

MCP Manager

Approve scoped agent access

Folder, capability, and TTL — then revoke from Access Center or a paired iPhone.

Agent JIT

Quickstart

If you are installing Authsia for the first time, start here.

quick path

# install app + CLI
brew install --cask james-liang-cs/authsia/authsia

# prepare the repo
authsia workspace init
authsia workspace status
authsia agent init --agent codex

# run commands through Authsia
authsia workspace run -- npm test
authsia mcp configure --client codex
authsia guard

Guides

Workspace and terminal

Install and check readiness
Workspace workflow — init, env select, run, resolution order
Guarded terminal — PATH shims; agents leave the boundary at launch

Agents and MCP

Catalog capture records metadata without changing tool permissions. Review new tools in MCP Manager > Edit policy before use. Verified audit export includes management changes; Activity reports its bounded retention separately.

MCP setup and launch commands require MCP Integrations in Authsia Settings > Developer Access. If it is off, enable it in the app and retry. Status, diagnostics, and stop remain available.

authsia agent init --agent codex — install project rules plus command-attribution and sub-agent-lineage hooks; review them in Codex /hooks
Local MCP server — configure and serve Authsia’s six tools
MCP Manager — portal, STDIO coverage, and localhost Streamable HTTP
Agent JIT approvals — scope, cleanup, automation credentials

SSH and audit

Reference

Compact command map. Local authsia --help remains the option source of truth.