Compact command map
Orientation only. Local authsia --help remains the option source of truth.
| Command | Use it for | Example |
|---|---|---|
| status | App, bridge, Direct CLI session or IDE pairing, shell, guarded-terminal, and SSH agent state | authsia status --format json |
| workspace | Repo setup, refs, guarded runs, sync, reset | authsia workspace run -- npm test |
| agent init | Install setting-aware agent rules plus supported command-attribution and sub-agent-lineage hooks | authsia agent init --agent codex |
| mcp configure | Print-only recipe plus a table of that client's current launches | authsia mcp configure --client codex |
| mcp start | Start the app-owned MCP Manager and open its authenticated portal | authsia mcp start |
| mcp status | Report manager, registry, portal, and localhost HTTP readiness | authsia mcp status --json |
| mcp stop | Stop manager listeners without stopping existing STDIO proxies | authsia mcp stop |
| mcp restart | Restart manager listeners and invalidate portal sessions | authsia mcp restart |
| mcp wrap | Declare and protect one scanned local MCP launch after review; plan redacts env values | authsia mcp wrap --write --server jira |
| mcp declare | Declare a STDIO child command or validated localhost HTTP endpoint | authsia mcp declare --server internal --url http://127.0.0.1:9000/mcp --allow search --yes |
| mcp unwrap | Preview and restore a protected launch while retaining workspace policy | authsia mcp unwrap --write --server jira |
| mcp catalog | Record what a declared local MCP server advertises, so clients list its tools without starting it | authsia mcp catalog --server codegraph --write |
| mcp serve | Bind a validated workspaceRoot tool input or safe launch context | authsia mcp serve --workspace /path/to/repo |
| mcp proxy | Admit one workspace-declared stdio MCP; secret refs use Agent JIT | authsia mcp proxy --upstream jira |
| mcp doctor | Default table of scanned launches plus a verdict; exit 2 on effective or conditional bypass. JSON v2 includes host, version, MCP Integrations, and audit integrity | authsia mcp doctor --json |
| mcp activity export | Copy redacted MCP proxy command-history rows | authsia mcp activity export --json --unowned |
| guard | Activate guarded mode in the current shell | authsia guard |
| unguard | Restart the current tab in normal terminal mode | authsia unguard |
| exec | Resolve selected items or, with shell integration, shell-local authsia:// refs into one child process | API_KEY=authsia://… authsia exec -- npm start |
| list | Metadata-only vault listing; scraped items default to this machine | authsia list api-keys --format table |
| completion | Shell scripts and metadata suggestions; automation uses list permission | eval "$(authsia completion zsh)" |
| read | Resolve one authsia:// secret reference | authsia read "authsia://api-key/Stripe/key" |
| add api-key | Store API keys without a username field | authsia add api-key --name Stripe --key - |
| edit | Update fields, move to a folder, or move any editable vault item to Root with --clear-folder | authsia edit password GitHub --clear-folder |
| convert | Move password-style tokens into API Keys | authsia convert password Stripe --to api-key |
| ssh | Adopt, generate, sign, and configure SSH keys | authsia ssh adopt --path ~/.ssh --dry-run |
| access | Manage automation access credentials | authsia access list --format table |
| audit | Local access history | authsia audit list |