cli

Privasys CLI

The command-line interface to the Privasys confidential-computing platform. Authenticate with the Privasys Wallet, deploy and manage confidential apps, manage teams and billing, and verify attestation — from a terminal, a CI pipeline, or an AI agent.

Licensed under AGPL-3.0.

Install

Script (macOS / Linux):

curl -fsSL https://privasys.org/cli/install.sh | sh

Go:

go install github.com/Privasys/cli/cmd/privasys@latest

Binaries: download a signed archive for your OS/arch from the releases page and put privasys on your PATH. Windows binaries are currently unsigned.

Verify:

privasys version

Shell completions:

privasys completion bash|zsh|fish|powershell

Quickstart

privasys auth login                 # scan the QR with your Privasys Wallet
privasys apps list
privasys apps describe <app-id>
privasys attest <app-id> --verify

Authentication

The CLI never holds your signing key — it stays on your wallet. The CLI holds a short-lived access token it renews silently. Every interactive flow is the OAuth 2.0 device authorization grant (RFC 8628).

Helpers: privasys auth whoami, auth print-access-token, auth list, auth logout.

Tokens are stored in the OS keychain (with a 0600 file fallback); the long-lived refresh token and service key live in the keychain.

Commands

Deploy an app end to end:

privasys apps create --name demo --source github --commit-url https://github.com/you/demo/commit/<sha>
privasys apps deploy demo --watch
privasys apps call demo hello --data '{"who":"world"}'

Manage a team and billing:

privasys team add <sub> --email dev@acme.com --role member
privasys apps owners add demo <sub>
privasys billing balance
privasys billing subscribe          # opens Stripe Checkout (no card data touches the CLI)

For AI agents

The CLI is built to be driven by AI agents.

MCP server. privasys mcp serve exposes the full command surface as Model Context Protocol tools over stdio. Register it with an MCP client:

// MCP client config (e.g. Claude Desktop)
{
  "mcpServers": {
    "privasys": { "command": "privasys", "args": ["mcp", "serve"] }
  }
}

# Claude Code
claude mcp add privasys -- privasys mcp serve

Tools include whoami, apps_list/apps_describe/apps_create/apps_deploy/apps_call/…, attest, verify_quote, account_show, team_list/team_add, and billing_*. The server authenticates exactly like the CLI — a logged-in session, or a service account (PRIVASYS_SERVICE_KEY) for unattended use.

Scripting. Every command takes --format json (and yaml); output auto-switches to JSON when stdout is not a TTY. --no-input never prompts. Stable exit codes:

TOKEN=$(privasys auth print-access-token)        # pipe into curl
privasys apps list --format json | jq '.[].name'

Attestation

privasys attest <app-id> fetches the deployed app's RA-TLS attestation (TEE quote, measurements, certificate, and Privasys OID extensions) and can verify and export it.

privasys attest <app-id>                       # summary: quote type, MRENCLAVE/MRTD, RTMRs
privasys attest <app-id> --challenge $(openssl rand -hex 16)   # fresh challenge-response quote
privasys attest <app-id> --extensions          # print the certificate's OID extensions
privasys attest <app-id> --verify              # verify the quote with the attestation server
privasys attest <app-id> --out ./att           # dump all artifacts to a directory
privasys attest <app-id> --format json         # full attestation as JSON

--out <dir> writes:

Configuration & environment

Config lives at ~/.privasys/config.yaml (named configurations). Global flags: --endpoint, --issuer, --account, --format, --no-input, --quiet.

privasys config set endpoint https://api.developer.privasys.org
privasys config set account <account-id>
privasys config list