porticol-cli

Let coding agents call your APIs without holding the keys.

porticol-cli is the open part of Porticol: an MCP server for Claude Code, Cursor, Codex and VS Code, Porticol Guard's policy engine, local proxy and agent hooks, and a runner for Porticol and Postman collections in CI.

An agent asks Porticol to send a request. Porticol adds the key from your keychain, checks the call against your policy, holds a risky one until a person approves it, and records what was sent. The agent never sees the key.

Install

curl -fsSL https://porticol.app/install.sh | sh

That installs the Porticol app and porticol-cli. The command line alone, with Homebrew: brew install pavanmanishd/porticol/porticol-cli. Windows: irm https://porticol.app/install.ps1 | iex.

Related MCP server: Laguarde

Connect an agent

claude mcp add porticol -- porticol-cli mcp

Or as a Claude Code plugin:

claude plugin marketplace add pavanmanishd/porticol-cli
claude plugin install porticol@porticol-cli

Cursor, Codex and VS Code: porticol.app/docs/ai-agents.

Guard

A policy decides each call: allow, deny or ask a person.

version: 1
mode: enforce
rules:
  - id: no-deletes-in-production
    match: { method: DELETE, environment: production }
    action: ask

• porticol-cli approve <id> and deny <id> answer a held call from a terminal.

• porticol-cli guard proxy holds risky calls from a sandboxed agent's own shell commands.

• porticol-cli guard log verify checks the record's hash chain, and guard log export writes it as JSON or CSV.

• porticol-cli guard scan finds keys left in .env files, without printing them.

What each level stops, and what it does not: porticol.app/guard.html.

Run collections in CI

porticol-cli run ./collection.json --env staging

Build

cargo build --release -p api-cli

Licence

Apache-2.0. This repository is exported from Porticol's private repository at each release; issues and pull requests are welcome here.