# porticol-cli

Let coding agents call your APIs without holding the keys.

`porticol-cli` is the open part of [Porticol](https://porticol.app): an MCP server for
Claude Code, Cursor, Codex and VS Code, Porticol Guard's policy engine, local proxy and
agent hooks, and a runner for Porticol and Postman collections in CI.

An agent asks Porticol to send a request. Porticol adds the key from your keychain,
checks the call against your policy, holds a risky one until a person approves it, and
records what was sent. The agent never sees the key.

## Install

```sh
curl -fsSL https://porticol.app/install.sh | sh
```

That installs the Porticol app and `porticol-cli`. The command line alone, with Homebrew: `brew install pavanmanishd/porticol/porticol-cli`. Windows:
`irm https://porticol.app/install.ps1 | iex`.

## Connect an agent

```sh
claude mcp add porticol -- porticol-cli mcp
```

Or as a Claude Code plugin:

```sh
claude plugin marketplace add pavanmanishd/porticol-cli
claude plugin install porticol@porticol-cli
```

Cursor, Codex and VS Code: [porticol.app/docs/ai-agents](https://porticol.app/docs/ai-agents).

## Guard

A policy decides each call: allow, deny or ask a person.

```yaml
version: 1
mode: enforce
rules:
  - id: no-deletes-in-production
    match: { method: DELETE, environment: production }
    action: ask
```

- `porticol-cli approve <id>` and `deny <id>` answer a held call from a terminal.
- `porticol-cli guard proxy` holds risky calls from a sandboxed agent's own shell commands.
- `porticol-cli guard log verify` checks the record's hash chain, and `guard log export`
  writes it as JSON or CSV.
- `porticol-cli guard scan` finds keys left in `.env` files, without printing them.

What each level stops, and what it does not: [porticol.app/guard.html](https://porticol.app/guard.html).

## Run collections in CI

```sh
porticol-cli run ./collection.json --env staging
```

## Build

```sh
cargo build --release -p api-cli
```

## Licence

Apache-2.0. This repository is exported from Porticol's private repository at each
release; issues and pull requests are welcome here.