Install the CLI

clavitor-cli is a single binary with no runtime dependencies. It talks to your vault over an encrypted channel and decrypts L2 fields on your machine. It cannot decrypt L3 fields.

Download

Get the binary for your platform from Downloads. Builds are published for Linux (amd64, arm64), macOS (Intel, Apple Silicon), Windows and FreeBSD. A SHA256SUMS file sits next to them.

On Linux, for example:

sha256sum -c SHA256SUMS --ignore-missing
chmod +x clavitor-cli-linux-amd64
mv clavitor-cli-linux-amd64 ~/.local/bin/clavitor-cli
clavitor-cli version

Any directory on your PATH works. One installed copy serves every agent on the machine.

Enroll

The CLI acts as a client of your vault: an identity with its own scopes, IP allow-list and read quota. Create the client in the vault first. Agent setup has the full walkthrough. In short: in the vault, go to Clients, click + New client, and choose type CLI. The vault shows two values, once:

• the blob: sealed, safe to paste anywhere, including on a command line;
• the key: the only secret. Never put it on a command line.

Then, on the machine where the CLI runs:

clavitor-cli init

Paste the blob at the first prompt, then the key at the Enrollment key: prompt. The key is not echoed. You can also pass the blob as an argument, clavitor-cli init <blob>, and the CLI still asks for the key.

For a non-interactive setup, pipe the blob and the key as two lines:

printf '%s\n%s\n' "$BLOB" "$KEY" | clavitor-cli init

On success the CLI prints Enrolled. with the vault, vault ID, agent and config path.

Where the config lives

init writes one file, $XDG_CONFIG_HOME/clavitor/config, or ~/.config/clavitor/config when XDG_CONFIG_HOME is unset. It is written with mode 0600. There is no environment variable to point the CLI somewhere else.

The file holds the agent's L2 key. Its encryption only obscures it. What protects it is file permissions, so treat the file as a secret.

init refuses to overwrite an existing config. To enroll again, delete the file first:

rm ~/.config/clavitor/config
clavitor-cli init

Check it works

clavitor-cli find github

find prints the exact titles of matching entries the client can reach (titles and types only, never values). See get to read a value.

Commands

clavitor-cli help lists everything. Most commands also take --help (put, note and memory do not). Every command exits 0 on success. On failure it exits non-zero and prints an error on stderr, usually starting with a stable code such as CV-2000.