@dcprotocol/cli

@dcprotocol/cli

CLI for operating a DCP vault.

This is the main tool for developers, operators, and headless environments.

Install

npm install -g @dcprotocol/cli

Linux Notes

• This is the human/operator CLI, not the recommended VPS-agent package.
• On Debian/Ubuntu, install libsecret-1-0 for keychain-backed local vault usage.
• For remote agents and VPS hosts, prefer @dcprotocol/proxy and dcp-proxy.
• Example relay URLs in this README use the default public relay wss://relay.dcp.1ly.store; replace it if you run your own relay.

What The CLI Covers

• initialize and recover a vault
• create wallets and store data
• run approvals and manage sessions
• trust and connect remote services
• generate pairing tokens for VPS agents
• run a local proxy for remote agents

Fastest Local Setup

dcp init
dcp create-wallet --chain solana
dcp add address.home
dcp add identity.email
npx -y @dcprotocol/server

Open http://127.0.0.1:8420 for the local approval UI.

Command Groups

Vault setup and data

Command	Purpose
dcp init	Initialize a new vault
dcp recovery restore	Restore from recovery phrase
dcp create-wallet --chain <chain>	Create a wallet inside the vault
dcp add <scope>	Add a scope interactively
dcp update <scope>	Update a stored record
dcp remove <scope>	Delete a stored record
dcp read <scope>	Read a stored record
dcp list	List scopes in the vault
dcp status	Show summary status
dcp config	View or update budgets and limits
dcp activity	Show audit logs

Approvals and sessions

Command	Purpose
dcp approve --list	List pending consent requests
dcp approve <consent-id>	Approve a request
dcp approve <consent-id> --session	Approve and create a reusable session
dcp agents	List active agent sessions
dcp revoke <session-or-agent>	Revoke a session or agent

Remote services

Command	Purpose
dcp trust <service>	Add or update a trusted service
dcp trust <service> --list	List trusted services
dcp trust <service> --revoke	Revoke a trusted service
dcp connect <service>	Send vault routing info to a service

Remote VPS / proxy

Command	Purpose
dcp pairing start <service>	Create a short-lived pairing token
dcp proxy ...	Run a proxy from the operator CLI (advanced/local compatibility)

Common Flows

1. Trust a verified service

dcp trust 1ly

2. Trust a custom service

dcp trust openclaw-prod \
  --key ed25519:<base64-public-key> \
  --scopes sign:solana,read:credentials.api.* \
  --budget 10usdc/day \
  --auto-approve-under 1usdc

3. Connect a trusted service

dcp connect 1ly

For a custom service:

dcp connect openclaw-prod \
  --url https://example.com/api/dcp/connect \
  --auth-url https://example.com/settings/dcp

4. Create a pairing token for a VPS proxy

dcp pairing start openclaw-vps \
  --scopes sign:solana,budget:check \
  --budget 10usdc/day \
  --auto-approve-under 1usdc

5. Start a proxy on the VPS

npx -y -p @dcprotocol/proxy dcp-proxy \
  --pair "<pairing-token>" \
  --service-id "openclaw-vps" \
  --vault "<vault-id>" \
  --hpke-key "<vault-hpke-public-key>" \
  --relay "wss://relay.dcp.1ly.store" \
  --port 8420

The proxy stores its identity under ~/.dcp/proxy/<service-id>.json and exposes a local DCP-compatible endpoint for the agent. For published/npm VPS installs, prefer @dcprotocol/proxy and dcp-proxy instead of the heavier human CLI path.

Useful Flags

dcp trust

• --key <ed25519:...>: required for custom services
• --scopes <a,b,c>: explicit allowed scopes
• --budget <10usdc/day>: daily budget
• --auto-approve-under <1usdc>: auto-approval threshold
• --list: list trusted services
• --revoke: revoke trust
• --yes: skip confirmation prompts

dcp connect

• --url <https://...>: custom connect endpoint
• --auth-url <https://...>: custom auth page
• --relay-url <wss://...>: override relay URL
• --no-browser: print the auth URL instead of opening it

dcp pairing start

• --scopes <a,b,c>: required
• --budget <10usdc/day>: daily budget
• --auto-approve-under <1usdc>: auto-approval threshold
• --ttl <seconds>: token lifetime, default 600

dcp proxy

• --vault <vault-id>: target vault
• --hpke-key <base64>: vault HPKE relay public key
• --relay <wss://...>: relay endpoint
• --service-id <id>: service/proxy identity
• --service-key <base64>: service private key for direct relay mode
• --pair <token>: pair and generate identity automatically
• --port <port>: local port, default 8420
• --agent-name <name>: agent name used by proxied requests

Session Cache

After a successful CLI unlock, DCP caches local unlock state for 30 minutes by default.

Environment variables:

• DCP_CLI_SESSION_MINUTES
• DCP_CLI_INSECURE_SESSION=1 for file-based fallback when keychain is unavailable

Notes

• Use the CLI when you want full control and reproducible setup.
• Use the desktop app when the operator wants a GUI.
• Use @dcprotocol/client when you are embedding DCP in code.

Troubleshooting

Native module problems after switching Node versions

npm rebuild better-sqlite3

Want to run from source instead of the published package

npm -w @dcprotocol/cli run build
node packages/dcp-cli/dist/cli.js --help

Related Docs

• Root: README.md
• SDK: packages/dcp-client/README.md
• Desktop: packages/dcp-desktop/README.md