@grantex/cli
Advanced tools
Command-line tool for the Grantex delegated authorization protocol.
80+ commands covering the full Grantex API — agents, grants, tokens, policies, budgets, audit, compliance, credentials, and more. All commands support --json for machine-readable output. Portable Agent Skills let Hermes, OpenClaw, and other shell-capable agents use the same interface.
npm install -g @grantex/cli
grantex config set --url https://api.grantex.dev --key YOUR_API_KEY
# Or use environment variables
export GRANTEX_URL=https://api.grantex.dev
export GRANTEX_KEY=YOUR_API_KEY
# Verify your setup
grantex me
Config is saved to ~/.grantex/config.json. Environment variables override the config file.
All commands support --json for machine-readable output — ideal for scripting, jq, and AI coding assistants (Claude Code, Cursor, Codex).
grantex --json agents list | jq '.[0].agentId'
grantex --json tokens verify <jwt> | jq '.valid'
Set NO_COLOR=1 to disable colored output.
Install the bundled use-grantex-cli and integrate-grantex skills with one command:
# OpenClaw workspace: ./skills
grantex agent install --target openclaw
# Hermes: ~/.hermes/skills/grantex
grantex agent install --target hermes
# Portable project location: ./.agents/skills
grantex agent install --target portable
# Any other agent skill root
grantex agent install --dir /path/to/skills
Use --force to refresh existing bundled files. A Hermes- or OpenClaw-specific SDK is not required; application code should continue to use the TypeScript, Python, or Go SDK at the protected service boundary.
Avoid placing grant tokens in shell history or process arguments:
grantex verify --env GRANTEX_GRANT_TOKEN --json
grantex --json tokens verify --env GRANTEX_GRANT_TOKEN
grantex --json enforce test --token-env GRANTEX_GRANT_TOKEN \
--connector salesforce --tool create_lead
The verification commands also accept --file and --stdin; enforce test accepts --token-file and --token-stdin. Invalid or denied checks return a non-zero process status in JSON mode.
# 1. Register an agent
grantex agents register --name "My Bot" --description "Reads email" --scopes email:read
# 2. Start authorization
grantex authorize --agent ag_... --principal user@example.com --scopes email:read
# 3. Exchange code for token
grantex tokens exchange --code <code> --agent-id ag_...
# 4. Verify the token
grantex tokens verify <jwt>
# 5. Refresh when needed
grantex tokens refresh --refresh-token <token> --agent-id ag_...
# 6. Revoke when done
grantex grants revoke grnt_...
grantex agents list
grantex agents register --name bot --description "..." --scopes email:read,calendar:write
grantex agents get ag_...
grantex agents update ag_... --name new-name --scopes email:read
grantex agents delete ag_...
grantex grants list [--agent ag_... --status active]
grantex grants get grnt_...
grantex grants revoke grnt_...
grantex grants delegate --grant-token <jwt> --agent-id ag_child... --scopes email:read
grantex tokens exchange --code <code> --agent-id ag_...
grantex tokens verify <jwt>
grantex tokens refresh --refresh-token <token> --agent-id ag_...
grantex tokens revoke <jti>
grantex authorize --agent ag_... --principal user@example.com --scopes email:read
grantex authorize --agent ag_... --principal user@example.com --scopes email:read \
--code-challenge <S256-challenge> --redirect-uri https://app.com/callback
grantex audit list [--agent ag_... --grant grnt_... --action email.read --since 2026-01-01]
grantex audit get alog_...
grantex audit log --agent-id ag_... --agent-did did:grantex:ag_... --grant-id grnt_... \
--principal-id user@example.com --action email.read --status success
grantex policies list
grantex policies get pol_...
grantex policies create --name "Allow Bot" --effect allow --agent-id ag_... --scopes email:read
grantex policies update pol_... --priority 50
grantex policies delete pol_...
grantex budgets allocate --grant-id grnt_... --amount 100 [--currency USD]
grantex budgets debit --grant-id grnt_... --amount 25.50 --description "API call"
grantex budgets balance grnt_...
grantex budgets transactions grnt_...
grantex usage current
grantex usage history [--days 7]
grantex webhooks list
grantex webhooks create --url https://example.com/hook --events grant.created,token.issued
grantex webhooks delete wh_...
grantex events stream [--types grant.created,token.issued]
grantex --json events stream # One JSON object per line
grantex domains list
grantex domains add --domain auth.mycompany.com
grantex domains verify dom_...
grantex domains delete dom_...
grantex vault list [--principal user@example.com --service google]
grantex vault get cred_...
grantex vault store --principal-id user@example.com --service google --access-token ya29...
grantex vault delete cred_...
grantex vault exchange --grant-token <jwt> --service google
grantex webauthn register-options --principal-id user@example.com
grantex webauthn register-verify --challenge-id ch_... --response '{"id":"..."}' --device-name "MacBook"
grantex webauthn list user@example.com
grantex webauthn delete cred_...
grantex credentials list [--grant-id grnt_... --status active]
grantex credentials get vc_...
grantex credentials verify --vc-jwt eyJ...
grantex credentials present --sd-jwt eyJ... --nonce abc123
grantex passports issue --agent-id ag_... --grant-id grnt_... --categories "compute,storage" --max-amount 100
grantex passports list [--agent-id ag_...]
grantex passports get pp_...
grantex passports revoke pp_...
grantex principal-sessions create --principal-id user@example.com [--expires-in 1h]
grantex me
grantex compliance summary [--since 2026-01-01 --until 2026-02-01]
grantex compliance export grants --format json --output grants.json
grantex compliance export audit --format json --output audit.json
grantex compliance evidence-pack --framework soc2 --output evidence.json
grantex anomalies detect
grantex anomalies list [--unacknowledged]
grantex anomalies acknowledge anom_...
grantex billing status
grantex billing checkout pro --success-url https://app.com/ok --cancel-url https://app.com/cancel
grantex billing portal --return-url https://app.com/settings
grantex scim tokens list | create --label "Okta" | revoke tok_...
grantex scim users list | get usr_... | create --user-name john@co.com | update usr_... | delete usr_...
grantex sso get | configure --issuer-url ... --client-id ... | delete
grantex sso login-url my-org
grantex sso callback --code CODE --state STATE
grantex verify <jwt> [--verbose --check-revocation]
grantex verify --file token.txt [--jwks https://api.grantex.dev/.well-known/jwks.json]
grantex decode <jwt>
grantex decode --file token.txt --json
decode does not verify the signature. Use verify before trusting claims.
grantex audit-log inspect audit.jsonl
grantex audit-log verify audit.jsonl
grantex registry lookup did:web:agent.example.com
grantex registry verify-dns did:web:agent.example.com
grantex dpdp consent list --principal user@example.com
grantex dpdp consent get cr_...
grantex dpdp consent withdraw cr_... --reason "Consent withdrawn"
grantex dpdp grievances get grv_...
grantex dpdp erasure user@example.com
grantex dpdp principal-records user@example.com
Run grantex dpdp --help for the create, notice, grievance, and export options.
grantex manifest list [--category finance]
grantex manifest show salesforce
grantex manifest validate --agent-tools list_contacts,create_contact --connector hubspot
grantex manifest load ./manifest.json
grantex manifest generate ./src
grantex enforce test --token <jwt> --connector salesforce --tool delete_contact
grantex init gemma [--dir ./grantex-gemma-starter]
grantex agent install [--target openclaw|hermes|portable] [--dir <skill-root>] [--force]
grantex config set --url http://localhost:3001 --key dev-api-key-local
Apache 2.0
FAQs
Agent-friendly CLI for Grantex delegated authorization
The npm package @grantex/cli receives a total of 11 weekly downloads. As such, @grantex/cli popularity was classified as not popular.
We found that @grantex/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.