Authensor CLI reference

The Authensor CLI (npx authensor) is a command-line tool for managing policies, querying receipts, running the MCP gateway, and interacting with the control plane. This is the full command reference.

Installation

The CLI is included in the @authensor/cli package:

pnpm add -g @authensor/cli
# or run without installing:
npx authensor <command>

Policy commands

authensor policy lint <file>

Validate a YAML policy file. Checks for syntax errors, unreachable rules, missing reasons on escalation rules, and invalid regex patterns.

npx authensor policy lint ./policy.yaml

authensor policy test <file> --input <json>

Test a policy against a specific tool call:

npx authensor policy test ./policy.yaml \
  --input '{"tool": "shell.execute", "args": {"command": "rm -rf /"}}'
# Output: BLOCK - "Destructive shell commands are blocked"

authensor policy diff <file1> <file2>

Show the differences between two policy files:

npx authensor policy diff ./old-policy.yaml ./new-policy.yaml

Receipt commands

authensor receipts list

List recent receipts from the control plane:

npx authensor receipts list --limit 20
npx authensor receipts list --action block --since 24h
npx authensor receipts list --session sess_abc123

authensor receipts verify

Verify the integrity of a receipt chain:

npx authensor receipts verify --session sess_abc123

Returns exit code 0 if the chain is intact, 1 if tampering is detected.

MCP gateway commands

authensor mcp-gateway

Start the MCP gateway:

npx authensor mcp-gateway --config ./mcp-gateway.yaml
npx authensor mcp-gateway --policy ./policy.yaml --transport stdio

Control plane commands

authensor init

Initialize a new Authensor project with a default policy and configuration:

npx authensor init

authensor status

Check the connection to the control plane:

npx authensor status --endpoint http://localhost:3000

Global options

| Flag | Description | |------|-------------| | --config <path> | Path to configuration file | | --endpoint <url> | Control plane URL | | --api-key <key> | API key for authentication | | --format <json\|table> | Output format | | --verbose | Enable debug logging |

Environment variables

The CLI reads these environment variables:

• AUTHENSOR_ENDPOINT: Control plane URL
• AUTHENSOR_API_KEY: API key
• AUTHENSOR_CONFIG: Path to configuration file