CLI Reference

The Vultrino CLI provides complete control over credential management, server operations, and administration.

Global Options

vultrino [OPTIONS] <COMMAND>

Options:
  -c, --config <FILE>    Path to config file
  -v, --verbose          Increase verbosity (-v, -vv, -vvv)
  -k, --key <KEY>        API key for scoped access (only `request` uses it: it then
                         calls the web API at VULTRINO_API_URL, default
                         http://127.0.0.1:7879, instead of opening the vault)
  -h, --help             Print help
  -V, --version          Print version

Environment Variables

Variable	Description
`VULTRINO_PASSWORD`	Storage encryption password (required)
`VULTRINO_POLICY_HASH_SECRET`	Required by `vultrino web`; a stable random secret
`RUST_LOG`	Log level (trace, debug, info, warn, error)

There is no VULTRINO_CONFIG variable: use -c, --config <FILE>; otherwise the OS config directory is used (~/.config/vultrino/config.toml on Linux).

Commands

`init`

Initialize a new Vultrino instance.

vultrino init [OPTIONS]

Options:
  --force    Overwrite existing configuration

This command:

Writes a default config.toml (default-deny enforcement) to the OS config directory
Prompts for the web UI admin username and password and saves them to admin.json next to it

It always uses the OS config directory and ignores --config. The credential vault is created on first use, not by init.

Example:

export VULTRINO_PASSWORD="your-secure-password"
vultrino init
# Enter admin username: admin
# Enter admin password: ********

`add`

Add a new credential to storage.

vultrino add [OPTIONS]

Options:
  -a, --alias <ALIAS>         Human-readable name (required)
  -t, --type <TYPE>           Credential type [default: api_key]
  --key <KEY>                 API key value (api_key type)
  --username <USERNAME>       Username (basic_auth type)
  --password <PASSWORD>       Password (basic_auth type; prompts if omitted)
  -d, --description <DESC>    Optional description

Credential Types:

api_key — API key or token
basic_auth — Username and password
oauth2 — OAuth2 credentials (client ID, secret, tokens)
hmac_api_key, ecdsa_key, ssh_password, postgres (see vultrino add --help for their options)

Examples:

# Add an API key
vultrino add --alias github-api --key ghp_xxx...

# Add basic auth credentials
vultrino add --alias jira-api --type basic_auth \
  --username [email protected] --password secret123

# Add with description
vultrino add --alias stripe-api --key sk_live_xxx \
  --description "Production Stripe key"

`list`

List all stored credentials.

vultrino list [OPTIONS]

Options:
  -f, --format <FORMAT>    Output format: table (default) or json

--format json prints credential metadata only (id, alias, credential_type, metadata, created_at, updated_at), never secret fields. With no credentials stored it prints No credentials stored instead of [].

Example:

vultrino list
# ALIAS                TYPE            ID                                   DESCRIPTION
# --------------------------------------------------------------------------------
# github-api           api_key         550e8400-e29b-41d4-a716-446655440000 -
# stripe-api           api_key         6ba7b810-9dad-11d1-80b4-00c04fd430c8 -

`info`

Show details about a specific credential — metadata only, never the secret.

vultrino info <ALIAS>

Accepts a credential alias or id.

Example:

vultrino info github-api
# Alias: github-api
# Type: api_key
# Created: 2024-01-15T10:30:00Z
# Description: GitHub personal access token

`remove`

Remove a credential from storage.

vultrino remove <ALIAS>

Accepts a credential alias or id.

Example:

vultrino remove old-api-key
# Credential 'old-api-key' removed

`serve`

Run the MCP server (with --mcp). serve on its own no longer starts an API server — it prints a message directing you to vultrino web and exits without binding. Use vultrino web for the HTTP JSON API and admin UI, and vultrino mcp (or vultrino serve --mcp) for the MCP stdio server.

vultrino serve [OPTIONS]

Options:
  -b, --bind <ADDR>    Bind address for the legacy stub [default: 127.0.0.1:7878]
  --mcp                Start as MCP server (stdio transport) — same as `vultrino mcp`

Examples:

# Start MCP server for AI agents
vultrino serve --mcp   # equivalently: vultrino mcp

# `vultrino serve` alone does NOT serve the API — use `vultrino web` instead

`web`

Start the HTTP JSON API and web administration UI (the same process serves both, plus the /mcp and /llm connector routes).

vultrino web [OPTIONS]

Options:
  -b, --bind <ADDR>    Bind address [default: 127.0.0.1:7879]

Example:

vultrino web
# API + Web UI available at http://127.0.0.1:7879

`request`

Make an authenticated HTTP request.

vultrino request [OPTIONS] <CREDENTIAL> <URL>

Arguments:
  <CREDENTIAL>                Credential alias to use for authentication
  <URL>                       Target URL

Options:
  -X, --method <METHOD>       HTTP method [default: GET]
  -H, --header <HEADER>       Additional headers (can be repeated)
  -d, --data <DATA>           Request body (JSON string, or @filename to read from a file)
  -q, --quiet                 Output only the response body (no status info)

Examples:

# Simple GET request (credential alias is the first positional argument)
vultrino request github-api https://api.github.com/user

# POST with JSON body
vultrino request stripe-api \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"amount": 1000, "currency": "usd"}' \
  https://api.stripe.com/v1/charges

# Body only
vultrino request api-key https://api.example.com/data --quiet

`role`

Manage RBAC roles.

vultrino role <SUBCOMMAND>

Subcommands:
  create    Create a new role
  list      List all roles
  info      Show role details
  delete    Delete a role

Create a role:

vultrino role create <NAME> [OPTIONS]

Options:
  -p, --permissions <PERMS>    Comma-separated: read,write,update,delete,execute
  -s, --scopes <SCOPES>        Credential patterns (glob): "github-*,stripe-*"
  -d, --description <DESC>     Role description

Examples:

# Create read-only role
vultrino role create readonly --permissions read

# Create role for GitHub credentials only
vultrino role create github-executor \
  --permissions read,execute \
  --scopes "github-*" \
  --description "Execute requests with GitHub credentials"

# List roles
vultrino role list

# Delete role
vultrino role delete old-role

`key`

Manage API keys for programmatic access.

vultrino key <SUBCOMMAND>

Subcommands:
  create    Create a new API key
  list      List all API keys
  revoke    Revoke an API key

Create an API key:

vultrino key create <NAME> [OPTIONS]

Options:
  -r, --role <ROLE>           Role to assign (required)
  -e, --expires <DURATION>    Expiration: a number with h, d, w or m (m = 30 days),
                              e.g. "24h", "30d"; or "never" (default)

Examples:

# Create key with role
vultrino key create my-app --role github-executor
# Created API key: vk_a1b2c3d4e5f6...
# (Save this key - it won't be shown again)

# Create key with expiration
vultrino key create temp-key --role readonly --expires 7d

# List keys
vultrino key list

# Revoke key
vultrino key revoke vk_a1b2c3d4

The CLI has no completions subcommand; shell completions are not generated.

Exit Codes

Code	Meaning
0	Success
1	Any error (the CLI does not use separate codes for a missing credential, a denied request or a storage error)
2	Invalid arguments, or `vault check` (without `--truncate-final`) found only the final `.wal` record damaged

policy check also exits 1 when it finds a stored policy the servers refuse to load.

Tips

Use Aliases

Add to your shell profile:

alias vreq='vultrino request'
alias vcred='vultrino list'

Store Password Securely

On macOS, use Keychain:

security add-generic-password -a vultrino -s vultrino -w "your-password"
export VULTRINO_PASSWORD=$(security find-generic-password -a vultrino -s vultrino -w)

On Linux, use a secrets manager or environment file:

# ~/.vultrino-env (chmod 600)
export VULTRINO_PASSWORD="your-password"

# In shell profile
source ~/.vultrino-env

Vultrino Documentation