CLI (cf)

cf moves a local folder into your evidence supply. It ships three commands today.

cf login                 sign in this device (prints a code to approve in your browser)
cf logout                forget this device's stored token
cf sync <path> [--watch] [--dry-run] [--token <value>]

• cf login runs the OAuth device grant. You approve the code at /device; the device then appears under Settings, Agents, where you can revoke it. The token is stored in your OS config directory, readable only by you.
• cf sync content-addresses every file, skips what the server already holds, and records a snapshot. The server scans each file for prompt injection. Symlinks are never followed, and files over the per-file cap are skipped and reported.
• --watch keeps running and syncs on change; --dry-run scans and reports without pushing.

Creating, verifying and publishing from the command line are not shipped yet. Use the MCP tools or the REST API for those.

Version 2, updated 2026-10-11.