# CLI (cf)

`cf` moves a local folder into your evidence supply. It ships three commands today.

```text
cf login                 sign in this device (prints a code to approve in your browser)
cf logout                forget this device's stored token
cf sync <path> [--watch] [--dry-run] [--token <value>]
```

- `cf login` runs the OAuth device grant. You approve the code at [/device](/device);
  the device then appears under Settings, Agents, where you can revoke it. The token
  is stored in your OS config directory, readable only by you.
- `cf sync` content-addresses every file, skips what the server already holds, and
  records a snapshot. The server scans each file for prompt injection. Symlinks are
  never followed, and files over the per-file cap are skipped and reported.
- `--watch` keeps running and syncs on change; `--dry-run` scans and reports without
  pushing.

Creating, verifying and publishing from the command line are not shipped yet. Use the
MCP tools or the REST API for those.



Version 2, updated 2026-10-11.