CLI (early access)

The CLI is in early access: these commands work today; the surface will keep growing.

The firmament CLI exposes the same two verbs as the MCP server, for scripts, CI pipelines, and agents that can run shell commands but don't speak MCP. Same account, same access rules, same brain.

Log in once

firmament login

firmament login prints a short code and opens your browser; you approve with your normal workspace login (the printed URL is the fallback for headless machines). The session is stored securely on your machine and refreshes itself; firmament logout clears it and firmament whoami shows who you are.

For CI and scripts, an explicit token still works: set FIRMAMENT_TOKEN and it overrides the stored session.

Use it

# get your organization's proven guidance for the task at hand
firmament ask "deploying the payments service, anything I should know?"

# report an outcome after the task
firmament submit "migrate-first deploy worked; the smoke test still misses schema drift"

Both commands take plain language, exactly like the MCP tools, and the same scoping, approval, and never-store rules apply.

Configuration

Variable	Purpose
FIRMAMENT_API_URL	point the CLI at a different Firmament deployment
FIRMAMENT_TOKEN	explicit bearer token, overrides the stored login

When to use the CLI instead of MCP

• CI jobs that should consult organizational knowledge before acting
• shell-capable agents without MCP client support
• quick one-off checks from a terminal