Run your Crumb workspace from the terminal.

The Crumb CLI gives operators and AI agents workspace-scoped access without sharing a browser session. This installer downloads directly from Crumb; npm is not required.

Install

Requires macOS or Linux, Node.js 18.18+, curl, and tar.

curl -fsSL https://getcrumb.dev/install-cli | sh

The installer verifies the release archive's SHA-256 checksum before installing. It places versioned files under ~/.local/share/crumb-cli and the executable at ~/.local/bin/crumb.

Manual installation

curl -fLO https://getcrumb.dev/downloads/crumb-cli-0.2.0.tgz
echo "ce9b538cd4024bbae579fb9f353f4d96a6f6a501c258673a74b4be379564108a  crumb-cli-0.2.0.tgz" | sha256sum -c -
tar -xzf crumb-cli-0.2.0.tgz
node package/dist/index.js --version

On macOS, replace the checksum line with echo "ce9b538cd4024bbae579fb9f353f4d96a6f6a501c258673a74b4be379564108a crumb-cli-0.2.0.tgz" | shasum -a 256 -c.

Create an automation token

1. Open your workspace in the Crumb dashboard.
2. Open API Access, then create a token under CLI automation.
3. Copy the ca_ token immediately. It is shown only once.

Authenticate safely

Avoid putting the token directly in a shell command, where it may be saved in history. In bash or zsh:

read -s CRUMB_TOKEN
export CRUMB_TOKEN
crumb doctor --json

Paste the token after read and press Enter. The token is workspace-scoped and cannot become a browser session or authenticate inference requests.

If you are an agent

Use the CLI as a non-interactive, JSON-based interface. The human operating your environment should provide CRUMB_TOKEN; do not ask them to paste the token into chat, and never print or inspect its value.

# Confirm authentication and the selected workspace first.
crumb doctor --json

# Discover the commands supported by this installed version.
crumb --help

# Inspect state before proposing or performing a change.
crumb workspace show --json
crumb credential list --json
crumb pool list --json

# Mint a key only when the user has authorized you to handle its plaintext.
crumb key create --pool <pool-id> --recipient-email person@example.com --json

# Prefer distribution when the recipient should receive the key themselves.
crumb key distribute --pool <pool-id> --recipient-email person@example.com --json

• Always use --json. Parse stdout as exactly one JSON value; diagnostics and errors are written to stderr.
• Use --workspace <expected-id> when the expected workspace is known. Stop if it does not match the token's workspace.
• Inspect the relevant resource before mutating it, make only the requested change, then read it again to verify the result.
• Never run echo $CRUMB_TOKEN, env, or another command that could expose secrets. Do not include secrets in logs, summaries, command arguments, or files.
• key create prints a reveal-once ck_ secret. Capture it only into the destination authorized by the user; never repeat it in chat or a summary.
• Prefer key distribute when a recipient should receive access directly. It emails a reveal link and does not return the ck_ secret to the agent.
• For destructive commands, explain the target and consequence, then use --yes only when the user has authorized that action.
• Use exit codes to decide what to do: 2 invalid input, 3 authentication, 4 not found, 5 validation/conflict, and 6 temporary or rate-limited failure.

The package also includes a SKILL.md with these operating constraints for agent runtimes that support bundled skills.

Available commands

Run crumb --help for global options. Non-interactive tools should use --json.

Update or uninstall

Run the installer again to update to the version shown on this page.

curl -fsSL https://getcrumb.dev/install-cli | sh

To uninstall:

rm ~/.local/bin/crumb
rm -rf ~/.local/share/crumb-cli

Security notes

• Never print or commit CRUMB_TOKEN.
• Revoke a lost token immediately from API Access in the dashboard.
• The CLI sends no client analytics and stores no generated Crumb keys.
• Use --workspace <id> when a script should fail if its token targets an unexpected workspace.