CLI integration

The weirgate CLI exposes the same scoped public workflows as MCP with stable JSON, table, and YAML output.

weirgate auth login
weirgate auth status --output json
weirgate init --app my-app --output json

Browser login is the default. The dashboard consent screen shows the tenant, apps, tool groups, scope, environment, and expiry before issuing a single-use callback code. The CLI exchanges it and stores the reveal-once grant in macOS Keychain. --stdin accepts an already-minted key when browser login is unavailable.

Use --dry-run before apply, grant, or reversal operations and always pass a stable --idempotency-key for the real mutation. Config and rules changes remain durable proposals; a stale proposal must be rebased and previewed again.

Provider-key put and rotate default to a local browser ceremony. Hidden --stdin is available, but piped secret input is rejected unless the human explicitly opts in with --allow-pipe. Key values never appear in JSON output.

Run weirgate completion zsh or weirgate completion bash for shell completion. Set WEIRGATE_API_URL only when deliberately targeting a non-production environment.