CLI

The Declaw CLI lets you create and manage sandboxes, run commands, transfer files, build templates, manage volumes and vault-backed secrets, and sandbox MCP servers — all from your terminal.

Install

Shell script (Recommended)
Manual download
Go install

curl -fsSL https://raw.githubusercontent.com/declaw-ai/declaw-cli/main/install.sh | sh

Detects your OS and architecture automatically, downloads the latest release, and installs to /usr/local/bin.

Download the binary for your platform from GitHub Releases:

Platform	Binary
macOS (Apple Silicon)	`declaw-darwin-arm64`
macOS (Intel)	`declaw-darwin-amd64`
Linux x86_64	`declaw-linux-amd64`
Linux ARM64	`declaw-linux-arm64`
Windows x86_64	`declaw-windows-amd64.exe`
Windows ARM64	`declaw-windows-arm64.exe`

Then make it executable and move to your PATH:

chmod +x declaw-darwin-arm64
sudo mv declaw-darwin-arm64 /usr/local/bin/declaw

go install github.com/declaw-ai/declaw-cli/cmd/declaw@latest

Verify the installation:

declaw version

Authentication

declaw auth login

You’ll be prompted to enter your API key (input is hidden). The CLI validates it against the API and saves it to ~/.declaw/config.json. You can also pass it directly:

declaw auth login --api-key <your-key>

declaw auth status    # check who you're logged in as
declaw auth logout    # remove stored credentials

Configuration

The CLI resolves credentials in this order (highest priority first):

Priority	Source
1	`--api-key` and `--domain` flags
2	`DECLAW_API_KEY`, `DECLAW_DOMAIN`, and `DECLAW_API_URL` environment variables
3	`~/.declaw/config.json` (written by `declaw auth login`)

The config file location can be overridden with the DECLAW_CONFIG_DIR environment variable.

Config file format

{
  "api_key": "your-api-key",
  "domain": "api.declaw.ai",
  "api_url": ""
}

Only api_key is required. domain and api_url are optional — api_url sets a full base URL (useful for on-prem deployments) instead of deriving it from domain.

Global flags

These flags are available on every command:

Flag	Description
`--api-key`	API key (overrides env var and config file)
`--domain`	API domain (overrides env var and config file)
`--json`	Output as JSON (for scripting)

Commands

Each command group has its own reference page:

Command	Alias	What it does
`declaw sandbox`	`sb`	Create, inspect, exec into, connect to, and manage sandboxes
`declaw template`	`tpl`	List and build sandbox templates
`declaw volume`	`vol`	Manage volumes — copy-mode, file-granular files, locks, snapshots
`declaw vault`		Store and rotate secrets injected at the egress proxy
`declaw account`		View account, usage, and manage API keys
`declaw auth`		Log in, log out, and check auth status
`declaw mcp`		Wrap any stdio MCP server in a sandboxed microVM
`declaw governance packs list`		List available governance/compliance packs
`declaw version`		Print CLI version, commit, and build date (`--json` for machine output)

Next steps

Sandbox commands — the core declaw sandbox workflow
MCP Sandboxing — sandbox any MCP server with declaw mcp
Quickstart — five-minute tutorial using the SDKs
Installation — install the Python, TypeScript, or Go SDK

Getting Started

Core Features

Security

Platform

Deployment

Architecture

CLI

Install

Authentication

Configuration

Config file format

Global flags

Commands

Next steps

​Install

​Authentication

​Configuration

​Config file format

​Global flags

​Commands

​Next steps

Install

Authentication

Configuration

Config file format

Global flags

Commands

Next steps