> ## Documentation Index
> Fetch the complete documentation index at: https://docs.declaw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI

> Install and configure the Declaw CLI to manage sandboxes, templates, volumes, vault secrets, and MCP servers from the command line.

The Declaw CLI lets you create and manage sandboxes, run commands,
transfer files, build templates, manage volumes and vault-backed
secrets, and sandbox MCP servers — all from your terminal.

## Install

<Tabs>
  <Tab title="Shell script (Recommended)">
    ```bash theme={null}
    curl -fsSL https://raw.githubusercontent.com/declaw-ai/declaw-cli/main/install.sh | sh
    ```

    Detects your OS and architecture automatically, downloads the
    latest release, and installs to `/usr/local/bin`.
  </Tab>

  <Tab title="Manual download">
    Download the binary for your platform from
    [GitHub Releases](https://github.com/declaw-ai/declaw-cli/releases):

    | Platform              | Binary                     |
    | --------------------- | -------------------------- |
    | macOS (Apple Silicon) | `declaw-darwin-arm64`      |
    | macOS (Intel)         | `declaw-darwin-amd64`      |
    | Linux x86\_64         | `declaw-linux-amd64`       |
    | Linux ARM64           | `declaw-linux-arm64`       |
    | Windows x86\_64       | `declaw-windows-amd64.exe` |
    | Windows ARM64         | `declaw-windows-arm64.exe` |

    Then make it executable and move to your PATH:

    ```bash theme={null}
    chmod +x declaw-darwin-arm64
    sudo mv declaw-darwin-arm64 /usr/local/bin/declaw
    ```
  </Tab>

  <Tab title="Go install">
    ```bash theme={null}
    go install github.com/declaw-ai/declaw-cli/cmd/declaw@latest
    ```
  </Tab>
</Tabs>

Verify the installation:

```bash theme={null}
declaw version
```

## Authentication

Sign up at [console.declaw.ai](https://console.declaw.ai), copy your
API key from the dashboard, and run:

```bash theme={null}
declaw auth login
```

You'll be prompted to enter your API key (input is hidden).
The CLI validates it against the API and saves it to
`~/.declaw/config.json`. You can also pass it directly:

```bash theme={null}
declaw auth login --api-key <your-key>
```

```bash theme={null}
declaw auth status    # check who you're logged in as
declaw auth logout    # remove stored credentials
```

## Configuration

The CLI resolves credentials in this order (highest priority first):

| Priority | Source                                                                        |
| -------- | ----------------------------------------------------------------------------- |
| 1        | `--api-key` and `--domain` flags                                              |
| 2        | `DECLAW_API_KEY`, `DECLAW_DOMAIN`, and `DECLAW_API_URL` environment variables |
| 3        | `~/.declaw/config.json` (written by `declaw auth login`)                      |

The config file location can be overridden with the `DECLAW_CONFIG_DIR`
environment variable.

### Config file format

```json theme={null}
{
  "api_key": "your-api-key",
  "domain": "api.declaw.ai",
  "api_url": ""
}
```

Only `api_key` is required. `domain` and `api_url` are optional —
`api_url` sets a full base URL (useful for on-prem deployments) instead
of deriving it from `domain`.

## Global flags

These flags are available on every command:

| Flag        | Description                                    |
| ----------- | ---------------------------------------------- |
| `--api-key` | API key (overrides env var and config file)    |
| `--domain`  | API domain (overrides env var and config file) |
| `--json`    | Output as JSON (for scripting)                 |

## Commands

Each command group has its own reference page:

| Command                            | Alias | What it does                                                            |
| ---------------------------------- | ----- | ----------------------------------------------------------------------- |
| [`declaw sandbox`](/cli/sandbox)   | `sb`  | Create, inspect, exec into, connect to, and manage sandboxes            |
| [`declaw template`](/cli/template) | `tpl` | List and build sandbox templates                                        |
| [`declaw volume`](/cli/volume)     | `vol` | Manage volumes — copy-mode, file-granular files, locks, snapshots       |
| [`declaw vault`](/cli/vault)       |       | Store and rotate secrets injected at the egress proxy                   |
| [`declaw account`](/cli/account)   |       | View account, usage, and manage API keys                                |
| [`declaw auth`](/cli/auth)         |       | Log in, log out, and check auth status                                  |
| [`declaw mcp`](/cli/mcp)           |       | Wrap any stdio MCP server in a sandboxed microVM                        |
| `declaw governance packs list`     |       | List available governance/compliance packs                              |
| `declaw version`                   |       | Print CLI version, commit, and build date (`--json` for machine output) |

## Next steps

* [Sandbox commands](/cli/sandbox) — the core `declaw sandbox` workflow
* [MCP Sandboxing](/cli/mcp) — sandbox any MCP server with `declaw mcp`
* [Quickstart](/quickstart) — five-minute tutorial using the SDKs
* [Installation](/installation) — install the Python, TypeScript, or Go SDK