cs — CoreSpeed CLI

The command-line tool for CoreSpeed HaaS. Authenticate via WorkOS, manage sk-cs-* server-to-server API keys, emit MCP client config, and administer connectors + remote MCP servers — all against the one authed CoreSpeed gateway.

Install

# One-off, no install (ideal for agents / CI)
npx @corespeed/cs --help

# Global install
npm install -g @corespeed/cs
cs --help

# Bun equivalents
bunx @corespeed/cs --help
bun install -g @corespeed/cs

Requires Node.js >= 20 (or Bun). Zero runtime dependencies.

Quick start

cs login                 # browser PKCE login; stores tokens under ~/.config/cs
cs whoami                # show the current user + org
cs keys create my-key    # mint an sk-cs-* API key (shown once)
cs mcp-config            # emit MCP client config JSON for the unified /mcp surface

Run cs --help for the full command list (keys, connectors, remote, mcp, usage, admin, …).

Environment

The CLI defaults to the CoreSpeed production environment (api.corespeed.io). Override these to target another environment:

| Variable | Default (production) | Purpose | |---|---|---| | CS_API_URL | https://api.corespeed.io | HaaS worker base URL | | CS_APP_URL | https://app.corespeed.io | Dashboard base URL (connector web flows) | | CS_WORKOS_CLIENT_ID | production "CoreSpeed CLI" app | WorkOS public client ID for the PKCE login | | CS_WORKOS_API_URL | https://auth.corespeed.io | WorkOS Authentication API origin | | CS_LOGIN_PORT | random | Fixed loopback port for the login callback | | CS_LOGIN_TIMEOUT_MS | 300000 | Browser login deadline in milliseconds (1–2147483647) | | CS_CONFIG_DIR | ~/.config/cs | Where tokens are stored | | DO_NOT_TRACK | unset | Set to exactly 1 to omit the constant X-CS-Client product/version header from CLI requests. Authorization and protocol headers remain; this does not disable service activity, billing, audit, security, or abuse-prevention records. |

Targeting staging

Set the first four together, but for different reasons — worth knowing which, because only one of them breaks authentication:

• CS_API_URL + CS_WORKOS_CLIENT_ID must agree. Each tier pins its own WorkOS issuer, so a token minted against one tier's app is rejected by the other tier's worker on every authenticated call.
• CS_APP_URL is not part of that: it only sets the dashboard host for cs connectors connect deep-links. Mismatch it and auth still works — you just hand the user a link into the wrong environment's dashboard.
• CS_WORKOS_API_URL must be https://api.workos.com for staging; CoreSpeed's auth.corespeed.io custom Authentication API domain exists only in WorkOS production.

export CS_API_URL=https://api.staging.corespeed.io
export CS_APP_URL=https://app.staging.corespeed.io
export CS_WORKOS_CLIENT_ID=client_01KW5DAFK2WNFE75PK6Z8MD0NH   # staging "CoreSpeed CLI" app
export CS_WORKOS_API_URL=https://api.workos.com
cs login                                                       # re-login after switching tiers

Tokens are stored per config dir, not per tier — pair a tier switch with CS_CONFIG_DIR (or a fresh cs login) to avoid reusing the other tier's token.

Learn more

• Agent-native skill: skills/cs-cli
• Gateway SDK setup: the cs-api skill in the same repo

License

Apache-2.0 © CoreSpeed, Inc.