@geslar/cli

Command-line access to your Geslar vault via geslar:// references — for scripts, agents, and DevOps. Requires a Premium, Family, Business, or Enterprise plan.

npm install -g @geslar/cli
geslar signin
geslar run -e DB_PASSWORD=geslar://Work/Database/password -- ./start-server.sh

The server never sees which vault, item, or field a reference asks for — resolution happens locally, after decrypting on your machine.

MCP server

geslar mcp serve runs a stdio MCP server for Claude Code, Claude Desktop, Cursor, and other MCP clients — 6 tools (list vaults/items, whoami, provision-env, run, recent audit) scoped to an agent profile, gated behind an out-of-band pre-grant (geslar mcp allow/allow-cmd) for anything that writes or executes. No tool returns a secret value — run reports only exit status and line counts, and by default returns no process output at all.

geslar unlock --ttl 30m
geslar agent create my-agent --vault Work
geslar mcp init my-agent --client claude-code

geslar mcp init detects your MCP client and wires up the config for you (never contains a token). It points the config at your globally-installed geslar if one is on your PATH (tracking whatever version that is), otherwise at a version-pinned npx -y @geslar/cli@<version> — never an unpinned @latest. Full reference — all 6 tools, the pre-grant model, and known limitations — at docs.geslar.app/cli/reference.

Full docs: install (including standalone Windows/Linux binaries), quickstart, the geslar:// reference syntax, agent profiles, and known limitations — see docs.geslar.app/cli/reference or the docs/cli/ directory in the geslar-suite repository.

License

Proprietary, copyright Geslar d.o.o. — see LICENSE.md.