@cybersierra-cli/cybersierra

Command-line client for the Cyber Sierra GRC platform — third-party risk assessments, permissions, and platform health from a terminal, a CI pipeline, or an AI agent.

npm install -g @cybersierra-cli/cybersierra

This package ships without a command surface

The CLI's commands are not compiled in — they are data, loaded from your own backend once you authenticate. A fresh install knows how to log in and nothing else:

$ cybersierra --help
Commands:
  auth          Manage CLI authentication
  self-update   Sync the CLI command surface to the backend it points at
  manifest      Print the agent command catalog as JSON
  version       Print CLI and loaded manifest versions

No command surface loaded yet. Run `cybersierra auth login` to authenticate —
the platform commands are fetched from your backend on login.

This is deliberate. The set of API operations available to you depends on your deployment, so it is served by your deployment — not baked into a public package.

Getting started

# email + password
cybersierra auth login --url https://morpheus-api.<your-env>.cybersierra.ai \
                       --org <org-id> --email [email protected]

# SSO or MFA accounts — opens a browser
cybersierra auth login-browser --url https://morpheus-api.<your-env>.cybersierra.ai

Login stores a profile at ~/.cybersierra/config.json (mode 0600; the JWT only, never your password) and immediately fetches your command surface. After that:

cybersierra manifest                        # what can I do? (JSON catalog)
cybersierra tprm assessments list           # run a command

Commands

Every platform command follows cybersierra <module> <resource> <action>. Run cybersierra manifest for the full catalog as structured JSON — one call, including each parameter's type, defaults, and allowed values, plus a safe flag marking read-only operations.

Output

stdout is always a JSON envelope; errors go to stderr.

{ "data": [ ... ], "meta": { "total": 112, "page": 1, "limit": 50 } }
{ "error": { "code": 401, "message": "Token expired. Run: cybersierra auth login" } }

Exit codes: 0 success · 1 API error · 2 auth · 3 not found · 4 forbidden.

Staying in sync

The CLI checks your backend's public /health checksum periodically and tells you when your surface is stale. To sync on demand:

cybersierra self-update           # fetch the current surface
cybersierra self-update --check   # compare only; exit 3 if out of sync

Set MORPHEUS_NO_UPDATE_CHECK=1 to disable the background check entirely.

Configuration

| Variable | Purpose | |---|---| | MORPHEUS_TOKEN | JWT — preferred for agents and CI | | MORPHEUS_BASE_URL | Backend base URL | | MORPHEUS_ORG | Organisation / tenant ID | | MORPHEUS_EMAIL / MORPHEUS_PASSWORD | Non-interactive login | | MORPHEUS_PROFILE via --profile <name> | Named profiles for multiple tenants | | MORPHEUS_CONFIG_DIR | Override ~/.cybersierra | | MORPHEUS_CLIENT | Force the client tag (agent / operator / ci) | | MORPHEUS_NO_UPDATE_CHECK | Disable the background drift check |

Environment variables always take precedence over the stored profile.