Logfire CLI

Rust command-line tools for Pydantic Logfire.

logfire authenticates against the hosted (or self-hosted) Logfire API, drives the public Logfire MCP server, points a project at Logfire, and exposes the typed Platform API — with first-class machine output for scripts and coding agents.

Quickstart

cargo install --path crates/logfire-cli   # see docs/installation.md for details
logfire auth                              # browser OAuth into the OS keychain
logfire mcp tools list                    # use that session against public MCP

Commands

| Command | What it does | | --- | --- | | logfire auth | Browser OAuth shared by CLI and MCP | | logfire init | Point a directory at a Logfire project | | logfire project | Validate and show the configured SDK project | | logfire token | Mint a project read/write token and print it | | logfire api-key | Mint a project-scoped API key and print it | | logfire api | Typed Platform API endpoints | | logfire mcp | Discover and call the public Logfire MCP server | | logfire doctor | Diagnose local prerequisites without exposing secrets |

Every command and group accepts --help.

Documentation

The User Guide covers everything in task-oriented pages:

• Installation — the binary and shell completions
• Authentication — logins, regions, LOGFIRE_TOKEN, and OS-keychain storage
• Output contracts — human vs. --output json/jsonl, the envelope, exit codes, and flag precedence

Global options apply before or after every command. --region us|eu (env PYDANTIC_LOGFIRE_REGION) chooses a hosted region, while --base-url <URL> (env LOGFIRE_BASE_URL) targets a self-hosted or staging instance and overrides it. --output human|json|jsonl, --no-input, and --color auto|always|never provide the shared presentation and prompting contract.

Architecture

The CLI is a Cargo workspace of small, single-purpose crates:

| Crate | Role | | --- | --- | | logfire-cli | The logfire binary: argument parsing (clap) and command dispatch. | | logfire-api | The typed logfire api command surface over the generated client. | | logfire-api-client | Generated from the OpenAPI schemas (see below); never hand-edited. | | logfire-auth | Standards-based browser OAuth orchestration. | | logfire-config | Credential resolution, regions / base-URL, and the request context. | | logfire-init | logfire init project setup and the .logfire/ credentials file. | | logfire-mcp-core | Pure, I/O-free decision core for global input/output, envelope, limit, and error-category contracts. | | logfire-mcp-client | Official rmcp transport, standards OAuth, bounded protocol I/O, and protocol-faithful fakes. |

See dev-docs/ARCHITECTURE.md for the product boundaries and trust model, and dev-docs/CRATE_RULES.md for each crate's dependency and I/O contract.

Design notes

• No unsafe. The workspace sets unsafe_code = "forbid"; safe std/nix APIs have covered every need, and forbid (unlike deny) can't be overridden locally.
• Small release binary. The release profile trades a little compile time for size (opt-level = "z", fat LTO, one codegen unit, strip, panic = "abort"), taking the macOS arm64 binary from ~15 MB to ~3.6 MB. Because panic = "abort" skips unwinding, a panic ends the process without running destructors — fine for a CLI, but note a task panic aborts the whole process rather than just that task.
• TLS via ring, not aws-lc. reqwest/rustls use the ring crypto provider — much smaller, and no cmake at build time. Trade-off: ring cannot verify P-521-signed certificates, so TLS can fail behind a corporate TLS-inspection proxy or Cloudflare WARP that uses a P-521 CA. If you hit that, the crypto provider is why; switching reqwest back to the default rustls (aws-lc) provider fixes it.
• Quality bars are enforced in CI, not by convention. Clippy runs at -D warnings with the pedantic group and unwrap/expect/panic denied in library and binary code; cargo-deny gates licenses and duplicate dependencies; 100% line/function coverage for every handwritten crate (scripts/check_coverage.py) and an architecture policy check (scripts/check_policy.py) block regressions; cargo doc runs with warnings as errors. See CLAUDE.md for the code-style rules and dev-docs/RUST-CONVENTIONS.md for the reviewed conventions.

Generated API Client

crates/logfire-api-client is generated exclusively from Logfire's documented Platform schema at /api/openapi.json. The client lives under logfire_api_client::platform; private or compatibility schemas are not shipped.

The normalized inputs and their provenance are committed under openapi/. To refresh the snapshot from its reviewed public HTTPS URL, inspect the schema diff, and then regenerate the client:

make refresh-openapi
make generate-api-client

make refresh-openapi replaces the snapshot and its SHA-256 provenance as one validated set. It deliberately leaves the generated checksum failing until make generate-api-client succeeds, so refreshed inputs cannot masquerade as a current client.

The crate is derived output: never hand-edit it. The generator cannot produce it correctly on its own, so scripts/generate-api-client.sh applies a handful of fix-ups afterwards (crate-relative import rewriting, missing recursive-schema type aliases, bounded response reads, channel discriminators, and the lint config). Anything that needs to persist across a regeneration belongs in that script's fix-up section.

The script requires Docker and uses OpenAPI Generator 7.22.0 through the exact OCI image digest recorded in openapi/provenance.toml. It constructs and formats a staging workspace, tests it against the exact lockfile, and only then replaces the client; a final locked compile remains rollback-protected. The committed checksum binds the schema snapshots, provenance, generation recipe, formatting config, and complete output tree, so ordinary CI detects input or generated-client drift without network access.

Development

The hosted Logfire MCP server is the primary boundary for new remote product capabilities; the documented Platform OpenAPI is the secondary typed automation surface, and handwritten /v1 calls are forbidden. See dev-docs/ARCHITECTURE.md and dev-docs/adr/0001-mcp-first-client.md before adding a command or remote dependency, and dev-docs/CHANGE_MAP.md for the files, tests, and docs that must change together. Pure MCP command contracts live in logfire-mcp-core; transport and OAuth stay in separate adapters.

Run the fast stable checks used by CI:

make ci

Before handing work off, run the pinned nightly formatter and Clippy lane too:

make ci-all

Enforce 100% line and function coverage for every handwritten crate and render text/HTML reports:

make coverage

The stable compiler is pinned in rust-toolchain.toml; the nightly formatter and lint toolchain is pinned by NIGHTLY_TOOLCHAIN in the Makefile. See dev-docs/VERIFICATION.md for scope, tool installation, and the rules for raising coverage floors.

Contributing and security

See CONTRIBUTING.md for the development and pull-request contract. Report vulnerabilities through the private process in SECURITY.md, never through a public issue.

The Logfire CLI is released under the MIT License.