@remitlabs/cli

Least-privilege and lifecycle control for AI agent skills.

skillctl audits the skills your agents already have, records static findings, runs a canary in a disposable container when Docker or Podman is available, pins installs by digest, and blocks revoked digests at load time.

Quick start

npx @remitlabs/cli@latest start

start scans your real agent skill directories, starts the local app on 127.0.0.1:8787, and opens the reports view with the highest-severity findings first. Nothing is installed or modified by the scan.

npx @remitlabs/cli@latest setup

setup merges — never replaces — each agent's MCP config and Claude Code hook. It writes a timestamped backup before the first change and is safe to run twice. The hook is observe-only until REMIT_ENFORCE=1.

If you run setup from the npx cache, install the CLI globally first so the hook path survives cache cleanup:

npm i -g @remitlabs/cli
skillctl setup

Commands

skillctl doctor --json        # environment and capability report
skillctl audit                # audit installed skill directories
skillctl add owner/repo@skill # preview digest, evidence, decision, then commit
skillctl status               # active / monitor / review / blocked / unknown / parked
skillctl explain <name>       # why allowed, what coverage is missing, receipt limits
skillctl canary <dir>         # run the behavioral canary (needs Docker or Podman)
skillctl sync                 # verify and apply the signed daily feed
skillctl report               # auditor-facing fleet posture (markdown or JSON)
skillctl scorecard <name>     # risk + canary + lockfile + eval evidence
skillctl hook-guard           # PreToolUse guard; observe-only until REMIT_ENFORCE=1
skillctl find "ship to prod"  # semantic search over the local index
skillctl stop                 # stop the local app

The MCP router enforces the same assessment at load time. Hard blocks always refuse. Review-level skills refuse unless REMIT_MCP_ALLOW_REVIEW=1. Legacy skills with no receipt still load unless you opt into REMIT_MCP_REQUIRE_EVIDENCE=1.

What this does not prove

• A finding is a rule match. It is not proof of intent, and a clean scan is not proof that a skill is benign.
• A canary receipt is one observed run in a container. It is not a guarantee that the skill cannot escape, exfiltrate, or behave differently on another host.
• The canary is observer-first by default. It enforces egress destinations only when you pass --egress allowlist. It observes HTTP(S) proxy traffic, not TLS bodies, and it does not run the agent or the model.
• Static coverage can be partial when files are oversized, opaque, or symlinked. The scan reports that state; it does not silently treat it as clean.

Remit is defense in depth, not a clean bill of health.

Security

Please do not open a public issue for a security problem. Email [email protected] with [security] in the subject and include the package version, a minimal reproduction, and the impact.

Requirements

• Node.js 22.5 or newer (the local index uses node:sqlite).
• Docker or Podman is optional. Without a container runtime, Remit runs static-only and reports unknown where behavioral evidence is missing.

License

Apache-2.0. See LICENSE in the package tarball.

Website: https://remitlabs.github.io