zenith-ops

Local Zenith Ops agent CLI for OAuth login, guided onboarding, and seamless MCP connection to local LLM clients.

npx zenith-ops

The package exposes two binaries:

• zenith
• zenith-ops

Core commands

zenith login
zenith
zenith projects
zenith projects --select
zenith create
zenith dashboard --project my-project
zenith login --project my-project
zenith status --profile my-project
zenith connect mcp --profile my-project --client codex
zenith connect mcp --profile my-project --client claude-desktop
zenith mcp serve --profile my-project
zenith logout --profile my-project

Security model

• Uses Zenith Core's OAuth 2.1 + PKCE flow for both account CLI access (/cli) and project MCP access (/mcp/{slug}).
• Keeps account dashboard tokens (scope=cli, project_id=NULL) separate from project MCP tokens (mcp_*, project-scoped).
• Stores token material in the OS keychain on macOS.
• Falls back to ~/.zenith-ops-agent/secrets.json with 0600 permissions when no supported keychain is available.
• Writes MCP client configs with a command bridge only; tokens are never written into Claude/Codex config files.
• Defaults to mcp_read. operator and admin scopes are opt-in.

Account dashboard

After account login:

zenith login
zenith projects
zenith create
zenith dashboard --project my-project

The dashboard shows the current runtime state, connected resource counts, next actions, and MCP connection hints.

MCP bridge

MCP clients run:

zenith mcp serve --profile my-project

The bridge speaks stdio MCP locally and forwards JSON-RPC calls to:

https://zenith-ops-api.harmonycvm.com/mcp/my-project

with the current OAuth bearer token.

Global zenith command

npx zenith-ops runs from the npx cache, so the zenith binary is not on your PATH afterwards. On first run the CLI offers to install itself globally (npm install -g zenith-ops) — accept it and every hint like zenith login works from any shell. If you skip it, every command also works in npx form: npx zenith-ops login, npx zenith-ops connect mcp .... MCP client configs written without a global install use the npx -y zenith-ops mcp serve ... bridge automatically, so Codex / Claude Desktop keep working either way.

Interactive shell (0.1.3)

With an account login, bare zenith drops into a codex/claude-style shell:

$ zenith
zenith-ops 0.1.3 — interactive shell
Projects
  orderhop-cs   live   owner
  ...
zenith> list
zenith> connect mcp --project orderhop-cs --client codex
zenith> status --project orderhop-cs
zenith> exit

connect mcp --project <slug> runs the project OAuth automatically when no profile exists yet, so login → connect is a single command.