CLI reference.
Everything the locker binary does today, and an explicit list of what it does not do yet.
The one rule about secret input#
No command accepts a secret value as an argument. There is no flag for it. Commands that need a value read it from standard input behind --stdin, and a raw secret detected on the argument list is rejected with exit code 7 before anything is sent to the daemon.
This is not a style preference. Arguments are visible to other processes on the machine, they land in shell history, and they get captured by process supervisors and crash reporters.
# reads the value from stdin, never from the command line
printf '%s' "$KEY" | locker secrets add OPENAI_API_KEY --provider openai --stdin--stdin, the command fails in under a second and names the flag it wanted.Every command#
| Command | What it does |
|---|---|
| locker init [--stdin] | Creates the vault, generates the Vault Secret Key, writes the Emergency Kit. |
| locker unlock [--stdin] | Unlocks with passphrase then Vault Secret Key, one per line. |
| locker lock | Re-locks immediately, without waiting for the idle timeout. |
| locker status | Reports lock state and daemon reachability. |
| locker secrets list | Aliases, providers, and versions. Never values. |
| locker secrets show ALIAS | Metadata for one secret. Still never the value. |
| locker secrets add ALIAS [--provider P] [--stdin] | Stores a new secret. --provider defaults to env. |
| locker secrets rotate ALIAS [--stdin] | Adds a new version; earlier versions stay retrievable. |
| locker secrets reveal ALIAS --reason TEXT --confirm | Break-glass. Disabled by default, always audited. See below. |
| locker tokens list | Fingerprints, bindings, and expiry for issued tokens. |
| locker tokens create --name N --bind provider=ALIAS [--env E] [--ttl S] [--reason TEXT] | Mints a scoped Locker token. At least one --bind is required; --env defaults to dev. |
| locker events list [--limit N] | Reads the activity log, newest first. |
| locker run --secret ALIAS[=ENV] [--reason TEXT] -- CMD | Runs a program with the secret in its environment only. |
| locker mcp serve | Serves the agent broker over stdio for MCP clients. |
| locker help | version | Usage and build information. |
Global flags#
--json switches output to machine-readable form. It is order-independent and is consumed before any -- separator, so a child program's own flags are never mistaken for Slifer's. -h, --help, -V and --version behave as you would expect.
--json deliberately does not apply to locker run. That command's standard output belongs to the child process, and wrapping it would corrupt whatever the child is writing.
Exit codes#
Exit codes are a stable interface. Script against them rather than parsing text.
| Code | Meaning |
|---|---|
| 0 | Success. |
| 1 | Internal or vault failure. |
| 2 | Bad command line. Nothing was sent to the daemon. |
| 3 | Daemon unreachable, or the deadline was exceeded. |
| 4 | Vault is locked. Run locker unlock. |
| 5 | Denied by policy or by token state. |
| 6 | Break-glass is disabled or was not confirmed. |
| 7 | Malformed request, including a secret found on the argument list. |
| 8 | Unknown provider. |
| 9 | A rate budget was exhausted. |
| 125, 126, 127 | locker run only, following env(1): the command could not be run, was not executable, or was not found. |
An unrecognized code from the daemon collapses to 1 rather than being passed through, so a future server version cannot invent an exit code this client does not understand. Exit code 4 is the one you will hit most: the vault locked itself while you were away.
Break-glass#
secrets reveal is the deliberate escape hatch for a human who genuinely needs a value back. It requires an explicit reason and an explicit confirmation, it is refused by default, and it writes an audit event that cannot be suppressed. Agents are denied it outright.
Treat a revealed value as compromised. Once it has been printed it has been in a terminal buffer, a scrollback file, and possibly a screen recording. Rotate it at the provider.
What is not in the binary yet#
These exist as library code and are reachable over the daemon's HTTP interface, but there is no command for them today. Listing them here so you do not go looking:
doctor, an environment diagnostic.tokens revoke. Revocation works, but only over the control interface, not from the CLI.policies dry-run, for testing a policy without sending a request.tui, the terminal interface. The crate renders but has no binary target.