CLI v1.0 • OAuth, MCP, and Skills

Run IAN from the folder you already work in.

The `ian` CLI discovers repositories in your current workspace, proposes a deploy-ready project assembly, syncs it to IAN, runs audits, triggers deployments, and exposes the same workflow to coding agents through MCP.

Install the CLI Set up MCP Book a call

Folder-aware audits OAuth and personal tokens Live operation streaming Codex / Claude Code / Cursor MCP

ian terminal

streaming

$ ian auth login

Opening browser approval flow on localhost…

✓ Signed in as [email protected]

$ ian audit ~/workspace

Discovered 3 repositories across this folder…

✓ Project assembly acme-platform confirmed

✓ 3 critical findings (secrets, IAM drift, exposed debug route)

✓ $4,100/mo in savings identified

$ ian deploy . --env staging

✓ Deploy #89 healthy — infra → service → frontend

$ ian mcp install

✓ Codex, Claude Code, and Cursor configs updated

Install

Install the package and get the `ian` binary on your machine.

npm install -g ian-cli

Authenticate

Use browser-based login for interactive work or a personal token for CI.

ian auth login

Audit folders

Point at one repo or an entire workspace. IAN discovers and previews the assembly first.

ian audit ~/workspace

Connect agents

Expose the same org, project assembly, audit, action, and deploy flows over MCP.

ian mcp install

Auth

Two auth paths, one backend contract.

Interactive users authenticate through a short-lived PKCE flow with a localhost callback. Automation and CI can use personal access tokens generated from your profile page or the profile API.

Browser OAuth

Best for local development, deploy approvals, and MCP-enabled agent sessions.

ian auth login
ian auth status
ian auth logout

Personal Tokens

Best for CI runners, remote workers, and scripts that cannot open a browser.

export IAN_API_TOKEN=ian_pat_xxx
ian auth status
ian audit . --json

Folder-aware workflow

Audit and deploy without pre-registering every repo by hand.

1. Discover

The CLI inspects the current path, finds nested git repositories, ignores build noise, derives remote slugs, and classifies likely repo roles.

2. Preview

IAN returns a project assembly preview with project naming, role mapping, deploy order, conflicts, and repo matches before any write occurs.

3. Commit

Once confirmed, the CLI syncs the project assembly and stores the mapping so later audits and deploys can reuse it.

4. Stream

Audit and deploy commands stream live operation events from the Rails backend so the terminal reflects real job progress, not placeholder output.

$ ian audit .
Discovered 1 repository in /Users/you/platform-api
Previewing project assembly…
? Confirm project "platform-api" with role "service" [Y/n]
Streaming audit events…
✓ 3 critical findings
✓ 2 remediations queued

$ ian deploy . --env staging
Reusing stored project assembly for acme-platform
Deploying infrastructure
Deploying service
Deploying frontend
✓ Deployment healthy

MCP

Bring IAN into your coding agent.

The local MCP server exposes organization listing, project assembly preview and commit, audits, deploys, action approvals, Hermes-backed summaries, and auth status as standard tools and resources.

ian mcp server
ian mcp install
ian mcp doctor

Built-in v1 integrations

Codex

Claude Code

Cursor

Manual JSON config

Tool surface

`ian_orgs_list`, `ian_project_assembly_preview`, `ian_project_assembly_commit`, `ian_audit_run`, `ian_audit_status`, `ian_actions_list`, `ian_action_approve`, `ian_action_reject`, `ian_deploy_run`, `ian_deploy_status`, `ian_assistant_chat`, and `ian_auth_status`.

Skill

Install the IAN setup skill for agents.

The repo-hosted skill teaches external coding agents how to install the CLI, run auth, install MCP, verify the setup with `ian doctor`, and use the folder-aware audit and deploy flow.

npx skills add iancloud/ian-cli
/ian-cli

Use the skill when you want an agent to bootstrap the local toolchain rather than manually editing agent MCP config files or guessing the correct CLI flow.

API

Stable CLI-facing endpoints.

Auth

POST /api/v1/cli/auth/sessions
POST /api/v1/cli/auth/token
POST /api/v1/cli/auth/refresh
GET /api/v1/cli/auth/status
POST /api/v1/cli/auth/revoke

Project assembly

POST /api/v1/cli/project_assemblies/preview
POST /api/v1/cli/project_assemblies/commit

Operations

POST /api/v1/cli/audits
GET /api/v1/cli/audits/:id
POST /api/v1/cli/deployments
GET /api/v1/cli/deployments/:id
GET /api/v1/cli/operations/:id/events

Actions and assistant

GET /api/v1/cli/actions
POST /api/v1/cli/actions/:id/approve
POST /api/v1/cli/actions/:id/reject
POST /api/v1/assistant/chat

FAQ

Practical answers for the first run.

Can I run `ian audit .` inside a single repo?

Yes. The CLI treats the current git repo as a single-repo project candidate, previews the mapping, and then runs the audit once confirmed.

Can I point it at a monorepo workspace?

Yes. If multiple nested repos are detected, the CLI proposes an assembly with inferred roles and deploy order before creating or updating the IAN project mapping.

Do I need browser auth?

No. Browser auth is the default for interactive use, but personal access tokens are supported for CI and non-interactive automation.

Does MCP require copy-paste?

No. Once the MCP server is installed, supported agents can call the CLI-backed tools directly and inspect the latest org, audit, and deployment resources.

What happens if a repo role is unsupported?

Preview fails clearly before deploy. The CLI does not fake healthy status for unsupported deployment branches.