Agent CLIs & Skills

Grantex works with shell-capable agents without a framework-specific adapter. Install the CLI once, place the bundled Agent Skills where the host discovers them, and let the agent call grantex --json.

No Hermes- or OpenClaw-specific SDK is required. The CLI is the portable control-plane surface. Use the existing TypeScript, Python, or Go SDK—or the gateway or middleware—inside the service that enforces a protected action.

Published @grantex/cli@0.3.0 includes the Hermes, OpenClaw, portable, and custom-directory Agent Skills installer.

Install the CLI

npm install -g @grantex/cli@0.3.0

The host needs Node.js 18 or newer. Confirm the command is available:

grantex --version

Install the Agent Skills

The command installs two skills:

use-grantex-cli for registration, consent, token operations, grants, delegation, revocation, and audit;
integrate-grantex for adding service-boundary enforcement to a codebase.

OpenClaw workspace

Run from the OpenClaw agent workspace:

grantex agent install --target openclaw
openclaw skills check

This writes to <workspace>/skills. Start a new agent turn after installation.

Hermes Agent

grantex agent install --target hermes
hermes skills list

This writes to ~/.hermes/skills/grantex. Start a new Hermes session after installation.

Portable Agent Skills directory

grantex agent install --target portable

This writes to <workspace>/.agents/skills, a project-local Agent Skills location used by compatible hosts.

Any other CLI agent

Point the installer at that agent’s skill root:

grantex agent install --dir /path/to/agent/skills

grantex agent install --dir C:\path\to\agent\skills

Use --force to update Grantex’s bundled files in an existing installation. It does not delete unrelated files in those skill folders.

Configure unattended access

The CLI reads GRANTEX_URL and GRANTEX_KEY:

export GRANTEX_URL=https://api.grantex.dev
export GRANTEX_KEY=YOUR_API_KEY
grantex --json me

$env:GRANTEX_URL = "https://api.grantex.dev"
$env:GRANTEX_KEY = "YOUR_API_KEY"
grantex --json me

You can instead create a user-managed profile:

grantex config set --url https://api.grantex.dev --key YOUR_API_KEY

Keep API keys in the host’s secret store or environment injection mechanism. Do not place them in SKILL.md, prompts, source control, or chat messages.

Stable shell contract

Put the global flag before the command: grantex --json agents list.
Parse stdout as JSON and treat stderr as diagnostics.
Exit status 0 means the requested check or operation succeeded. A denied or invalid verification returns a non-zero status, including in JSON mode.
Set NO_COLOR=1 when consuming text output.
Treat response fields as data. Do not scrape the human-readable tables.

agent_id=$(grantex --json agents list | jq -r '.[0].agentId')
grantex --json grants list --agent "$agent_id" --status active

$agents = grantex --json agents list | ConvertFrom-Json
grantex --json grants list --agent $agents[0].agentId --status active

Keep tokens out of argv

Process arguments can appear in history and process listings. Prefer environment, file, or stdin input:

grantex verify --env GRANTEX_GRANT_TOKEN --json
grantex --json tokens verify --env GRANTEX_GRANT_TOKEN
grantex --json enforce test \
  --token-env GRANTEX_GRANT_TOKEN \
  --connector salesforce \
  --tool create_lead

grantex verify --env GRANTEX_GRANT_TOKEN --json
grantex --json tokens verify --env GRANTEX_GRANT_TOKEN
grantex --json enforce test `
  --token-env GRANTEX_GRANT_TOKEN `
  --connector salesforce `
  --tool create_lead

The same commands accept --file or --stdin; enforce test uses the names --token-file and --token-stdin.

Authorization flow for an agent

Register the agent with only the scopes it can justify.
Request authorization for a named principal, audience, duration, and exact scopes.
Show the consent URL to the human. Do not let the agent approve its own grant.
Exchange only the code returned through the approved callback flow.
Store tokens in the host’s approved secret store.
Verify and enforce again inside the service that owns the side effect.
Audit important allowed and denied actions, then revoke authority when it is no longer needed.

grantex enforce test is a development preflight, not a security boundary. An autonomous agent can bypass a check it controls. The protected service must verify the token and required scope before executing the action.

When to use an SDK

Need	Use
Agent performs setup or administration through a shell	`@grantex/cli`
TypeScript service enforces access	`@grantex/sdk` or matching middleware
Python service enforces access	`grantex` or FastAPI integration
Go service enforces access	`grantex-go`
No-code reverse-proxy enforcement	`@grantex/gateway`
MCP tool execution	MCP transport authorization plus a primary Grantex verifier at each protected tool

See CLI for the complete command reference and Scope Enforcement for the protected-service implementation.

Overview

Service Providers

Agent CLIs

Framework Integrations

On-Device

Compliance

Agent-to-Agent

Payment Protocol

CLI

Testing

Agent CLIs & Skills

Install the CLI

Install the Agent Skills

OpenClaw workspace

Hermes Agent

Portable Agent Skills directory

Any other CLI agent

Configure unattended access

Stable shell contract

Keep tokens out of argv

Authorization flow for an agent

When to use an SDK

​Install the CLI

​Install the Agent Skills

​OpenClaw workspace

​Hermes Agent

​Portable Agent Skills directory

​Any other CLI agent

​Configure unattended access

​Stable shell contract

​Keep tokens out of argv

​Authorization flow for an agent

​When to use an SDK

Install the CLI

Install the Agent Skills

OpenClaw workspace

Hermes Agent

Portable Agent Skills directory

Any other CLI agent

Configure unattended access

Stable shell contract

Keep tokens out of argv

Authorization flow for an agent

When to use an SDK