orithos-cli 0.1.0__tar.gz

orithos_cli-0.1.0/MANIFEST.in

@@ -0,0 +1,5 @@
+# Exclude macOS/exfat junk and build artifacts from sdists.
+global-exclude ._*
+global-exclude .DS_Store
+global-exclude *.py[cod]
+global-exclude __pycache__/*

orithos_cli-0.1.0/PKG-INFO

@@ -0,0 +1,99 @@
+Metadata-Version: 2.4
+Name: orithos-cli
+Version: 0.1.0
+Summary: Orithos CLI — AI agent security testing from the terminal: scan deployed agents, MCP servers, and skill/plugin artifacts.
+Author: Orithos
+License: Proprietary
+Project-URL: Homepage, https://orithos.com
+Project-URL: Documentation, https://orithos.com/docs
+Project-URL: Repository, https://github.com/nishkmg/TraceShield
+Keywords: ai-security,agent-security,red-team,mcp,llm,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Requires-Dist: click>=8.1.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: pydantic>=2.0.0
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: pytest-mock>=3.14.0; extra == "dev"
+Requires-Dist: types-PyYAML>=6.0; extra == "dev"
+
+# Orithos CLI
+
+AI agent security testing from the terminal. Scan deployed agents and MCP
+servers against the Orithos probe catalog, vet skill/plugin artifacts before
+they run, and pull findings, compliance reports, and evidence packages — all
+from the command line.
+
+## Install
+
+```bash
+pip install orithos-cli
+```
+
+## Quick start
+
+```bash
+# Point the CLI at your Orithos account (or use ORITHOS_API_KEY / ORITHOS_API_URL env vars)
+orithos configure
+
+# Vet a skill or plugin before installing it — no account needed, fully offline
+orithos skill scan ./some-agent-skill
+
+# Scan a registered agent
+orithos scan run --agent-id <AGENT_ID>
+orithos scan status <SCAN_ID>
+orithos scan findings <SCAN_ID> --format sarif
+```
+
+## `orithos skill scan`
+
+Static vetting for agent skills, plugins, and MCP packages. Runs offline with
+zero outbound calls; archives (zip/tar.gz) are unpacked with traversal
+protection.
+
+```bash
+orithos skill scan <path|url> [--format text|json|sarif] [--fail-on critical|high|medium|low]
+```
+
+Seven check classes: manifest hygiene · declared-vs-implied permissions ·
+outbound destinations (exfil-prone endpoints, IP literals) · shell & install
+hooks · credential access · obfuscation · known-bad signatures. Every finding
+cites file, line, and evidence.
+
+Exit codes: `0` clean · `1` findings at/above `--fail-on` (default `high`) ·
+`2` error — ready for CI gates.
+
+## Commands
+
+- `orithos agent ...` — register and manage agent endpoints
+- `orithos scan ...` — run scans, fetch findings (`summary`/`json`/`sarif`/`junit`)
+- `orithos skill scan ...` — static skill/plugin vetting
+- `orithos mcp ...` — interact with the Orithos MCP policy server
+- `orithos compliance ...` — compliance mappings and reports
+- `orithos verify <package>` — offline evidence-package integrity check (hashes + Merkle root)
+- `orithos connection / discovery / graph / guardrail / probes / remediation / runtime ...` — platform workflows
+
+## Environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ORITHOS_API_KEY` | — | API key (`tsk_...`); overrides the config file |
+| `ORITHOS_API_URL` | `https://api.orithos.com` | API base URL |
+| `ORITHOS_ORG_ID` | — | Organisation ID (optional override) |
+| `ORITHOS_TIMEOUT` | `30` | Request timeout in seconds |
+
+## Development
+
+```bash
+pip install -e "apps/cli[dev]"
+pytest -q
+```

orithos_cli-0.1.0/README.md

@@ -0,0 +1,71 @@
+# Orithos CLI
+
+AI agent security testing from the terminal. Scan deployed agents and MCP
+servers against the Orithos probe catalog, vet skill/plugin artifacts before
+they run, and pull findings, compliance reports, and evidence packages — all
+from the command line.
+
+## Install
+
+```bash
+pip install orithos-cli
+```
+
+## Quick start
+
+```bash
+# Point the CLI at your Orithos account (or use ORITHOS_API_KEY / ORITHOS_API_URL env vars)
+orithos configure
+
+# Vet a skill or plugin before installing it — no account needed, fully offline
+orithos skill scan ./some-agent-skill
+
+# Scan a registered agent
+orithos scan run --agent-id <AGENT_ID>
+orithos scan status <SCAN_ID>
+orithos scan findings <SCAN_ID> --format sarif
+```
+
+## `orithos skill scan`
+
+Static vetting for agent skills, plugins, and MCP packages. Runs offline with
+zero outbound calls; archives (zip/tar.gz) are unpacked with traversal
+protection.
+
+```bash
+orithos skill scan <path|url> [--format text|json|sarif] [--fail-on critical|high|medium|low]
+```
+
+Seven check classes: manifest hygiene · declared-vs-implied permissions ·
+outbound destinations (exfil-prone endpoints, IP literals) · shell & install
+hooks · credential access · obfuscation · known-bad signatures. Every finding
+cites file, line, and evidence.
+
+Exit codes: `0` clean · `1` findings at/above `--fail-on` (default `high`) ·
+`2` error — ready for CI gates.
+
+## Commands
+
+- `orithos agent ...` — register and manage agent endpoints
+- `orithos scan ...` — run scans, fetch findings (`summary`/`json`/`sarif`/`junit`)
+- `orithos skill scan ...` — static skill/plugin vetting
+- `orithos mcp ...` — interact with the Orithos MCP policy server
+- `orithos compliance ...` — compliance mappings and reports
+- `orithos verify <package>` — offline evidence-package integrity check (hashes + Merkle root)
+- `orithos connection / discovery / graph / guardrail / probes / remediation / runtime ...` — platform workflows
+
+## Environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ORITHOS_API_KEY` | — | API key (`tsk_...`); overrides the config file |
+| `ORITHOS_API_URL` | `https://api.orithos.com` | API base URL |
+| `ORITHOS_ORG_ID` | — | Organisation ID (optional override) |
+| `ORITHOS_TIMEOUT` | `30` | Request timeout in seconds |
+
+## Development
+
+```bash
+pip install -e "apps/cli[dev]"
+pytest -q
+```

orithos_cli-0.1.0/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "orithos-cli"
+version = "0.1.0"
+description = "Orithos CLI — AI agent security testing from the terminal: scan deployed agents, MCP servers, and skill/plugin artifacts."
+readme = "README.md"
+requires-python = ">=3.12"
+license = {text = "Proprietary"}
+authors = [{ name = "Orithos" }]
+keywords = ["ai-security", "agent-security", "red-team", "mcp", "llm", "security"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Intended Audience :: Information Technology",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Security",
+]
+dependencies = [
+    "click>=8.1.0",
+    "httpx>=0.27.0",
+    "pydantic>=2.0.0",
+    "pyyaml>=6.0",
+]
+
+[project.urls]
+Homepage = "https://orithos.com"
+Documentation = "https://orithos.com/docs"
+Repository = "https://github.com/nishkmg/TraceShield"
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0.0",
+    "pytest-mock>=3.14.0",
+    "types-PyYAML>=6.0",
+]
+
+[project.scripts]
+orithos = "orithos_cli.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["orithos_cli*"]

orithos_cli-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

orithos_cli-0.1.0/src/orithos_cli/__init__.py

@@ -0,0 +1,6 @@
+"""Orithos CLI — AI Agent Security Testing Platform."""
+
+from orithos_cli.cli import main
+
+__version__ = "0.1.0"
+__all__ = ["main"]

orithos_cli-0.1.0/src/orithos_cli/agent.py

@@ -0,0 +1,78 @@
+"""Agent management subcommands for Orithos CLI."""
+
+from __future__ import annotations
+
+import httpx
+import click
+
+from orithos_cli.config import get_config
+
+
+@click.group(name="agent")
+def agent_group() -> None:
+    """Manage Orithos agents."""
+    pass
+
+
+@agent_group.command("new")
+@click.option("--name", default="", help="Agent name (omit for interactive wizard)")
+def new_agent(name: str) -> None:
+    """Interactive agent setup — configure identity, prompt, tools, memory, guardrails."""
+    from orithos_cli.agent_wizard import interactive_agent_wizard
+
+    interactive_agent_wizard()
+
+
+@agent_group.command("create")
+@click.option("--name", default="", help="Agent name (omit for interactive wizard)")
+def create_agent(name: str) -> None:
+    """Create a new agent — interactive wizard by default."""
+    from orithos_cli.agent_wizard import interactive_agent_wizard
+
+    interactive_agent_wizard()
+
+
+@agent_group.command("list")
+def list_agents() -> None:
+    """List all registered agents."""
+    cfg = get_config()
+
+    try:
+        response = httpx.get(
+            f"{cfg.api_url}/v1/agents",
+            headers=cfg.auth_headers(),
+            timeout=cfg.timeout,
+        )
+        response.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    except httpx.RequestError as exc:
+        click.echo(f"Connection error: {exc}", err=True)
+        raise SystemExit(1)
+
+    agents = response.json()
+    if not agents:
+        click.echo("No agents found.")
+        return
+
+    for agent in agents:
+        click.echo(f"[{agent['id']}] {agent['name']} — {agent['endpoint_url']}")
+
+
+@agent_group.command("delete")
+@click.argument("agent-id")
+def delete_agent(agent_id: str) -> None:
+    """Delete an agent by ID."""
+    cfg = get_config()
+    try:
+        response = httpx.delete(
+            f"{cfg.api_url}/v1/agents/{agent_id}",
+            headers=cfg.auth_headers(),
+            timeout=cfg.timeout,
+        )
+        response.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    click.echo(f"Agent {agent_id[:8]} deleted.")

orithos_cli-0.1.0/src/orithos_cli/agent_wizard.py

@@ -0,0 +1,255 @@
+"""Interactive agent wizard for Orithos CLI — 5 steps matching dashboard."""
+
+from __future__ import annotations
+
+import json
+import httpx
+import click
+
+from orithos_cli.config import get_config, fmt_http_error
+
+
+def _s(text: str = "", fg: str | None = None, dim: bool = False, bold: bool = False) -> str:
+    return click.style(text, fg=fg, dim=dim, bold=bold)
+
+
+PROVIDER_OPTIONS = [
+    ("Pinecone", "Pinecone", "Vector database"),
+    ("Weaviate", "Weaviate", "Vector database"),
+    ("Chroma", "Chroma", "Vector database"),
+    ("Milvus", "Milvus", "Vector database"),
+    ("Qdrant", "Qdrant", "Vector database"),
+    ("Pgvector", "Pgvector", "PostgreSQL vector extension"),
+]
+
+RAG_TYPE_OPTIONS = [
+    ("Vector Database", "Vector Database", "Embedding-based retrieval"),
+    ("Document Store", "Document Store", "Raw document storage"),
+    ("Knowledge Graph", "Knowledge Graph", "Graph-based retrieval"),
+]
+
+GUARDRAIL_PROVIDERS = [
+    ("NVIDIA NeMo Guardrails", "NeMo Guardrails", "NeMo"),
+    ("Llama Guard", "Llama Guard", "Meta safety model"),
+    ("Custom Classifier", "Custom Classifier", "Custom classifier endpoint"),
+    ("OpenAI Moderation", "OpenAI Moderation", "OpenAI moderation API"),
+]
+
+STAGE_OPTIONS = [
+    ("pre", "Pre", "Before agent inference"),
+    ("post", "Post", "After agent response"),
+    ("both", "Both", "Pre and post"),
+]
+
+TOOL_PARAM_TYPES = ["string", "number", "integer", "boolean", "object", "array"]
+
+
+def _pick(options: list[tuple[str, str, str]], prompt: str, default: int = 1) -> str:
+    for i, (_, label, desc) in enumerate(options, 1):
+        click.echo(f"  [{i}] {_s(label, bold=True)} \u2014 {_s(desc, dim=True)}")
+    choice = click.prompt(prompt, type=int, default=default)
+    if choice < 1 or choice > len(options):
+        choice = default
+    return options[choice - 1][0]
+
+
+def _confirm(prompt: str, default: bool = True) -> bool:
+    return click.confirm(_s(prompt, dim=True), default=default)
+
+
+def _risk_class(name: str, desc: str) -> str:
+    low = (name + " " + desc).lower()
+    critical_kw = ["refund", "payment", "transfer", "charge", "delete", "remove", "purge",
+                   "destroy", "create_user", "add_user", "grant", "elevate", "permission"]
+    write_kw = critical_kw + ["send", "message", "email", "notify", "write", "create",
+                               "update", "post", "admin", "access", "install", "deploy"]
+    if any(w in low for w in critical_kw):
+        return "write"
+    if any(w in low for w in write_kw):
+        return "write"
+    return "read"
+
+
+def interactive_agent_wizard() -> None:
+    cfg = get_config()
+
+    click.echo()
+    click.echo(_s("\u2726 Orithos Agent Wizard", fg="green", bold=True))
+    click.echo(_s("  Configure your agent step by step.", dim=True))
+    click.echo()
+
+    # === Step 1: Identity ===
+    click.echo(_s("Step 1/5: Identity", fg="green"))
+    name = click.prompt("  Agent name", default="")
+    if not name:
+        click.echo(_s("  Agent name is required.", fg="red"))
+        raise SystemExit(1)
+    version = click.prompt("  Version", default="1.0")
+    description = click.prompt("  Description", default="")
+    click.echo()
+
+    # === Step 2: System Prompt ===
+    click.echo(_s("Step 2/5: System Prompt", fg="green"))
+    click.echo(_s("  Paste the system prompt. Enter '.' on a blank line to finish.", dim=True))
+    lines: list[str] = []
+    while True:
+        line = input()
+        if line == ".":
+            break
+        lines.append(line)
+    system_prompt = "\n".join(lines).strip()
+
+    if system_prompt:
+        click.echo(_s("  Analysing prompt...", dim=True), nl=False)
+        try:
+            ar = httpx.post(
+                f"{cfg.api_url}/v1/agents/analyze-prompt",
+                json={"text": system_prompt},
+                headers=cfg.auth_headers(),
+                timeout=30,
+            )
+            if ar.status_code == 200:
+                analysis = ar.json()
+                constraints = analysis.get("constraints_count", 0)
+                identifiers = analysis.get("identifiers_count", 0)
+                probes = analysis.get("summary", {}).get("estimated_total_probes", 0)
+                leakage = analysis.get("leakage_risk", "low")
+                click.echo(_s(f" \u2713", fg="green"))
+                click.echo(_s(f"  \u21b3 {constraints} constraints \u00b7 {identifiers} identifiers \u00b7 ~{probes} probes \u00b7 leakage: {leakage}", dim=True))
+            else:
+                click.echo(_s(" \u2716 (analysis unavailable)", fg="yellow"))
+        except httpx.RequestError:
+            click.echo(_s(" \u2716 (analysis unavailable)", fg="yellow"))
+    click.echo()
+
+    # === Step 3: Tools ===
+    click.echo(_s("Step 3/5: Tools (optional)", fg="green"))
+    tools: list[dict] = []
+    if _confirm("  Add tools?"):
+        while True:
+            t_name = click.prompt("    Tool name", default="")
+            if not t_name:
+                break
+            t_desc = click.prompt("    Description", default="")
+            params: list[dict] = []
+            click.echo(_s("    Parameters (enter blank name to stop):", dim=True))
+            pi = 1
+            while True:
+                p_name = click.prompt(f"      param {pi} name", default="")
+                if not p_name:
+                    break
+                p_type = click.prompt(f"      param {pi} type", type=click.Choice(TOOL_PARAM_TYPES), default="string", show_choices=False)
+                params.append({"name": p_name, "type": p_type})
+                pi += 1
+
+            access = _risk_class(t_name, t_desc)
+            tools.append({
+                "name": t_name,
+                "description": t_desc,
+                "parameters": params,
+                "access_level": access,
+            })
+            click.echo(f"    Risk: {_s(access, dim=True)}")
+            if not _confirm("    Add another tool?", default=False):
+                break
+    click.echo()
+
+    # === Step 4: Memory & Guardrails ===
+    click.echo(_s("Step 4/5: Memory & Guardrails (optional)", fg="green"))
+    memory_sources: list[dict] = []
+    guardrails: list[dict] = []
+
+    if _confirm("  Add RAG source?"):
+        while True:
+            rag_name = click.prompt("    Source name", default="knowledge-base")
+            rag_provider = _pick(PROVIDER_OPTIONS, "    Provider")
+            rag_type = _pick(RAG_TYPE_OPTIONS, "    Type", default=1)
+            rag_docs = click.prompt("    Document count", type=int, default=0)
+            memory_sources.append({
+                "name": rag_name,
+                "type": rag_type,
+                "provider": rag_provider,
+                "doc_count": rag_docs,
+                "risk": "supply_chain",
+            })
+            if not _confirm("    Add another RAG source?", default=False):
+                break
+
+    if _confirm("  Add guardrail?"):
+        while True:
+            g_name = click.prompt("    Guardrail name", default="")
+            g_provider = _pick(GUARDRAIL_PROVIDERS, "    Provider")
+            g_stage = _pick(STAGE_OPTIONS, "    Stage")
+            guardrails.append({
+                "name": g_name,
+                "type": g_provider,
+                "stage": g_stage,
+                "enabled": True,
+            })
+            if not _confirm("    Add another guardrail?", default=False):
+                break
+    click.echo()
+
+    # === Step 5: Confirm & Save ===
+    click.echo(_s("Step 5/5: Confirm & Save", fg="green"))
+    tool_count = len(tools)
+    tool_names = ", ".join(t.get("name", "?") for t in tools[:3])
+    if tool_count > 3:
+        tool_names += f" +{tool_count - 3} more"
+    prompt_preview = system_prompt[:60].replace("\n", "\\n") + ("..." if len(system_prompt) > 60 else "")
+    prompt_tokens = max(1, len(system_prompt) // 4)
+
+    click.echo(_s("\u250c" + "\u2500" * 47 + "\u2510", dim=True))
+    for line in [
+        f" Name:        {name}",
+        f" Version:     {version}",
+        f" Description: {description[:40] or '(none)'}",
+        f" Prompt:      {prompt_tokens} tokens",
+        f" Tools:       {tool_names or 'none'}",
+        f" RAG sources: {len(memory_sources)}",
+        f" Guardrails:  {len(guardrails)}",
+    ]:
+        click.echo(_s(f"\u2502 {line:<45}\u2502", dim=True))
+    click.echo(_s("\u2514" + "\u2500" * 47 + "\u2518", dim=True))
+    click.echo()
+
+    if not _confirm("  Save agent?", default=True):
+        click.echo(_s("  Cancelled.", fg="yellow"))
+        return
+
+    payload: dict = {
+        "name": name,
+        "version": version,
+        "endpoint_url": "",
+    }
+    if description:
+        payload["description"] = description
+    if system_prompt:
+        payload["system_prompt"] = system_prompt
+    if tools:
+        payload["tools_config"] = tools
+    if memory_sources:
+        payload["memory_sources"] = memory_sources
+    if guardrails:
+        payload["guardrails"] = guardrails
+
+    try:
+        r = httpx.post(
+            f"{cfg.api_url}/v1/agents",
+            json=payload,
+            headers=cfg.auth_headers(),
+            timeout=cfg.timeout,
+        )
+        r.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(_s(f"Error creating agent: {fmt_http_error(exc)}", fg="red"), err=True)
+        raise SystemExit(1)
+    except httpx.RequestError as exc:
+        click.echo(_s(f"Connection error: {exc}", fg="red"), err=True)
+        raise SystemExit(1)
+
+    data = r.json()
+    aid = data.get("id", "?")[:8]
+    click.echo(_s(f"\u2726 Agent created: {aid}", fg="green", bold=True))
+    click.echo(_s(f"  Name: {data.get('name', '?')}", dim=True))
+    click.echo(_s(f"  Tools: {len(tools)}  RAG: {len(memory_sources)}  Guardrails: {len(guardrails)}", dim=True))

orithos_cli-0.1.0/src/orithos_cli/auth.py

@@ -0,0 +1,21 @@
+"""Authentication and request signing utilities for Orithos CLI."""
+
+import os
+import hmac
+import hashlib
+import time
+
+
+def sign_request(method: str, path: str, body: bytes = b"") -> dict:
+    """Add HMAC-SHA256 signature headers to a request."""
+    key = os.environ.get("TRACESHIELD_REQUEST_SIGNING_KEY", "")
+    if not key:
+        return {}  # No signing in dev mode
+
+    timestamp = int(time.time())
+    payload = f"{timestamp}.{method}.{path}.{hashlib.sha256(body).hexdigest()}".encode()
+    signature = hmac.new(key.encode(), payload, hashlib.sha256).hexdigest()
+    return {
+        "X-Orithos-Timestamp": str(timestamp),
+        "X-Orithos-Signature": f"t={timestamp},v1={signature}",
+    }

orithos_cli-0.1.0/src/orithos_cli/cli.py

@@ -0,0 +1,82 @@
+"""Orithos CLI — main entry point."""
+
+import click
+
+from orithos_cli.configure import configure
+from orithos_cli.agent import agent_group
+from orithos_cli.compliance import compliance_group
+from orithos_cli.connection import connection_group
+from orithos_cli.discovery import discovery_group
+from orithos_cli.graph import graph_group
+from orithos_cli.guardrail import guardrail_group
+from orithos_cli.mcp import mcp_group
+from orithos_cli.probes import probes_group
+from orithos_cli.remediation import remediation_group
+from orithos_cli.runtime import alerting_group, runtime_group
+from orithos_cli.scan import scan_group
+from orithos_cli.skill import skill_group
+from orithos_cli.template import template_group
+from orithos_cli.verify import verify_package_file
+
+
+@click.group()
+@click.version_option(version="0.1.0", prog_name="orithos")
+def main() -> None:
+    """Orithos CLI — AI Agent Security Testing Platform.
+
+    Quick start: orithos configure
+
+    Environment variables (override config file):
+    ORITHOS_API_KEY     API key (tsk_...)
+    ORITHOS_API_URL     API base URL (overrides default https://api.orithos.com)
+    ORITHOS_ORG_ID      Organisation ID (optional override)
+    ORITHOS_TIMEOUT     Request timeout in seconds (default: 30)
+    """
+    pass
+
+
+@main.command("verify")
+@click.argument("package_file", type=click.Path(exists=True, dir_okay=False))
+def verify_cmd(package_file: str) -> None:
+    """Verify an evidence package offline (hashes + Merkle root).
+
+    Recomputes every artifact hash and the Merkle root from the package
+    content and compares against the declared manifest. No network access,
+    no Orithos contact — independent verifiability for auditors.
+    """
+    from pathlib import Path
+
+    result = verify_package_file(Path(package_file))
+    if result["ok"]:
+        click.echo("OK — package integrity verified")
+    else:
+        click.echo("FAIL — package integrity check failed")
+        for err in result["errors"]:
+            click.echo(f"  - {err}")
+    for art in result.get("artifacts", []):
+        click.echo(f"  {art['name']}: {art['sha256'][:16]}…")
+    if result.get("merkle_root"):
+        click.echo(f"  merkle root: {result['merkle_root'][:16]}…")
+    if not result["ok"]:
+        raise SystemExit(1)
+
+
+main.add_command(configure)
+main.add_command(agent_group)
+main.add_command(scan_group)
+main.add_command(remediation_group)
+main.add_command(guardrail_group)
+main.add_command(graph_group)
+main.add_command(runtime_group)
+main.add_command(alerting_group)
+main.add_command(discovery_group)
+main.add_command(connection_group)
+main.add_command(template_group)
+main.add_command(probes_group)
+main.add_command(compliance_group)
+main.add_command(mcp_group)
+main.add_command(skill_group)
+
+
+if __name__ == "__main__":
+    main()