An AI engineer in your terminal
Type hanzo in a repo and you get a coding session. Type hanzo and a noun and you get the rest of the cloud — identity, usage, billing, clusters, machines, networks — typed straight from the API's own document.
Open source (MIT). One static Rust binary — macOS and Linux on amd64 and arm64, Windows on amd64. No runtime, no daemon.
Paste and ship
Paste this into any agent. It reads the skill manifest and calls CLI from there.
What is Hanzo CLI
A resource tree, not a pile of flags
hanzo <resource> <command>. The resources beyond the hand-written ones are generated from the OpenAPI documents, so the CLI can only ask for things the API has.
A coding session, metered
Bare hanzo runs our dev agent with the Hanzo toolset attached and the model calls billed to your organization. Point it at claude or codex instead and it drives an agent you already have.
Run the cloud on your machine
hanzo serve cloud starts the whole API locally, or name one service — iam, kms, gateway, storage, pubsub. hanzo engine serve puts a model on a local endpoint.
No raw-path escape hatch
There is no hanzo api verb and no URL to hand-write. Every cloud capability arrives as a typed subcommand, which is what keeps the CLI and the API from disagreeing.
Capabilities
What the binary carries
Several identities at once
Hold as many principals as you need and switch between them. A second login never clobbers the first, and hanzo auth show says which one is answering right now.
Secrets arrive on stdin
Pass --token - and the credential is read from the pipe, never from argv — so nothing lands in shell history, ps, or a CI log. It is stored in the OS keychain, or an owner-only file where there is none.
A public URL for a local port
hanzo share 3000 publishes a service over the zero-trust fabric while the port stays bound to localhost. Pass --name to keep the same subdomain next time.
Find the secret before the commit
hanzo scan walks a path for exposed credentials and exits non-zero when it finds one, which is what makes it usable as a hook rather than a habit.
The whole cloud, unhealthy first
hanzo status leads with what is broken, then clusters, applications and the machines on your fleet. The thing you needed to know is the first line, not the last.
Put this shell on the fabric
hanzo link publishes the terminal you are in so the console can watch it — or drive it. --read-only when you would rather be watched than typed at.
Get started
Install, sign in, start working
Start building with CLI
One API key. One credit balance. Every primitive.