An AI engineer in your terminal
Type hanzo in a repo and you get a coding session. Type hanzo and a noun and you get the rest of the cloud — identity, usage, billing, clusters, machines, networks — typed straight from the API's own document.
Open source (MIT). One static Rust binary — macOS and Linux on amd64 and arm64, Windows on amd64. No runtime, no daemon.
A resource tree, not a pile of flags
hanzo <resource> <command>. The resources beyond the hand-written ones are generated from the OpenAPI documents, so the CLI can only ask for things the API has.
A coding session, metered
Bare hanzo runs our dev agent with the Hanzo toolset attached and the model calls billed to your organization. Point it at claude or codex instead and it drives an agent you already have.
Run the cloud on your machine
hanzo serve cloud starts the whole API locally, or name one service — iam, kms, gateway, storage, pubsub. hanzo engine serve puts a model on a local endpoint.
No raw-path escape hatch
There is no hanzo api verb and no URL to hand-write. Every cloud capability arrives as a typed subcommand, which is what keeps the CLI and the API from disagreeing.
What the binary carries
Several identities at once
Hold as many principals as you need and switch between them. A second login never clobbers the first, and hanzo auth show says which one is answering right now.
Secrets arrive on stdin
Pass --token - and the credential is read from the pipe, never from argv — so nothing lands in shell history, ps, or a CI log. It is stored in the OS keychain, or an owner-only file where there is none.
A public URL for a local port
hanzo share 3000 publishes a service over the zero-trust fabric while the port stays bound to localhost. Pass --name to keep the same subdomain next time.
Find the secret before the commit
hanzo scan walks a path for exposed credentials and exits non-zero when it finds one, which is what makes it usable as a hook rather than a habit.
The whole cloud, unhealthy first
hanzo status leads with what is broken, then clusters, applications and the machines on your fleet. The thing you needed to know is the first line, not the last.
Put this shell on the fabric
hanzo link publishes the terminal you are in so the console can watch it — or drive it. --read-only when you would rather be watched than typed at.
Install, sign in, start working
# Install the CLI — the same line every Hanzo surface prints
curl -fsSL https://hanzo.sh | sh
# Sign in. Interactive picker, or name a provider.
hanzo auth login
# Bare hanzo IS a coding session in this repo
hanzo
# ...or hand it the task and let it run headless
hanzo "add rate limiting to the /v1/chat endpoint"
# What did that cost, and what is left
hanzo usage summary
hanzo billing balanceInstall once. It comes with you.
A local repo, a CI job, a machine you sshed into, a fix at 2am. Same binary, same identity, same commands.