An AI engineer in your terminal
Type hanzo in a repo and you get a coding session. Type hanzo and a noun and you get the rest of the cloud — identity, usage, billing, clusters, machines, networks — typed straight from the API's own document.
- $hanzo
- >deploy the gateway to staging
- reading the project
- gateway is on staging
curl -fsSL https://hanzo.sh | shExample project. Every name in it is one you would give your own.
Open source (MIT). One static Rust binary — macOS and Linux on amd64 and arm64, Windows on amd64. No runtime, no daemon.
Hanzo CLI · DevelopersA resource tree, not a pile of flags
hanzo <resource> <command>. The resources beyond the hand-written ones are generated from the OpenAPI documents, so the CLI can only ask for things the API has.
hanzo auth login
Sign in. Interactive picker, or name a provider.
01A coding session, metered
Bare hanzo runs our dev agent with the Hanzo toolset attached and the model calls billed to your organization. Point it at claude or codex instead and it drives an agent you already have.
02Run the cloud on your machine
hanzo serve cloud starts the whole API locally, or name one service — iam, kms, gateway, storage, pubsub. hanzo engine serve puts a model on a local endpoint.
03No raw-path escape hatch
There is no hanzo api verb and no URL to hand-write. Every cloud capability arrives as a typed subcommand, which is what keeps the CLI and the API from disagreeing.
Read https://hanzo.ai/skill.md and use Hanzo CLI in my project. Start with: hanzo auth loginAgent promptPaste and ship
Paste this into any agent. It reads the skill manifest and calls CLI from there.
What the binary carries
Capabilities
hanzo auth showSeveral identities at once
Hold as many principals as you need and switch between them. A second login never clobbers the first, and hanzo auth show says which one is answering right now.
--token -Secrets arrive on stdin
Pass --token - and the credential is read from the pipe, never from argv — so nothing lands in shell history, ps, or a CI log. It is stored in the OS keychain, or an owner-only file where there is none.
hanzo share 3000A public URL for a local port
hanzo share 3000 publishes a service over the zero-trust fabric while the port stays bound to localhost. Pass --name to keep the same subdomain next time.
hanzo scanFind the secret before the commit
hanzo scan walks a path for exposed credentials and exits non-zero when it finds one, which is what makes it usable as a hook rather than a habit.
hanzo statusThe whole cloud, unhealthy first
hanzo status leads with what is broken, then clusters, applications and the machines on your fleet. The thing you needed to know is the first line, not the last.
hanzo linkPut this shell on the fabric
hanzo link publishes the terminal you are in so the console can watch it — or drive it. --read-only when you would rather be watched than typed at.
# Install the CLI — the same line Hanzo prints everywhere curl -fsSL https://hanzo.sh | sh npm i -g hanzo
# Sign in. Interactive picker, or name a provider. hanzo auth login
# Bare hanzo IS a coding session in this repo hanzo
# ...or hand it the task and let it run headless hanzo "add rate limiting to the /v1/chat endpoint"
# What did that cost, and what is left hanzo usage summary hanzo billing balance
Get CLI
One CLI for the whole stack
- License:
- Apache-2.0
- ★
- 11 stars
Install once. It comes with you.
A local repo, a CI job, a machine you sshed into, a fix at 2am. Same binary, same identity, same commands.
Install from hanzo.sh