AiAx CLI
AiAx CLI connects a supported agent client to your organization's Company Brain endpoint. It never prints bearer tokens and it grants no direct write access. Reads stay access controlled, and proposed changes still go to the AiAx approval inbox.
Installing
The source package is named @aiax/cli and installs the aiax binary.
We withhold the customer facing install command until the package has a verified registry receipt. Connect AiAx shows the exact command once that release gate passes. We would rather publish nothing than a command that installs the wrong thing.
Setup rejects temporary one shot runners, because a desktop client must not depend on a package cache that can be cleared.
AiAx CLI supports macOS and Linux. On Windows, login fails before the browser authorization starts, so an unsupported machine never mints a server credential it could then lose. We will not call the package Windows ready until it has a platform backed credential store we have tested.
Commands
aiax auth login
aiax auth status
aiax auth logout
aiax setup claude-code
aiax connect claude-code --dry-run
aiax connect cursor
aiax connect openclaw
aiax doctor [claude-code|cursor|openclaw]aiax setup <client> is the path to use. It opens login only when needed, asks before it updates the client's configuration, and finishes with a remote doctor check. It never passes an automatic yes flag.
The lower level auth, connect and doctor commands are still there for automation and troubleshooting.
- aiax auth login
- Opens a browser screen where an owner or an administrator has to approve. The exchange uses SHA-256 PKCE and a short lived, state bound one time code, and issues the employee viewer tier by default. The token expires after 90 days.
- aiax auth status
- Reports whether a credential is present and valid, without printing it.
- aiax auth logout
- Removes the stored credential from this machine.
- aiax setup <client>
- The full path for one client: sign in if needed, ask before writing the client configuration, then verify.
- aiax connect <client>
- Writes the client configuration only. Pass --dry-run to print what it would change and write nothing.
- aiax doctor [client]
- Verifies the launcher paths and runs an authenticated, read-only initialization and capability check against the endpoint, without printing the token.
Where credentials live
Credentials are stored in a private directory with owner only files. On macOS and Linux that is the aiax directory under your user configuration directory.
The client configuration never embeds the token. Claude Code, Cursor and OpenClaw start the local bridge from an absolute path. That bridge reads the private credential and connects to the AiAx endpoint over HTTPS using the official MCP SDK. Absolute executable and script paths keep the connection independent of whatever environment a desktop application happens to inherit.