CLI

The sentisec command pairs this machine with your workspace, reports what it is connected to, runs an end-to-end demo, and manages subscription mode. You do not need an API key first — sentisec login mints and pairs one for you.

The Python install paths need Python 3.11, 3.12, 3.13, or 3.14 on your PATH.

Install

Three paths, all landing the same sentisec command. If you plan to use subscription mode — which runs a small background service on your machine — use pipx: it installs the command and everything that service needs in one isolated step.

pipx (recommended)

pipx puts the CLI in its own virtual environment and the sentisec command on your PATH.

brew install pipx
pipx ensurepath
pipx install sentisec-sdk

sudo apt update && sudo apt install -y pipx
pipx ensurepath
pipx install sentisec-sdk

python3 -m pip install --user pipx
python3 -m pipx ensurepath
pipx install sentisec-sdk

Bare pip install sentisec-sdk fails with a PEP 668 externally-managed-environment error on most modern Python distributions. pipx is the supported answer; see troubleshooting for a venv fallback.

One-line installer

get.sentisec.ch

curl -fsSL https://get.sentisec.ch | bash

Detects your platform and the python3 on PATH (or SENTISEC_PYTHON), downloads the matching release, and installs sentisec to ~/.local/bin — adding it to your PATH if needed. Every download is checked against the release's SHA-256 manifest before it is unpacked, and the installer aborts rather than install an artifact that does not match.

npm

npm install -g @sentisec/sdk

A postinstall step fetches the native CLI for your platform and puts sentisec on your PATH.

one line, or the package manager you already use

Install Sentisec

The one-line installer end to end, the pipx and npm paths that land the same sentisec command, and the single environment variable that puts your agent behind it.

Verify it worked

sentisec --version

The command prints sentisec followed by your installed version.

Nothing? Walk through first-run problems.

First run

1. Check status

sentisec status

On a fresh install the status view reports the unpaired SDK and unwired edge separately. Follow its next-step command to pair this machine.

2. Pair your workspace

sentisec login

Your browser opens on the dashboard, you confirm which workspace to pair, and the credential lands in ~/.sentisec/credentials.toml. The success message names the workspace and tier and the file written; it never prints the API key.

3. Confirm the pairing

sentisec status

Status reports the SDK pairing, edge wiring, workspace mode, and service health from the facts available. It checks connectivity by default. Use sentisec status --offline for local state only, or sentisec status --json for a machine-readable result. A missing fact is shown as unknown, not as proof of protection.

4. Run the demo

sentisec demo run

Runs a short agent session against your workspace end to end and prints the verdict. This is the fastest way to confirm a new workspace is wired up correctly.

Commands

Command	What it does
`sentisec login`	Pairs this machine with a workspace and writes `~/.sentisec/credentials.toml`.
`sentisec status`	Reports SDK and edge state and checks connectivity. `--offline` skips network checks.
`sentisec demo run`	Runs an end-to-end demo session and prints the verdict.
`sentisec logout`	Deletes the local credentials file.
`sentisec edge`	Guided setup and control for subscription mode.

Pairing on a machine with no browser

On a server, a container, or a CI runner, mint the pair code in the workspace's Settings → Connect subscription setup. Copy its short-lived pairing code and redeem it:

sentisec login --code <code>

Codes are single-use and expire in ten minutes. See authentication for the full flow.

Configuration

The CLI resolves configuration in this order:

Command-line arguments.
SENTISEC_API_KEY and SENTISEC_ENDPOINT in the environment. The API key encodes the workspace, so there is no separate workspace setting.
~/.sentisec/credentials.toml, written by sentisec login.

The endpoint defaults to https://api.sentisec.ch. Point it somewhere else to work against a self-hosted deployment.

Authentication — key format, pairing, and choosing an upstream provider.
Subscription mode — protect Claude Code or Codex with no API key at all.
Python — the same package, used as a library.

Updates / contradictions

2026-09-09 — Replaced retired CLI output and the old --ping instruction with the current status behavior. Version output is described without pinning an old release. Pair codes come from workspace connection setup, not the old CLI setup instructions.