Rust CLI reference

The griot executable is built from cli/griot. A nonpublishing CI run passed native build, tests, smoke, archive creation, and checksum verification for Linux x86-64, macOS Apple Silicon, and Windows x86-64. This does not certify older Linux distributions or additional architectures. No signed or published download exists. Build and connect it from a matching source checkout.

Commands

Command family Purpose
griot auth status/login Show endpoint/profile without token; or request and verify a real email magic link, storing a session in the selected keychain or private file.
griot operations [--resource NAME] Inspect compiled public operation IDs.
griot call ID Invoke a declared public operation with --param, --query, --body/--file, --upload, or --download.
griot resource NAME ACTION Resource/action spelling resolved from the same manifest; list falls back to enumerate.
griot tables list/get/create Existing governed dataset list/get; explicit create from bucket bytes requires integrated catalog contract and a human session.
griot buckets list/get/create, buckets files upload Bucket metadata and file upload, gated by the catalog feature manifest.
griot workspace members invite Invite through the public tenant operation.
`griot jobs runs
griot governance RESOURCE ACTION, griot sharing RESOURCE ACTION, `griot workspace members roles ACTION`

--all requires an operation with declared limit and offset query parameters and an items response; it is capped at 100 pages of up to 200 items. Mutating DELETE/PATCH/PUT calls require --yes. Downloads refuse to overwrite existing files. JSON writes to stdout, diagnostics to stderr. Exit codes: 0 success, 2 argument/contract, 3 auth, 4 resource/conflict/validation/throttling, 5 network/server/response.

Use GRIOT_API_URL, GRIOT_TOKEN, and (for a gpat_ PAT) GRIOT_TENANT_ID, or use griot auth login with an email magic link. --workspace is a server-validated login hint, not an authority header. gak_ is MCP-only. The CLI refuses known one-time secret-issuing operations to avoid printing secrets and redacts recognized secret fields in responses. There is no OAuth device/browser login, published cross-platform release, or folder-recursive upload yet.