Rust CLI reference
The griot executable is built from cli/griot. A nonpublishing CI run passed native build, tests, smoke, archive creation, and checksum verification for Linux x86-64, macOS Apple Silicon, and Windows x86-64. This does not certify older Linux distributions or additional architectures. No signed or published download exists. Build and connect it from a matching source checkout.
Commands
| Command family | Purpose |
|---|---|
griot auth status/login |
Show endpoint/profile without token; or request and verify a real email magic link, storing a session in the selected keychain or private file. |
griot operations [--resource NAME] |
Inspect compiled public operation IDs. |
griot call ID |
Invoke a declared public operation with --param, --query, --body/--file, --upload, or --download. |
griot resource NAME ACTION |
Resource/action spelling resolved from the same manifest; list falls back to enumerate. |
griot tables list/get/create |
Existing governed dataset list/get; explicit create from bucket bytes requires integrated catalog contract and a human session. |
griot buckets list/get/create, buckets files upload |
Bucket metadata and file upload, gated by the catalog feature manifest. |
griot workspace members invite |
Invite through the public tenant operation. |
| `griot jobs | runs |
griot governance RESOURCE ACTION, griot sharing RESOURCE ACTION, `griot workspace members |
roles ACTION` |
--all requires an operation with declared limit and offset query parameters and an items response; it is capped at 100 pages of up to 200 items. Mutating DELETE/PATCH/PUT calls require --yes. Downloads refuse to overwrite existing files. JSON writes to stdout, diagnostics to stderr. Exit codes: 0 success, 2 argument/contract, 3 auth, 4 resource/conflict/validation/throttling, 5 network/server/response.
Use GRIOT_API_URL, GRIOT_TOKEN, and (for a gpat_ PAT) GRIOT_TENANT_ID, or use griot auth login with an email magic link. --workspace is a server-validated login hint, not an authority header. gak_ is MCP-only. The CLI refuses known one-time secret-issuing operations to avoid printing secrets and redacts recognized secret fields in responses. There is no OAuth device/browser login, published cross-platform release, or folder-recursive upload yet.