CLI & MCP
Read and manage your keys from the terminal, and give AI agents safe, metadata-only access.
Early access: the fally CLI and fally-mcp server aren't on the public npm registry yet. The commands and tools below are the current interface.
CLI
Point it at the hosted app
By default the CLI talks to http://localhost:3000. For the hosted app, set the API URL once (or pass --api-url on any command):
export FALLY_API_URL=https://app.getfally.comSign in
fally auth login prompts for your email and password, stores a token in ~/.fally/config.json, and mints a matching MCP token. Tokens are bound to a single project and expire after 7 days.
fally auth loginCommands
| Command | What it does |
|---|---|
fally auth login | Sign in; stores a token in ~/.fally/config.json |
fally auth logout | Revoke your stored tokens and clear the config |
fally whoami | Show your user, organization, project, role, and plan |
fally projects | List the projects you can open |
fally secrets list | List and search key metadata (never values) |
fally secrets get <name> | Show one key's metadata |
fally secrets reveal <name> | Print a value to stdout (audited) |
fally secrets copy <name> | Copy a value to your clipboard (audited) |
fally secrets create | Create a key (name, vendor, purpose, owner, env, value) |
fally secrets rotate <name> | Replace a key's stored value |
fally secrets transfer <name> --owner <email> | Hand a key to a new owner |
fally secrets archive / restore <name> | Hide a key from the default list, or bring it back |
fally secrets delete <name> | Permanently delete an archived key |
fally pack --env <env> | Copy an .env-style pack for a whole environment |
On the Free plan, creating and rotating keys from the CLI is a Team feature — reveal, copy, list, get, and pack still work on Free.
CI & automation
Skip the interactive login by setting FALLY_TOKEN to a token you mint under Tokens in the app (or with fally auth tokens):
export FALLY_API_URL=https://app.getfally.com
export FALLY_TOKEN=fldr_...
fally secrets listMCP
The fally-mcp server lets AI agents read your key metadata over the Model Context Protocol. By default agents get metadata only — revealing actual values is off until a project admin turns on “Allow MCP reveal.”
Tools
| Tool | What it does |
|---|---|
list_secrets | List key metadata, filtered by team, env, or vendor. Never returns values. |
search_secrets | Search key metadata by name, vendor, purpose, or owner. |
get_secret_metadata | Fetch one key's metadata by id or exact name. |
reveal_secret | Reveal a value — off until a project admin enables “Allow MCP reveal”, and audited. |
Running it
fally-mcp runs over stdio and authenticates with the MCP-scoped token that fally auth login created (or FALLY_MCP_TOKEN). Point it at the same server with FALLY_API_URL.
Scope: the MCP token can only read metadata and call reveal — it can't create, rotate, delete, or mint a wider token.