Sakrylle CLI
Sakrylle CLI is a locally-running AI coding agent, built as a fork of OpenAI Codex CLI. It interacts with AI models through a full-screen TUI (terminal user interface), automatically reads and writes local files, executes terminal commands, and runs inside a sandboxed environment to help you with coding, debugging, refactoring, and other development tasks.
- Repository: https://github.com/Ranshen1209/sakrylle-cli
- Binary:
sakrylle(aliasskl) - Platforms: current public installer supports macOS arm64 only; Windows and Linux builds are in development
- License: Apache-2.0
- Console: https://ai1.sakrylle.com
- Tech stack: Rust workspace (~100 crates) + TypeScript wrapper
Sakrylle CLI is an extended fork of Codex CLI, not a drop-in replacement. If you currently use Codex CLI, note the differences in config paths, default provider, and environment variables. See Differences from Codex CLI for details.
Installation
macOS arm64 install
curl -fsSL https://cli.sakrylle.com/install.sh | shThe install script places the binary at ~/.local/bin/sakrylle and creates a skl alias. Requires macOS 12+ on ARM64.
macOS arm64 uninstall
curl -fsSL https://cli.sakrylle.com/uninstall.sh | shLogin and Authentication
Sakrylle CLI supports multiple authentication methods. The default is ChatGPT OAuth (browser-based).
ChatGPT OAuth (default)
sakrylle loginOpens a browser for OAuth authorization. Credentials are saved locally on success.
API Key
printenv SAKRYLLE_API_KEY | sakrylle login --with-api-keyAccess Token
printenv SAKRYLLE_ACCESS_TOKEN | sakrylle login --with-access-tokenDevice Code OIDC
sakrylle login --device-authDisplays a device code and URL in the terminal. Enter the device code in your browser to complete authorization.
Check login status
sakrylle login statusLogout
sakrylle logoutRemoves all locally stored credentials.
Command Overview
| Command | Alias | Description |
|---|---|---|
sakrylle | skl | Launch interactive TUI |
sakrylle exec | sakrylle e | Non-interactive execution |
sakrylle review | -- | Code review (alias for exec review) |
sakrylle login | -- | Authenticate |
sakrylle logout | -- | Remove credentials |
sakrylle mcp | -- | Manage MCP servers |
sakrylle plugin | -- | Manage plugins |
sakrylle resume | -- | Resume interactive session |
sakrylle fork | -- | Fork a session |
sakrylle archive | -- | Archive a session |
sakrylle unarchive | -- | Unarchive a session |
sakrylle apply | sakrylle a | Apply latest diff via git apply |
sakrylle completion | -- | Generate shell completion script |
sakrylle doctor | -- | Diagnose installation issues |
sakrylle sandbox | -- | Run commands in a sandbox |
sakrylle cloud | cloud-tasks | [EXPERIMENTAL] Cloud tasks |
sakrylle app-server | -- | [EXPERIMENTAL] Application server |
sakrylle remote-control | -- | [EXPERIMENTAL] Daemon management |
sakrylle app | -- | Launch desktop app (macOS/Windows) |
sakrylle debug | -- | Debugging tools |
sakrylle features | -- | Feature flag management |
sakrylle mcp-server | -- | Start as MCP server (stdio) |
sakrylle
Launches the full-screen terminal user interface for conversing with an AI model.
sakrylleGlobal Flags
These flags apply to sakrylle and all other commands that launch the TUI (resume, fork, etc.).
| Flag | Short | Description |
|---|---|---|
--config | -c | Path to config file (overrides default ~/.sakrylle-cli/config.toml) |
--enable | -- | Enable a specific feature flag |
--disable | -- | Disable a specific feature flag |
--remote | -- | Connect to a remote app server |
--remote-auth-token-env | -- | Name of env var containing remote auth token |
--model | -m | Model to use |
--oss | -- | Use local OSS model |
--local-provider | -- | Use local model provider |
--profile | -p | Use a specific config profile |
--sandbox | -s | Sandbox mode: read-only, workspace-write, danger-full-access |
--ask-for-approval | -a | Approval policy: untrusted, on-request, never |
--dangerously-bypass-approvals-and-sandbox | --yolo | Skip all approvals and sandbox restrictions (dangerous) |
--dangerously-bypass-hook-trust | -- | Skip hook trust verification |
--cd | -C | Set working directory |
--image | -i | Path to an image file |
--add-dir | -- | Add an extra directory to context |
--search | -- | Enable search |
--no-alt-screen | -- | Do not use alternate screen buffer |
--strict-config | -- | Strict config mode; refuse to start on config errors |
Built-in TUI Commands
Inside the TUI, slash commands are available:
| Command | Description |
|---|---|
/vim | Toggle Vim editing mode |
/theme | Switch custom theme |
/keymap | Customize key bindings |
/copy | Copy latest response to clipboard |
/side | Start a side conversation |
/btw | Quick side conversation |
/plan | Enter Plan mode |
/compact | Manually compact conversation context |
/init | Generate AGENTS.md file |
/ps | View background terminals |
/stop | Stop background terminals |
TUI Keyboard Shortcuts
| Shortcut | Description |
|---|---|
Ctrl+G | Open prompt editor |
Up/Down | Browse draft history |
Ctrl+R | Search prompt history |
Ctrl+O | Copy latest response |
sakrylle exec
Runs in non-interactive mode, passing a prompt directly and returning the result. Suitable for scripts and pipelines.
sakrylle exec "Explain the file structure of the current directory"Flags
| Flag | Short | Description |
|---|---|---|
PROMPT | -- | The prompt to execute (positional argument) |
--image | -i | Path to an image file |
--model | -m | Model to use |
--oss | -- | Use local OSS model |
--sandbox | -s | Sandbox mode |
--profile | -p | Use a specific profile |
--skip-git-repo-check | -- | Skip git repository check |
--ephemeral | -- | Ephemeral mode; do not save session history |
--ignore-user-config | -- | Ignore user-level config |
--ignore-rules | -- | Ignore rule files like AGENTS.md |
--output-schema | -- | Output schema specification |
--color | -- | Color output: always, never, auto |
--json | -- | Output in JSON format |
--output-last-message | -o | Output only the last message |
--strict-config | -- | Strict config mode |
-c / --config | -- | Path to config file |
--yolo | -- | Skip approvals and sandbox |
--dangerously-bypass-hook-trust | -- | Skip hook trust verification |
--cd | -C | Set working directory |
--full-auto | -- | (Deprecated) Fully automatic mode |
Examples
# Simple execution
sakrylle exec "List all TODO comments"
# Specify model
sakrylle exec -m gpt-5.4 "Refactor this function"
# JSON output
sakrylle exec --json "Analyze project dependencies"
# Output last message only
sakrylle exec -o "Read the first 5 lines of README.md"exec resume
sakrylle exec resume [SESSION_ID]| Flag | Description |
|---|---|
SESSION_ID | Session ID to resume (positional argument) |
--last | Resume the most recent session |
--all | List all resumable sessions |
PROMPT | Follow-up prompt |
--image | Path to an image file |
exec review
sakrylle exec review
sakrylle review # alias| Flag | Description |
|---|---|
--uncommitted | Review uncommitted changes |
--base | Base branch to compare against |
--commit | Specific commit SHA to review |
--title | Review title |
PROMPT | Additional prompt |
# Review uncommitted changes
sakrylle review --uncommitted
# Review diff against main branch
sakrylle review --base main
# Review a specific commit
sakrylle review --commit abc1234sakrylle login
sakrylle login [FLAGS]Flags
| Flag | Description |
|---|---|
--with-api-key | Read API Key from stdin for login |
--with-access-token | Read Access Token from stdin for login |
--api-key | (Deprecated compatibility) legacy API key flag; use --with-api-key for new scripts |
--device-auth | Use Device Code OIDC authentication |
login status
sakrylle login statusShows current authentication status and associated account information.
sakrylle logout (Logout)
sakrylle logoutRemoves all locally stored authentication credentials.
sakrylle mcp
Manages Model Context Protocol (MCP) server connections.
sakrylle mcp <subcommand> [FLAGS]mcp list
Lists all configured MCP servers.
sakrylle mcp list [--json]mcp get
Shows details for a specific MCP server.
sakrylle mcp get <name> [--json]mcp add
Adds a new MCP server.
# Add via command
sakrylle mcp add <name> -- <command...>
# Add via URL (SSE transport)
sakrylle mcp add <name> --url URL| Option | Description |
|---|---|
--env KEY=VALUE | Set environment variable (repeatable) |
--url | SSE transport URL |
--bearer-token-env-var | Name of env var containing Bearer token |
--oauth-client-id | OAuth client ID |
--oauth-resource | OAuth resource identifier |
mcp remove
Removes a specific MCP server.
sakrylle mcp remove <name>mcp login
Logs into a specific MCP server.
sakrylle mcp login <name> [--scopes SCOPE1,SCOPE2]mcp logout
Logs out of a specific MCP server.
sakrylle mcp logout <name>Examples
# Add a local MCP server
sakrylle mcp add my-server -- npx -y @modelcontextprotocol/server-everything
# Add MCP server with environment variables
sakrylle mcp add my-server --env API_KEY=sk-xxx -- npx my-mcp-server
# Add a remote SSE MCP server
sakrylle mcp add remote-server --url https://mcp.example.com/sse
# List all MCP servers
sakrylle mcp list --jsonsakrylle plugin
Manages Sakrylle CLI plugins.
sakrylle plugin <subcommand> [FLAGS]plugin add
Installs a plugin.
sakrylle plugin add <plugin[@marketplace]> [-m]| Flag | Description |
|---|---|
-m | Install from marketplace |
plugin list
Lists installed plugins.
sakrylle plugin list [-m] [--json] [--available]| Flag | Description |
|---|---|
-m | List plugins from marketplace |
--json | JSON output |
--available | List available (not installed) plugins |
plugin remove
Removes a specific plugin.
sakrylle plugin remove <plugin[@marketplace]> [-m]plugin market
# Add a marketplace source
sakrylle plugin marketplace add <SOURCE> [--ref REF] [--sparse PATH]
# List added marketplaces
sakrylle plugin marketplace list
# Upgrade plugins from marketplace
sakrylle plugin marketplace upgrade [NAME]
# Remove a marketplace
sakrylle plugin marketplace remove <NAME>sakrylle resume
Resumes a previously saved interactive session.
sakrylle resume [SESSION_ID] [FLAGS]| Flag | Description |
|---|---|
SESSION_ID | Session ID to resume (positional argument) |
--last | Resume the most recent session |
--all | List all resumable sessions |
--include-non-interactive | Also include non-interactive sessions |
Also accepts all TUI global flags (--model, --sandbox, --profile, etc.).
# Resume the most recent session
sakrylle resume --last
# List all sessions and choose
sakrylle resume --all
# Resume a specific session
sakrylle resume abc1234sakrylle fork
Creates a new branch from an existing session, leaving the original session intact.
sakrylle fork [SESSION_ID] [FLAGS]| Flag | Description |
|---|---|
SESSION_ID | Source session ID to fork |
--last | Fork the most recent session |
--all | List all forkable sessions |
Also accepts all TUI global flags.
archive / unarchive
Archive
sakrylle archive <SESSION>Archives a session, hiding it from the active list.
Unarchive
sakrylle unarchive <SESSION>Restores an archived session to the active list.
sakrylle apply
Applies the most recently generated diff to the current workspace via git apply.
sakrylle apply [TASK_ID]
sakrylle a [TASK_ID] # alias| Flag | Description |
|---|---|
TASK_ID | Specific task ID to apply (optional; defaults to the most recent) |
completion
Generates shell auto-completion scripts.
sakrylle completion [SHELL]Supported shells: bash, zsh, fish, powershell, elvish.
# bash
sakrylle completion bash >> ~/.bashrc
# zsh
sakrylle completion zsh >> ~/.zshrc
# fish
sakrylle completion fish > ~/.config/fish/completions/sakrylle.fishsakrylle doctor
Diagnoses installation environment and configuration issues.
sakrylle doctor [FLAGS]| Flag | Description |
|---|---|
--json | JSON output |
--summary | Show summary only |
--all | Show all diagnostic checks |
--no-color | Disable colored output |
--ascii | Use ASCII characters for diagrams |
sakrylle sandbox
Runs a specified command inside an isolated sandbox environment, preventing accidental modification of system files.
sakrylle sandbox [FLAGS] COMMAND...macOS (Seatbelt)
Uses the native macOS Seatbelt sandboxing mechanism (sandbox-exec).
| Flag | Description |
|---|---|
--permissions-profile | Permissions profile |
--profile / -p | Sandbox profile to use |
--cd / -C | Set working directory |
--include-managed-config | Include managed config |
--allow-unix-socket | Allow Unix socket communication |
--log-denials | Log denied operations |
-c | Execute as command string |
COMMAND... | Command to execute |
Linux (Landlock)
Uses Linux Landlock LSM + seccomp for sandboxing. Flags are the same as macOS except --allow-unix-socket and --log-denials are not supported.
sakrylle cloud
EXPERIMENTAL -- API and behavior may change in future releases.
Executes tasks in the cloud via the Sakrylle API.
sakrylle cloud <subcommand>
sakrylle cloud-tasks <subcommand> # aliascloud exec
Execute a task in the cloud.
cloud list
List cloud tasks.
app-server
EXPERIMENTAL -- API and behavior may change in future releases.
Starts the Sakrylle application server, providing HTTP/stdio interfaces.
sakrylle app-server [FLAGS]Flags
| Flag | Description |
|---|---|
--listen URL | Listen address (e.g., http://0.0.0.0:3000) |
--stdio | Use stdio transport |
--remote-control | Enable remote control |
--analytics-default-enabled | Enable analytics collection by default |
--strict-config | Strict config mode |
Subcommands
app-server daemon
Manages the app server daemon process.
sakrylle app-server daemon start # Start the daemon
sakrylle app-server daemon restart # Restart the daemon
sakrylle app-server daemon stop # Stop the daemon
sakrylle app-server daemon version # Show daemon version
sakrylle app-server daemon bootstrap # Initialize daemon config
sakrylle app-server daemon enable-remote-control # Enable remote control
sakrylle app-server daemon disable-remote-control # Disable remote controlapp-server proxy
Starts a proxy server.
sakrylle app-server proxy [--sock]app-server generate-ts
Generates TypeScript type definitions.
sakrylle app-server generate-tsJSON schema
Generates JSON Schema.
sakrylle app-server generate-json-schemaremote-control
EXPERIMENTAL -- API and behavior may change in future releases.
Manages the Sakrylle daemon remote control functionality.
sakrylle remote-control [FLAGS] <subcommand>| Flag | Description |
|---|---|
--json | JSON output |
sakrylle remote-control start # Start remote control
sakrylle remote-control stop # Stop remote controlsakrylle app
macOS and Windows only. Launches the Sakrylle desktop application.
sakrylle appsakrylle debug
Provides debugging and diagnostic subcommands.
sakrylle debug <subcommand>debug models
Lists available models.
sakrylle debug models [--bundled]| Flag | Description |
|---|---|
--bundled | Show only bundled models |
send-message-v2
Sends a message to the app server (for debugging).
sakrylle debug app-server send-message-v2debug prompt-input
Prompt input debugging tool.
sakrylle debug prompt-input [PROMPT] [--image]clear-memories
Clears local memory storage. This is a hidden command and will not appear in help output.
sakrylle debug clear-memoriessakrylle features
Manages Sakrylle CLI feature flags.
sakrylle features <subcommand>features list
Lists all feature flags and their current state.
sakrylle features listfeatures enable
Enables a specific feature flag.
sakrylle features enable <feature>features disable
Disables a specific feature flag.
sakrylle features disable <feature>mcp-server
Starts Sakrylle CLI as an MCP server, communicating via stdio with external clients.
sakrylle mcp-serverIn this mode, Sakrylle CLI runs as a standard MCP server and can be called by MCP-compatible clients such as Claude Desktop and Cursor.
Configuration
Sakrylle CLI uses a TOML configuration file located at ~/.sakrylle-cli/config.toml. The config directory can be changed via the SAKRYLLE_CLI_HOME environment variable.
Configuration Layers
Configuration is applied in the following priority order (lowest to highest):
- Built-in defaults
- System-level config (system)
- User-level config (user):
~/.sakrylle-cli/config.toml - Profile config (profile)
- Project-level config (project): config file in the project root
- CLI flag overrides
Higher-priority settings override lower-priority ones for the same field.
Basic Config Fields
# Default model
model = "gpt-5.6-sol"
# Review model (used by review and similar commands)
review_model = "gpt-5.4"
# Model provider
model_provider = "sakrylle"
# Context window size (in tokens)
model_context_window = 200000
# Auto-compact token threshold
model_auto_compact_token_limit = 100000
# Approval policy: untrusted | on-failure | on-request | granular | never
approval_policy = "untrusted"
# Sandbox mode
sandbox_mode = "read-only"
# Custom system prompt
instructions = "You are a professional coding assistant."
# Developer prompt (appended after instructions)
developer_instructions = ""
# Web search mode: live | cached | disabled
web_search = "live"
# Conversation style: friendly | pragmatic | none
personality = "friendly"
# Service tier
service_tier = ""
# Reasoning effort: low | medium | high
model_reasoning_effort = "medium"
# Active profile
profile = "default"
# Forced login method: api | chatgpt
# forced_login_method = "api"
# Credential store: file | keyring | auto | ephemeral
# cli_auth_credentials_store = "auto"Providers
[model_providers.sakrylle]
name = "Sakrylle API"
base_url = "https://api.sakrylle.com/v1"
env_key = "SAKRYLLE_API_KEY"
wire_api = "responses" # or "chat"
# You can add multiple providers
[model_providers.ollama]
name = "Ollama Local"
base_url = "http://localhost:11434/v1"
env_key = "OLLAMA_API_KEY"
wire_api = "chat"Field descriptions:
name: Display name for the providerbase_url: API endpoint URL, OpenAI-compatible formatenv_key: Name of the environment variable holding the API keywire_api: API protocol type --responses(OpenAI Responses API) orchat(Chat Completions API)
Profile Configuration
Profiles allow you to save different configuration combinations for different scenarios:
[profiles.work]
model = "gpt-5.4"
model_provider = "sakrylle"
sandbox_mode = "read-only"
[profiles.personal]
model = "gpt-5.6-sol"
model_provider = "sakrylle"
sandbox_mode = "workspace-write"Select a profile at startup:
sakrylle --profile workMCP Server Configuration
[[mcp_servers]]
name = "my-server"
command = ["npx", "-y", "@modelcontextprotocol/server-everything"]
[[mcp_servers]]
name = "remote-server"
url = "https://mcp.example.com/sse"Hook Configuration
Hooks allow you to run custom scripts before or after specific events.
[hooks]Agent Configuration
[agents]
# Custom agent configurationMemory Configuration
[memories]
# Local memory storage configurationSkill Configuration
[skills]
# Custom skill configurationTool Configuration
[tools]
# Custom tool configurationFeature flags
Sakrylle CLI provides 80+ feature flags for controlling experimental features:
[features]
# Example: enable or disable specific featuresFeature flags can also be managed via the CLI:
sakrylle features list
sakrylle features enable <feature>
sakrylle features disable <feature>TUI Configuration
[tui]
# TUI-related configurationHistory Configuration
[history]
# Session history configurationAnalytics Configuration
[analytics]
# Analytics collection configuration
[otel]
# OpenTelemetry configurationOther Config Fields
# SQLite database storage directory
sqlite_home = ""
# Log output directory
log_dir = ""Environment Variables
Core env
| Variable | Description |
|---|---|
SAKRYLLE_CLI_HOME | Sakrylle CLI config directory path (default: ~/.sakrylle-cli/) |
SAKRYLLE_SQLITE_HOME | SQLite database storage path |
CODEX_HOME | Codex CLI-compatible config directory path (legacy) |
Auth env
| Variable | Description |
|---|---|
CODEX_API_KEY | OpenAI/Codex API key (legacy) |
CODEX_ACCESS_TOKEN | Codex access token (legacy) |
SAKRYLLE_API_KEY | Sakrylle API key |
Provider env
| Variable | Description |
|---|---|
CODEX_OSS_PORT | Local OSS model port |
CODEX_OSS_BASE_URL | Local OSS model base URL |
SAKRYLLE_API_BASE_URL | Sakrylle API base URL |
Sandbox env
| Variable | Description |
|---|---|
CODEX_SANDBOX | Sandbox mode setting |
CODEX_SANDBOX_NETWORK_DISABLED | Disable sandbox networking |
CODEX_THREAD_ID | Thread ID |
Sandboxing
Sakrylle CLI uses different sandboxing technologies on each operating system to isolate the AI agent's file system and process access.
macOS (Seatbelt)
On macOS, the native Apple Seatbelt (sandbox-exec) mechanism is used. A permissions profile controls which files and operations the AI agent can access.
Linux
Linux builds are still in development and do not have a public release package yet.
Windows
Windows builds are still in development and do not have a public release package yet.
Sandbox Modes
| Mode | Description |
|---|---|
read-only | Read-only; the AI agent cannot modify any files |
workspace-write | Allows writing files within the current workspace |
danger-full-access | Full access with no sandbox restrictions (use only when fully trusted) |
Codex differences
Sakrylle CLI is a fork of OpenAI Codex CLI. Here are the key differences:
| Area | Codex CLI | Sakrylle CLI |
|---|---|---|
| Binary | codex | sakrylle / skl |
| Config dir | ~/.codex/ | ~/.sakrylle-cli/ |
| Default provider | openai | sakrylle |
| API key env var | OPENAI_API_KEY | SAKRYLLE_API_KEY |
| Auth methods | ChatGPT OAuth + API Key | + OIDC device code |
| image_generation | Enabled | Disabled for Sakrylle |
| codex_apps MCP | Enabled | Disabled |
| update command | Present | Removed |
When migrating from Codex CLI to Sakrylle CLI, update your config directory path, environment variable names, and binary invocation.
Deprecated compatibility flags should not be used in new scripts: replace sakrylle login --api-key with sakrylle login --with-api-key, and replace sakrylle exec --full-auto with an explicit sandbox flag such as --sandbox workspace-write. Other hidden commands are for internal debugging or integrations and are not documented as user-facing interfaces.
Troubleshooting
sakrylle: command not found: Check that the install path is in yourPATH. The curl-installed binary is at~/.local/bin/sakrylle; ensure~/.local/binis in yourPATH. Runsakrylle doctorto diagnose- 401 / Authentication failed: Run
sakrylle login statusto check credential state. If expired, re-runsakrylle login - 402 Insufficient balance: Top up at https://ai1.sakrylle.com/purchase
- 404 / model not found: Verify that the
modelfield contains a valid model name. Runsakrylle debug modelsto list available models - Sandbox permission denied: Use
--sandbox workspace-writeto allow workspace writes, or--sandbox danger-full-accessto fully disable sandboxing (not recommended) - Config parse failure: Run
sakrylle doctorto check config file syntax. Use the--strict-configflag for more detailed error messages - MCP server connection failed: Check that the MCP server process is running and that the URL/command is correct. Use
sakrylle mcp listto review configured servers - TUI display issues: Ensure your terminal supports Unicode and 256 colors. Try the
--no-alt-screenflag. Runsakrylle doctorto check terminal compatibility - Conflicts with Codex CLI config: Sakrylle CLI uses its own config directory (
~/.sakrylle-cli/) and does not modify Codex CLI's~/.codex/configuration - Windows / Linux users: no public build is available yet; those platforms are still in development
Related Documentation
- Codex CLI -- Connect Sakrylle to the official OpenAI Codex CLI
- API Keys -- Create and manage your keys
- Billing -- Understand payments and charges
- Models and Pricing -- Full model group and price list
