> ## Documentation Index > Fetch the complete documentation index at: https://docs.try-airlock.com/llms.txt > Use this file to discover all available pages before exploring further. # CLI reference > Every airlock command. ``` airlock Open a sandboxed shell in the current repo airlock Run an agent command inside the sandbox airlock login Sign in: server URL + email + password → API token airlock logout Revoke the token and forget this machine's identity airlock setup mcp Enable an MCP connector for this repo airlock publish Ship transcripts and proxy egress to the backend airlock dashboard Point at the console (served by the backend) airlock build Fetch the sandbox and proxy container images airlock stop Remove this repo's proxy container airlock init Write an example .airlock.toml to the current repo airlock proxy (internal) Run the egress proxy airlock version Print version airlock help Print usage ``` The commands that run or configure a sandbox — bare `airlock`, `airlock `, `setup mcp`, `stop`, and `init` — act on the **current working directory**: the repo you are in is the repo that gets mounted, and policy is resolved from it. `build`, `login`, `logout`, `version`, `help`, and `proxy` do not. `publish` is also independent of the working directory: it reads transcripts from `~/.airlock/agent/`, egress logs from `~/.airlock/logs/`, and your identity from `~/.airlock/auth.json`, so it covers every repo you have sandboxed, not just the current one. *** ## airlock Opens a shell inside the sandbox for the current repo. ```sh theme={null} cd ~/code/some-repo airlock ``` Starts (or reuses) the repo's proxy container, then runs a fresh sandbox container attached to your terminal. The sandbox is removed when the session exits; the exit code is passed through. If you have run [`airlock login`](#airlock-login), your identity rides into both containers as environment ids (never tokens), and every audit line and published event is attributed to you. Without it, the launch continues after a one-line warning and the session's events are unattributed until you log in. Identity is set when the proxy container starts. If a proxy outlives one person's login session on a shared machine, attribution follows whoever was logged in at container start — restart the sandbox after switching accounts. ## airlock \ Runs a command inside the sandbox instead of opening a shell. ```sh theme={null} airlock claude airlock claude --dangerously-skip-permissions airlock npm test ``` Any argument that is not a known subcommand is treated as the command to run, so `airlock claude` is shorthand for `airlock run claude`. Use the explicit `run` form when your command name would collide with a subcommand: ```sh theme={null} airlock run build # runs `build` in the sandbox, not `airlock build` ``` ## airlock login Signs this machine in. ```sh theme={null} airlock login ``` Prompts for the backend URL, your email, and your password (created by your admin in the [console](/dashboard#user-management)). The backend exchanges them for an API token, cached in `~/.airlock/auth.json` (mode `0600`), separate from `secrets.toml`. After login, sandbox sessions carry your identity and `airlock publish` ships under it. The token is bound server-side to your account; events claiming anyone else are rejected. It is further scoped to ingestion: it cannot read anyone's timeline. ## airlock logout ```sh theme={null} airlock logout ``` Best-effort revokes the token server-side, then deletes `~/.airlock/auth.json` regardless of whether the network call succeeded. A lost connection never leaves you "stuck logged in." ## airlock setup mcp Interactively enables an MCP connector for the current repo. ```sh theme={null} airlock setup mcp ``` Presents the connector menu, prompts for credentials, then writes to three places: credentials to `~/.airlock/secrets.toml`, the enable flag to `.airlock.toml`, and the server registration to `.mcp.json`. See [MCP connectors](/mcp-connectors) for the full flow. ## airlock publish Ships two event sources to the [backend](/deploy) — no third-party service is involved: * **Sandbox transcripts** from `~/.airlock/agent/claude/projects/` — prompts, replies, tool calls, and returned results, as chat events. * **Proxy egress logs** from `~/.airlock/logs//` — every allowed and denied connection attempt, as identity-attributed access events. ```sh theme={null} airlock publish # one-shot, both sources airlock publish --dry-run # per-source preview, no network (also -n) airlock publish --watch # poll every 3 seconds (also -w) ``` Requires [`airlock login`](#airlock-login) first. Publishing authenticates with your token, and the server attributes every event to it. There is no schema to create: the backend migrates its own database. Re-running is safe: ingestion is insert-only and idempotent — an event already received is skipped, never rewritten. `--watch` republishes any file that grew, covering both sources, so the console can follow a session that is still running. Only the **first** argument is checked for a flag. `airlock publish --watch` works; a flag in any later position is silently ignored and a one-shot publish runs instead. See [audit log](/audit-log) for exactly what each source ships and how long content is retained. ## airlock dashboard The console is no longer a local server — it is served by the backend itself, login-gated and multi-user. This command exists as a signpost: it prints your deployment's console URL (from `~/.airlock/auth.json`) instead of failing as an unknown command. See [console](/dashboard). ## airlock build Fetches the `airlock/base` and `airlock/proxy` images, pinned to match the CLI's release. ```sh theme={null} airlock build ``` The default is a registry pull — no source tree required, which is what makes installed binaries work anywhere Docker does. Building the images locally from `images/*/Dockerfile` remains the contributor path via `make images` in a checkout. ## airlock stop Removes the current repo's proxy container. ```sh theme={null} airlock stop ``` Idempotent — nothing running is success, not an error. The backend is unaffected; stop it with `docker compose down` in `deploy/` (see [deploy](/deploy#teardown)). ## airlock init Writes a commented example `.airlock.toml` into the current directory. ```sh theme={null} airlock init ``` Errors if `.airlock.toml` already exists — it will not overwrite your policy. ## airlock version ```sh theme={null} airlock version ``` Also available as `airlock --version`. ## airlock help ```sh theme={null} airlock help ``` Also available as `airlock -h` and `airlock --help`. *** ## Make targets For working on Airlock itself: | Target | Does | | ------------------- | --------------------------------------------------------------------------------- | | `make build` | Build the CLI to `bin/airlock` with a local Go toolchain | | `make build-docker` | Build the CLI for your host inside a container (no local Go needed) | | `make install` | `build-docker`, then install to `$PREFIX/bin` (default `/usr/local`, uses `sudo`) | | `make images` | Build the `airlock/base` and `airlock/proxy` images locally | | `make tidy` | Run `go mod tidy` in a container | | `make clean` | Remove `bin/` |