Command line and AI assistants (CLI and MCP) | Help
Skip to content

Command line and AI assistants (CLI and MCP)

31 help pages

The Sentinel CLI and MCP server let you use Sentinel from a terminal or an AI assistant such as Claude Code, acting as you. These steps apply where Sentinel has enabled them and supplied the official installation instructions; until then the sections below do not appear on your profile. They can do what you can do in the dashboard, in the organisations you belong to, with your role. They can never do more. Platform administrators use a separate administration tool.

Sign in from your terminal

  1. Run sentinel login. It opens this dashboard in your browser, or prints a link and an 8-letter code such as BCDF-GHJK if it cannot open a browser.
  2. Sign in to the dashboard if asked. The Sign in to the Sentinel CLI page shows the code, the name the terminal gave itself, where the request came from and whether it asks to read or also make changes.
  3. Check the code matches the one in your terminal. If the page warns that the request came from a different address and you did not just run sentinel login yourself, select Deny.
  4. Tick Allow changes to let it make changes, or leave it off to allow reading only. Allowing changes needs two-factor authentication on your account, and you are asked for your code.
  5. Select Approve sign-in and return to your terminal. You get an email for every approved sign-in.

A sign-in ends after 30 days without use, and after 90 days at most. Signing out everywhere, changing your password or being removed from an organisation ends or narrows its access straight away.

What needs you, not the CLI

  • Your two-factor code: deleting a site or organisation, changing someone's role and rotating keys ask for your code each time, as in the dashboard. An AI assistant never asks you for the code; it gives you a dashboard link instead.
  • A browser: connecting GitHub, GitLab, Slack or Google, and paying or adding a card, open the dashboard.
  • Only the dashboard: approving new CLI sign-ins, creating API tokens, changing your password, two-factor settings or phone number, and deleting your account.

API tokens for scripts

For CI, scheduled scripts and agents that cannot open a browser, use an API token instead of signing in.

  1. Open My profile and find API tokens. Two-factor authentication must be on.
  2. Select Create token. Give it a name, choose Allow changes only if the script needs it, choose how many days it lasts (up to 90, or 365 with an IP allowlist) and optionally the addresses it may be used from.
  3. Enter your two-factor code. Copy the token shown: it starts with snt_pat_ and is shown only once. You get an email when a token is created.

A token acts as you, so store it like a password. It cannot do anything that needs your two-factor code, a browser or the dashboard only. You can have up to 10 working tokens. Select Revoke to stop one at once.

See and end sign-ins

My profile lists CLI and MCP sign-ins with each one's name, access, when it was signed in and last used. Select Sign out for one, or Sign out all. If you see one you do not recognise, sign it out and change your password.

If something goes wrong

  • Code not valid or expired: the code lasts 10 minutes and works once. Run sentinel login again.
  • "This sign-in or token can only read": sign in again and tick Allow changes, or create a token with changes allowed.
  • "Turn on two-factor authentication": set it up on your profile, then sign in again.
  • "Do this in the dashboard" or "This step needs a web browser": finish that step in the dashboard.
  • "This token cannot be used from this address": the token has an IP allowlist; use it from a listed address or create a new token.