{
  "markdown": "# Marrow CLI\n\nUse the Marrow CLI to add records, run queries, manage API keys, and start MCP\nover stdio. Connect remote-capable MCP clients directly to\n`https://mcp.marrow.id`; use `marrow mcp` when a client requires a local stdio\nserver. Version `1.0.11` uses separate credentials for account and product work:\n\n- a CLI session authorizes human account and API-key management;\n- `MARROW_API_KEY` authorizes product commands and local MCP;\n- non-secret defaults live in the Marrow config file;\n- customer keys never enter command arguments or Marrow config.\n\nThe CLI runs inside a trusted application process. Keep returned text as data\nand preserve citations, warnings, and `insufficient_evidence` when another\nmodel consumes it. See the [OpenAPI document](../openapi.yaml) and the\n[Native Memory API](../api-reference/memory.md).\n\n## Install\n\nInstall CLI version 1.0.11 with Node.js 20 or newer:\n\n```bash\nnpm install -g @marrowid/cli@1.0.11\nnpm exec --package @marrowid/cli@1.0.11 -- marrow --version\nmarrow --version\nmarrow --help\n```\n\nIf an older global binary is already on `PATH`, the `npm exec` check verifies\n1.0.11 independently before you replace the global install.\n\n## First setup\n\nCreate the local config, set only the defaults you need, then inspect the local\nsetup without making a network request:\n\n```bash\nmarrow init\nmarrow config --workspace default\nmarrow doctor\n```\n\n`marrow init` and `marrow config` write only the API base URL and workspace\ndefault. `marrow doctor` reports package, platform, config permissions,\nand whether `MARROW_API_KEY` is present. It reports presence, never the key.\n\nAn upgraded client that finds a legacy plaintext `apiKey` refuses every network\nrequest. Set `MARROW_API_KEY` through your shell, process manager, or secret\nstore; the next network command removes only the legacy key field atomically and\npreserves the non-secret defaults.\n\n## Credentials and platform support\n\n| Task | Credential | Storage |\n| :--- | :--- | :--- |\n| Product ingest, query, and native memory commands | Customer API key | `MARROW_API_KEY` in the process environment |\n| Local stdio MCP | Customer API key | Inherited `MARROW_API_KEY`; never MCP JSON |\n| Hosted MCP | Interactive authorization or customer API key | MCP client's protected credential store |\n| API-key create, rotate, revoke, and list | CLI account session | macOS Keychain |\n| Browser account and billing work | Browser session | Marrow Console |\n\n## Auth\n\nCustomer API keys are for apps and automation, not for signing in to this local CLI.\n\nDevice sign-in is available on macOS in version 1.0.11:\n\n```bash\nmarrow auth login\nmarrow auth status\n```\n\nThe browser flow must show the account, short code, expiry, and consequence\nbefore deliberate approval. Login or signup alone does not approve a device.\nLinux and Windows reject `marrow auth login` before sending a device request;\nuse the Console for account management and an environment customer key for\nproduct commands and local MCP.\n\nSign out the device when it should no longer manage the account:\n\n```bash\nmarrow auth logout\n```\n\nLogout clears the CLI session. It does not revoke or rotate customer API keys.\n\n## Add records\n\nProduct commands require `MARROW_API_KEY`. Preview a source before writing:\n\n```bash\nmarrow ingest url https://example.com/onboarding-note --dry-run --dated-at 2026-05-16\nmarrow ingest file ./onboarding.md --dry-run --dated-at 2026-05-16\n```\n\nSubmit it when the preview is correct:\n\n```bash\nmarrow ingest url https://example.com/onboarding-note --dated-at 2026-05-16 --idempotency-key onboarding-note-2026-05-16\nmarrow ingest file ./onboarding.md --dated-at 2026-05-16 --idempotency-key onboarding-file-2026-05-16\n```\n\nUse the authored, published, or otherwise relevant date. A live submission\nrequires a caller-owned idempotency key between 8 and 160 characters. Reuse the\nsame key when retrying the same submission; use a new key for a different\nsource or changed content. Dry-runs may omit it. Poll the returned job until it\nreaches `succeeded`, `failed`, or `quarantined`:\n\n```bash\nmarrow ingest jobs list --limit 5\nmarrow ingest jobs show <job-id>\n```\n\n## Query Marrow\n\nAsk one concrete question after processing succeeds:\n\n```bash\nmarrow query \"What should this workflow remember about onboarding?\" \\\n  --mode answer \\\n  --preset accuracy\n```\n\nThe response includes citations, source labels, excerpts, and warnings. If\nMarrow returns `insufficient_evidence`, add relevant material or continue\nwithout Marrow.\n\nNative workspace, peer, session, claim, event, and queue commands use the same\nenvironment customer key. Use each command's `--help` option for its exact\narguments.\n\n## Manage API keys on macOS\n\nWith an active CLI account session:\n\n```bash\nmarrow api-keys list\nmarrow api-keys create --name \"Production app\"\nmarrow api-keys create --name \"Query only\" --scope query\nmarrow api-keys create --name \"Memory app\" --scope ingest --scope query --scope memory.read --scope memory.write\nmarrow api-keys rotate <key-id>\nmarrow api-keys revoke <key-id>\n```\n\nOmit scope flags for the `ingest,query` default. Available scopes are `ingest`,\n`query`, `memory.read`, and `memory.write`. Create and rotate show a new secret\nonce; list and revoke never reveal it.\n\n## MCP\n\nConnect remote-capable clients to:\n\n```text\nhttps://mcp.marrow.id\n```\n\nPeople can use interactive authorization to connect an MCP client to their\nMarrow account. A server-managed client can use an API key with the required\nmemory scopes. Connected applications remain visible and revocable in Console.\n\nUse `marrow mcp` when the MCP client requires a local stdio server. It connects\nto the same Marrow account and exposes the same 14 tools as Hosted MCP.\n\n`marrow mcp` is the shipped local newline-delimited JSON-RPC entrypoint over\nstdio. Start the MCP client from a process that already inherits\n`MARROW_API_KEY`; do not paste a key into MCP client JSON.\n\n```bash\nmarrow mcp\n```\n\nThe server exposes 14 tools for query, peer, session, claim, event, queue, and\nrepresentation workflows. The canonical query tool requires `query`;\nnative-memory reads require `memory.read`; writes require `memory.write`.\nWrong-scope and revoked-key errors are returned to the client. See the\n[MCP tool table](./app-context.md#mcp-tools) and the short\n[coding-agent prompt](./app-context.md#prompt-for-a-coding-agent).\n\nThe local MCP server and tool schemas are available with the CLI. Calls to\nnative memory remain scoped by `memory.read` and `memory.write`.\n\n## Output and troubleshooting\n\nHuman-readable output is the default. Use `--json` only when automation needs a\nstable structured response.\n\n- Missing key: configure `MARROW_API_KEY` in the invoking process.\n- Missing live-ingest replay key: add `--idempotency-key <key>`, or use\n  `--dry-run` while previewing.\n- Legacy plaintext key: supply the environment key once so the client can\n  remove the legacy config field before network use.\n- Wrong scope: rotate or create a key with only the required scope.\n- Revoked key: replace the environment value; do not restore the old key.\n- Device login on Linux or Windows: use the Console for account work.\n- Local setup uncertainty: run `marrow doctor`; it performs no network request.\n\nProprietary. `UNLICENSED` means the package is a distribution channel, not an\nopen-source grant.",
  "bytes": 7321,
  "sha": "27ec2ba26b481b5e72585ec861f56d44931966e7785e9bb882fa2b051de3bb72",
  "repo_slug": "",
  "fonte": "npm",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_id_marrow_marrow_2bf7ff8d/readme"
}