{
  "markdown": "# as\n\n[![npm version](https://img.shields.io/npm/v/authshore.svg)](https://www.npmjs.com/package/authshore)\n[![MCP](https://img.shields.io/badge/MCP-18_tools-blue)](https://registry.modelcontextprotocol.io)\n[![Remote MCP](https://img.shields.io/badge/remote-mcp.authshore.ai-f97316)](#remote-mcp--zero-install)\n\n**Auth infrastructure for coding agents — user pools, secrets vault, token management. As easy as git.**\n\n> **git for your code. as for your auth.**\n\nYour agent can scaffold a whole app in an afternoon — then stalls the moment it needs auth. It hardcodes secrets into `.env` files it later commits, rolls its own JWT handling, and leaves you wiring up Cognito by hand. AuthShore is the auth layer your agent runs itself: one install, and it provisions user pools, stores secrets encrypted, and mints, validates and refreshes tokens — from the terminal, with no console to click through.\n\n**Works with:** Claude Code · Cursor · Cline · Windsurf · Aider · Codex · any MCP client\n\n## See It In Action\n\nReal terminal sessions against the live API — click a GIF for the full video.\n\n| Zero to auth in 60s | Secrets vault | Tokens & pools |\n|---|---|---|\n| [![Zero to auth in 60s](https://prodmedia.tyga.host/public/tyga.cloud/landing/authshore.ai/demo/signup-demo.gif)](https://prodmedia.tyga.host/public/tyga.cloud/landing/authshore.ai/demo/signup-demo.mp4) | [![Secrets vault](https://prodmedia.tyga.host/public/tyga.cloud/landing/authshore.ai/demo/secrets-demo.gif)](https://prodmedia.tyga.host/public/tyga.cloud/landing/authshore.ai/demo/secrets-demo.mp4) | [![Tokens & pools](https://prodmedia.tyga.host/public/tyga.cloud/landing/authshore.ai/demo/tokens-demo.gif)](https://prodmedia.tyga.host/public/tyga.cloud/landing/authshore.ai/demo/tokens-demo.mp4) |\n\nMore demos: [authshore.ai/#demo](https://authshore.ai/#demo)\n\n## Install\n\n```bash\nnpm install -g authshore\n```\n\nThe npm package is `authshore`; the command is `as`.\n\n## Quick Start\n\n```bash\n# 1. Create a project — free plan, API key active immediately, no card\nas signup my-project --email you@example.com --local\n\n# 2. Create a user pool\nas pool create main\n\n# 3. Store a secret (encrypted at rest, versioned)\nas secret set DATABASE_URL \"postgres://user:pass@host:5432/db\"\n\n# 4. Sign up a user in your pool\nas pool auth signup main --email user@example.com --password SecurePass123!\n\n# Full reference\nas help\n```\n\n## User Pools — Cognito without the console\n\nEvery project gets isolated user pools your agent manages from the terminal: create pools, add users, run full signup/signin flows that return real JWT pairs.\n\n```bash\nas pool create main                      # create a pool\nas pool list                             # list pools\nas pool users <id>                       # list users in a pool\nas pool user add <id> --email E --password P\nas pool auth signup <id> --email E --password P   # returns access + refresh tokens\nas pool auth signin <id> --email E --password P\n```\n\n## Secrets Vault — stop pasting keys into .env\n\nEncrypted, versioned key-value storage scoped to your project. Your agent stores third-party keys once and reads them at deploy time — nothing sensitive left sitting in the repo.\n\n```bash\nas secret set STRIPE_KEY \"sk_...\" --env production\nas secret get STRIPE_KEY                 # decrypted read\nas secret list\nas secret versions STRIPE_KEY            # full version history\nas secret delete STRIPE_KEY\n```\n\n## Tokens — mint, validate, refresh, revoke\n\nThe JWT plumbing agents usually hand-roll, done right once.\n\n```bash\nas token validate <jwt>                  # verify signature + expiry, show claims\nas token refresh <refresh-token>         # rotate the pair\nas token revoke <token>                  # kill a compromised token\n```\n\n## MCP Server\n\nPrefer tools over a CLI? `as` ships an MCP server. Point Claude Code (or any MCP client) at it and your agent gets **18 native tools**: pools, users, secrets, tokens, project status.\n\n```bash\nclaude mcp add authshore --env AUTHSHORE_API_KEY=as_your_key_here -- as mcp-serve\n```\n\nFor clients that use a JSON config (Cline, Cursor, Windsurf), pass your API key via the `AUTHSHORE_API_KEY` environment variable. The MCP server runs outside your project directory, so it will not pick up `.authshore/config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"authshore\": {\n      \"command\": \"as\",\n      \"args\": [\"mcp-serve\"],\n      \"env\": { \"AUTHSHORE_API_KEY\": \"as_your_key_here\" }\n    }\n  }\n}\n```\n\nNo key yet? `as signup my-project --email you@example.com` provisions one in seconds — free plan, no card.\n\n### Remote MCP — zero install\n\nNo CLI at all? Claude Web, Claude Desktop, Raycast, or any hosted MCP client can connect straight to our remote server. Same 18 tools, nothing to install:\n\n```\nURL:  https://mcp.authshore.ai/sse\nAuth: Authorization: Bearer YOUR_API_KEY\n```\n\nNo key? Connect without one: the remote server starts in onboarding mode with an `authshore_signup` tool that provisions your account and unlocks everything in the same session.\n\n## Features\n\n- **User pools** - isolated pools per project, full signup/signin flows, real JWT pairs\n- **Secrets vault** - encrypted at rest, versioned, environment-scoped\n- **Tokens** - validate, refresh, revoke from the terminal\n- **MCP server** - 18 tools, local (`as mcp-serve`) or fully remote (`mcp.authshore.ai`): Claude Code, Claude Web, Cursor, Raycast, any MCP client\n- **Agent-first CLI** - `--json` on every command for programmatic parsing\n- **Project-local config** - `.authshore/config.json`, auto-loaded, gitignore-friendly\n\n**Pricing:** free plan with an instantly-active API key — no card, no trial clock. Paid plans (Starter $9 / Pro $29 / Scale $99 per month) come with a 7-day free trial via secure Stripe checkout. [Details](https://authshore.ai/#pricing).\n\n## Config\n\n```bash\nas login --key YOUR_KEY --local     # saves to .authshore/config.json (project-local)\nas config                           # show active config\nas me                               # identity check: which project am I?\n```\n\nAPI key is resolved in this order (highest priority first):\n\n1. `--key` flag\n2. `AUTHSHORE_API_KEY` environment variable\n3. `./.authshore/config.json` (project-local)\n4. `~/.authshore/config.json` (global)\n\nAdd `.authshore/` to your `.gitignore`.\n\n## Agent Integration\n\nAdd to your CLAUDE.md, .cursorrules, .clinerules, .windsurfrules, or AGENTS.md:\n\n```\n## Auth\nThis project uses AuthShore for auth: user pools, secrets, tokens.\nUse the `as` CLI. Config is in .authshore/config.json (auto-loaded).\nIf not configured: as login --local --key YOUR_KEY\nRun `as help` for the full command reference. Run `as me` before any writes.\n```\n\n## Why this exists\n\nEvery agent-built app hits the same wall: auth. I watched my agents hardcode secrets, reinvent JWT refresh, and stall on Cognito consoles they can't click. So I built the auth layer the agent runs itself. It's early and I'm iterating fast: if something's rough or missing, [open an issue](https://github.com/jyswee/authshore/issues) — I read every one.\n\n## Documentation\n\n- [Quickstart Guides](https://authshore.ai/docs/quickstart.html)\n- [Full Reference](https://authshore.ai/llms.txt)\n- [Status](https://authshore.ai/health)\n\n## License\n\nProprietary - Tyga.Cloud Ltd. See [LICENSE](./LICENSE).\n",
  "bytes": 7267,
  "sha": "18763772aa0a079f507b6b9e1c52c483d24004e4b9026003dcdff00522775054",
  "repo_slug": "jyswee/authshore",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_jyswee_authshore_40dca10f/readme"
}