Current surfaces. Clear boundaries.

Admit a known skill from a local path, GitHub identifier or URL, agentskills slug, or direct HTTPS SKILL.md URL. The command collects sibling resources when available, rejects symlinks, validates, signs, records provenance, and can refresh profile links. Use --agent for remote skills that do not declare target agents, --yes for non-TTY automation, and --provenance to keep the recorded source identifier when replacing a local skill from a staging directory.

Remove a vaulted skill, delete vault-local transforms for that skill, and refresh managed profile links. Native profile-root discovery is on by default, so AutoVault prunes managed symlinks from discovered host roots such as ~/.claude/skills, ~/.codex/skills, and ~/.cursor/skills. Use --no-discover to refresh only the vault's internal profile tree, --link agent=/path for an explicit host root, and --json for automation.

Regenerate local filesystem-native profile links for detected or configured host skill roots. Reports restart_required: true when symlinks change so the operator knows to reload their agent session. Remote mode cannot perform this on client machines.

Interactive wizard that scans the vault, the bundled skills root, and any discovered native agent skill roots (~/.claude/skills, ~/.codex/skills, ~/.cursor/skills), then offers a per-skill adoption decision. The wizard requires a TTY; without one it exits with code 2 and a NoTtyError. Re-run any time to re-scan. Three adoption modes: augment (safe default) refreshes profile symlinks only — existing native dirs are not touched; backup renames each native dir to <root>.bak/<name>, admits the bytes into the vault, then replaces the original with a managed symlink (the typical “import my skills” choice); in-place admits the bytes then removes the native dir and replaces with a symlink — destructive, no backup. After adoption the wizard runs sync-profiles, which emits restart_required: true when symlinks change.

Inspect local vault health, installed skill integrity, ignored OS/editor metadata, and profile visibility. --clean removes ignored OS/editor metadata. --repair re-signs unsigned local skills only — it refuses tampered metadata and remote sources. --json emits a structured report with repair_status per skill.

Walk a repository for vendored SKILL.md files, validate each through the same admission gate the vault uses, and emit a report. Useful for CI checks that block merging unsigned or invalid skills.

Resolve which skills are visible to a given caller, platform, channel, and query. This exposes the same capability resolution the MCP server runs internally. Output is JSON; --channel is optional, the rest are required.

List installed skills as JSON, with each skill’s declared bin.* action names. Reserved action names (list, search, which) cannot be declared as bin actions.

Run local metadata text search over installed skills. Searches names, descriptions, tags, categories, and when-to-use metadata; embedding-backed semantic search is future work.

Print the resolved script path(s) for a skill without running them. Verifies the signed manifest before parsing. With <action>, prints the single command/args/cwd for that action; without, prints all declared actions.

Generic dispatch that delegates to the named skill’s bin.<action> handler. The skill’s signed manifest declares which actions exist; list, search, and which are reserved.

Start the remote Streamable HTTP MCP service. Set AUTOVAULT_MODE=remote, AUTOVAULT_PUBLIC_URL, admin credentials, and storage path before exposing it.

Set these before invoking the autovault CLI or starting autovault serve. Logs are JSON lines on stderr only; stdout is reserved for MCP framing — never write to stdout from server code.

Read only by scripts/install.sh during the initial install. The autovault binary does not parse these — they shape the installer's interactive flow.

Resolve tools, skills, and MCP servers for a scoped caller request. Unknown callers fail closed unless mapped to a restricted profile.

Grouped source exports for installing from configured sources, validating caller-authored SKILL.md bytes, or refreshing an installed skill. MCP tools wrap these same helpers.

Regenerate per-agent and tag-filtered profile symlinks from installed skill metadata and optional profile config.

Search by query or fetch one installed skill by name. Pass include_resources when packaged resource files are needed.

Install a known skill from GitHub, agentskills, HTTPS URL, or local bundle source. Caller-authored bytes should use propose_skill instead. For local bundles, pass skill_dir and an explicit identifier matching the CLI provenance value.

Submit newly authored SKILL.md content for validation, security scan, capability cross-check, deduplication, signing, and storage.

Compare installed skills against recorded upstream source state and report drift, unchecked inline skills, warnings, and errors.

First contact. Any keypair may call this, signed by itself, which is what makes autovault link work on a machine the owner has never seen: the request enrols the key as pending and returns its device_id. The owner admits it from the Machines card on Cloud. Enrolling the same key twice returns the existing device rather than a second row, so a repeated link is safe. A vault holds at most 20 pending devices at once; admitting or denying any of them frees a slot, and a machine that is already enrolled is never locked out by a full queue.

What the CLI polls while it waits for an owner to click Admit. Readable by any enrolled device, including a revoked one, which is deliberate: a machine that has lost access should be able to find that out rather than retry into a wall. Returns device_id and status, one of pending, active, or revoked. Responses are no-store, private because they are authorized per device.

The signed index of what the vault serves. Readable while a device is still pending, on purpose: autovault link enrols and then immediately reads the catalog to pin public_key, before the owner has admitted anything. Served byte-for-byte from KV, because re-serialising the JSON changes the bytes and every release signature stops verifying. A vault with nothing published yet answers 404 This vault has no published catalog yet, which is the normal state of a new vault rather than an error.

The skill content itself, addressed by the hash the catalog names. Active devices only, and unlike the catalog it also checks the hosted subscription: a lapsed subscriber gets 402 here while the catalog keeps answering, so billing failure reads as billing rather than as a broken vault. The client re-derives this path as bundles/<bundle_hash>.json relative to catalog.json and the path is covered by the release signature, so bundles cannot be renamed, moved, or redirected. Nothing under /v/ may return a 3xx at all: the CLI fetches with redirect: "manual" and throws on any redirect it sees.