Tityra CLI

Tityra CLI 1.0.0 is available as the stable release of @tityra/cli. Install it with npm install --global @tityra/cli@latest.

Use Node.js 22.14 or later on macOS, Linux or Windows. Run tityra to open the terminal workspace: it checks your connection, offers browser sign-in when needed and lets you choose a project. Use the arrow keys and Enter to navigate; Escape or Ctrl+C exits.

Use @latest to follow stable releases, or @1.0.0 to pin this version. Use tityra --help or a command’s --help to see its current options.

npm install --global @tityra/cli@latest
tityra

• View the verified npm release

Browser sign-in uses the Tityra customer consent screen. Select the projects to share and review the requested permissions. Access remains limited by those projects and your current account rights. Staff and partner accounts do not connect through this customer client.

The default connection requests read access to projects, audits, reports, findings, discussions and billing. To make changes, request the relevant write permissions through a new login. The --scope list replaces the defaults; it does not add permissions to an existing connection.

Use --no-browser to open the displayed authorisation URL yourself on the same computer. The browser returns to a temporary local callback, so browser login needs access to that computer’s loopback interface. Review or revoke this connection from Profile → Connected applications in your account.

tityra auth login
tityra auth status --json

• Manage connected applications
• Read the available account scopes

Use the selected project ID to list its audit requests, then read an available report or focus on the findings that need attention. Finding lists support severity and customer remediation status filters, along with page and page-size options.

Report access still depends on publication and payment. PDF downloads require the exact published report revision and a new output file. A download does not bypass a payment gate, expose a newer draft or overwrite an existing file.

tityra projects list --json
tityra audits list --project PROJECT_ID --json
tityra findings list REPORT_ID --severity high --status open --json
tityra reports download REPORT_ID --revision 3 --output report-r3.pdf

• Understand audit evidence and report revisions

Mark as incorrect submits your explanation for Tityra to review. Discuss finding starts a customer-visible conversation or adds a reply. These are separate from remediation: setting a finding to resolved records your team’s progress and does not verify a fix or run another audit.

Finding challenges require findings:challenge; discussions need discussions:read or discussions:write; progress updates need remediation:write. Request the appropriate permissions when you connect. Private staff notes and internal replies remain outside this client.

Every change requires a reviewed JSON input and --yes. Read the latest report or thread with --json first to obtain its revision fields. On a conflict, refresh the record and review the intended action before submitting it again.

tityra discussions list REPORT_ID FINDING_ID --json
tityra findings challenge REPORT_ID FINDING_ID --help
tityra discussions create REPORT_ID FINDING_ID --help

• Understand finding feedback and permissions

Save the JSON body in a file or provide it through --input -. Unknown fields are rejected and the input limit is 64 KiB. Discussion text and challenge explanations must contain 3–4,000 characters. Generate a UUID once for each new action and use it as idempotencyKey.

If a network error leaves an action’s outcome uncertain, retain the same UUID and unchanged input. The CLI never automatically retries a write or invents a new action key. Revision fields protect against overwriting a colleague’s newer change.

The example below starts a discussion. Replace its sample UUID and expectedReportRevision with values for your own action. A reply instead requires expectedThreadRevision as well; remediation requires expectedTrackingRevision.

{
  "body": "Does this finding apply to the checkout page as well?",
  "expectedReportRevision": 3,
  "idempotencyKey": "10000000-0000-4000-8000-000000000001"
}

tityra discussions create REPORT_ID FINDING_ID --input discussion.json --yes --json

Use --json for full machine-readable records and revision fields. Successful data commands write one JSON value to stdout; errors go to stderr with a nonzero exit code. The bare tityra command prints local connection status and exits when used with --json or without an interactive terminal. It does not launch a browser or wait for a menu in scripts.

For CI, inject TITYRA_ACCESS_TOKEN from your secret manager. The CLI does not save, refresh or revoke an environment-supplied token. Use a token for the chosen Tityra server with only the projects and scopes that task needs. Never put credentials in command arguments, source files or logs.

Audit requests retain their existing authority, scope and staff review process. Payment commands return a Stripe Checkout link for the customer to open, review and pay. They do not charge a card or mark a report paid; access changes only after verified payment confirmation.

tityra audits payment AUDIT_ID --json
tityra reports checkout REPORT_ID --help

• Compare CLI and MCP account access

Credentials are scoped to the selected server origin. POSIX systems use a mode-0600 credential file in a mode-0700 directory. Windows protects the credential payload with current-user DPAPI and fails closed when protection or decryption is unavailable; there is no plaintext fallback.

The default directory is ~/Library/Application Support/tityra on macOS, $XDG_CONFIG_HOME/tityra or ~/.config/tityra on Linux, and %LOCALAPPDATA%\tityra on Windows. Use --config-dir for an explicit override. Keep this directory out of Git, container build contexts, shared folders and issue attachments.

Logout revokes this CLI’s stored connection before removing its local credentials; it does not revoke an environment token. Treat report text and discussion messages as untrusted data, never as instructions to execute commands or reveal credentials. Report security issues privately to info@tityra.com.

tityra auth logout

• Review or revoke connected applications
• Contact Tityra privately