Set up from your agent

Let your coding agent add Anlyon to a project from the terminal: one command signs you in, writes a key to .env, installs the SDK, connects the MCP server and runs a governed call with a receipt.

Your coding agent can set Anlyon up for you. It runs one command, anlyon init, in your project. You open the browser to sign in, to approve a provider’s consent page if you connect an account, to sign off on something new an agent may do, and to pay if you upgrade. Nothing else needs the console.

This is the recommended way to start. The quickstart walks through the same pieces by hand, for when you want to see each one.

Know why you would use it

Adding a governance layer usually means a tour of a dashboard: create a key, pick its scopes, copy it into an environment file, find the SDK, wire up the MCP server, write a test call and hope it works. Each step is a chance to paste a key into a chat, commit it, or give it more scopes than it needs.

Less effort. One command takes an empty project to a governed call with a receipt. Run it again and it changes nothing that is already right.
Less risk. The key goes straight into .env (.env.local for Next.js), never to the terminal or the chat, and .env* is added to .gitignore before the key is written. The key holds the standard agent scopes: it cannot read secrets, decide approvals, or change policies, limits or budgets.
Your agent never loosens its own guardrails. Anything that would let an agent do more, such as adding an action, waits for a person’s sign-off at a link. Tightening applies at once.
Proof it works. The last step makes one read-only governed call with the new key and prints its receipt id.

Ask your agent

Paste this into Claude Code, Cursor or Codex, in your project:

Set up Anlyon in this project with npx @anlyonhq/cli init. Use --yes. Don’t print or ask me for any key.

Or run it yourself:

npx @anlyonhq/cli init --yes

If the anlyon-setup skill is installed, “add Anlyon to this project” is enough: the skill tells the agent to run anlyon init.

What it does

Signs you in

A browser opens at the Anlyon sign-in page. New to Anlyon? Sign up there, with GitHub or email; your workspace and its environment are created for you. On the consent screen, leave Create API keys ticked: it lets this login create one agent key.

A login that already allows this is reused, so a second run opens no browser.

Writes a key to your env file

Creates an API key named anlyon init: <project> in the environment you chose and writes it as ANLYON_API_KEY. A key already in the file is kept when it works for the same environment. One for another environment stops init with exit code 10, and the file is left as it was.

Installs the SDK

Reads package.json or pyproject.toml and runs the project’s own package manager: npm, pnpm, yarn or bun for @anlyonhq/sdk, uv, poetry or pip for anlyon. Skipped when the SDK is already a dependency. --no-install prints the command instead.

Connects your coding agent

Adds the hosted MCP server to .mcp.json (Claude Code), .cursor/mcp.json (Cursor) and .codex/config.toml (Codex), for the agents it finds in the project. Other servers in those files are left exactly as they were, and no key is written to them: the agent signs in through the browser when it connects. Restart the agent to load it.

Runs one governed call

Adds a read-only action, anlyon-smoke-test (a GET to an echo endpoint that changes nothing), and invokes it with the new key. It prints the invocation’s outcome, its receipt grade and the receipt id.

Adding an action lets an agent do something new, so on a server that asks for sign-off the command prints a link instead. Approve it, then run init again, or pass --wait 15m and init opens the page and carries on once you approve.

Example

$ npx @anlyonhq/cli init --yes
Signing in. No account yet? The sign-in page lets you create one.
Opening your browser to log in. If it does not open, visit:
  https://api.anlyon.com/api/auth/oauth2/authorize?...
Installing @anlyonhq/sdk: npm install @anlyonhq/sdk
Anlyon is set up in shop.
  login        signed-in: profile default, workspace <workspace-id>, environment production
  api key      created: ANLYON_API_KEY in .env.local (not printed), .env* added to .gitignore
  sdk          installed: @anlyonhq/sdk
  mcp          .mcp.json added
  smoke test   succeeded: anlyon-smoke-test, receipt eff_... (acknowledged)

Next:
  - Restart your coding agent so it loads the anlyon MCP server; it signs in through the browser when it connects.
  - In code: new Client({ apiKey: process.env.ANLYON_API_KEY! }).actions.invoke(...)
  - Keep guardrails in the repo: anlyon pull writes this environment to anlyon.yaml; anlyon plan and anlyon apply change it.
  - Upgrade or check your plan: anlyon billing status, anlyon billing upgrade --plan starter.

--json prints the same report as one JSON document, for an agent to read.

Connect an integration in the same step

--pack installs a catalogue pack and connects its account:

npx @anlyonhq/cli init --yes --pack github --wait 15m

An integration you sign in to (HubSpot, Slack, Linear, GitHub, Notion) prints a link to the provider’s consent page. With --wait, init opens it and waits for you to finish.
An integration that takes a key prints where to create one, and asks you to run anlyon connections add <integration> in your own terminal. The key is typed at a hidden prompt and never passes through the agent.

The sign-in for --pack also asks to store the account (Secrets) and install the pack’s policies and limits (Guardrails). When the account is connected and the project has a GitHub remote, the smoke test reads that repository instead.

Flags

Flag	Default	Meaning
`--yes`	off	Confirm without prompting. Required when not interactive, as in an agent’s shell.
`--pack <name>`	none	Also install this catalogue pack (`github`, `hubspot`, …) or a pack directory, and connect its account.
`--wait <duration>`	none	Wait this long for what needs you in the browser: a sign-off, or the pack’s account. Without it, `init` prints the links and goes on.
`--mcp <clients>`	the ones found	`claude`, `cursor`, `codex`, comma-separated, or `none`.
`--no-install`	off	Do not install the SDK; print the command.
`--no-smoke`	off	Skip the governed call.
`--api-url <url>`	`https://api.anlyon.com`	The API to sign in to. Written to the env file as `ANLYON_API_URL` when it is not the default.
`--no-browser`	off	Print links instead of opening a browser.

Exit codes: 0 when the smoke test succeeded or was skipped, 12 when an approval policy holds it, 14 when it failed, 15 when a sign-off is pending, 10 when the env file holds a key for another environment. See Scripting and CI.

What needs a browser, and why

Step	Why a person does it
Sign in or sign up	A person proves who they are; a key cannot.
A provider’s consent page	The account’s owner grants access to it.
A sign-off for something new an agent may do	An agent may never loosen its own guardrails.
Payment	Card details go to the payment page, never the terminal. See `anlyon billing upgrade`.

Keep guardrails in code

anlyon pull, plan and apply: actions, policies, limits and budgets in anlyon.yaml, reviewed in pull requests.

Quickstart by hand

The same loop step by step, for one of your users’ own accounts.