--- title: "Set up from your agent" description: "Let your coding agent add Anlyon to a project from the terminal: one command signs you in, writes a key to .env, installs the SDK, connects the MCP server and runs a governed call with a receipt." --- Your coding agent can set Anlyon up for you. It runs one command, `anlyon init`, in your project. You open the browser to sign in, to approve a provider's consent page if you connect an account, to sign off on something new an agent may do, and to pay if you upgrade. Nothing else needs the console. This is the recommended way to start. The [quickstart](/quickstart) walks through the same pieces by hand, for when you want to see each one. ## Know why you would use it Adding a governance layer usually means a tour of a dashboard: create a key, pick its scopes, copy it into an environment file, find the SDK, wire up the MCP server, write a test call and hope it works. Each step is a chance to paste a key into a chat, commit it, or give it more scopes than it needs. - **Less effort.** One command takes an empty project to a governed call with a receipt. Run it again and it changes nothing that is already right. - **Less risk.** The key goes straight into `.env` (`.env.local` for Next.js), never to the terminal or the chat, and `.env*` is added to `.gitignore` before the key is written. The key holds the standard agent scopes: it cannot read secrets, decide approvals, or change policies, limits or budgets. - **Your agent never loosens its own guardrails.** Anything that would let an agent do more, such as adding an action, waits for a person's sign-off at a link. Tightening applies at once. - **Proof it works.** The last step makes one read-only governed call with the new key and prints its receipt id. ## Ask your agent Paste this into Claude Code, Cursor or Codex, in your project: > Set up Anlyon in this project with `npx @anlyonhq/cli init`. Use `--yes`. Don't print or ask me for any key. Or run it yourself: ```bash npx @anlyonhq/cli init --yes ``` If the [`anlyon-setup`](/agents/skills/anlyon-setup) skill is installed, "add Anlyon to this project" is enough: the skill tells the agent to run `anlyon init`. ## What it does 1. **Signs you in** A browser opens at the Anlyon sign-in page. New to Anlyon? Sign up there, with GitHub or email; your workspace and its environment are created for you. On the consent screen, leave **Create API keys** ticked: it lets this login create one agent key. A login that already allows this is reused, so a second run opens no browser. 2. **Writes a key to your env file** Creates an API key named `anlyon init: ` in the environment you chose and writes it as `ANLYON_API_KEY`. A key already in the file is kept when it works for the same environment. One for another environment stops `init` with exit code 10, and the file is left as it was. 3. **Installs the SDK** Reads `package.json` or `pyproject.toml` and runs the project's own package manager: `npm`, `pnpm`, `yarn` or `bun` for `@anlyonhq/sdk`, `uv`, `poetry` or `pip` for `anlyon`. Skipped when the SDK is already a dependency. `--no-install` prints the command instead. 4. **Connects your coding agent** Adds the hosted MCP server to `.mcp.json` (Claude Code), `.cursor/mcp.json` (Cursor) and `.codex/config.toml` (Codex), for the agents it finds in the project. Other servers in those files are left exactly as they were, and no key is written to them: the agent signs in through the browser when it connects. Restart the agent to load it. 5. **Runs one governed call** Adds a read-only action, `anlyon-smoke-test` (a `GET` to an echo endpoint that changes nothing), and invokes it with the new key. It prints the invocation's outcome, its receipt grade and the receipt id. Adding an action lets an agent do something new, so on a server that asks for sign-off the command prints a link instead. Approve it, then run `init` again, or pass `--wait 15m` and `init` opens the page and carries on once you approve. ## Example ```text $ npx @anlyonhq/cli init --yes Signing in. No account yet? The sign-in page lets you create one. Opening your browser to log in. If it does not open, visit: https://api.anlyon.com/api/auth/oauth2/authorize?... Installing @anlyonhq/sdk: npm install @anlyonhq/sdk Anlyon is set up in shop. login signed-in: profile default, workspace , environment production api key created: ANLYON_API_KEY in .env.local (not printed), .env* added to .gitignore sdk installed: @anlyonhq/sdk mcp .mcp.json added smoke test succeeded: anlyon-smoke-test, receipt eff_... (acknowledged) Next: - Restart your coding agent so it loads the anlyon MCP server; it signs in through the browser when it connects. - In code: new Client({ apiKey: process.env.ANLYON_API_KEY! }).actions.invoke(...) - Keep guardrails in the repo: anlyon pull writes this environment to anlyon.yaml; anlyon plan and anlyon apply change it. - Upgrade or check your plan: anlyon billing status, anlyon billing upgrade --plan starter. ``` `--json` prints the same report as one JSON document, for an agent to read. ## Connect an integration in the same step `--pack` installs a catalogue pack and connects its account: ```bash npx @anlyonhq/cli init --yes --pack github --wait 15m ``` - An integration you sign in to (HubSpot, Slack, Linear, GitHub, Notion) prints a link to the provider's consent page. With `--wait`, `init` opens it and waits for you to finish. - An integration that takes a key prints where to create one, and asks you to run `anlyon connections add ` in your own terminal. The key is typed at a hidden prompt and never passes through the agent. The sign-in for `--pack` also asks to store the account (**Secrets**) and install the pack's policies and limits (**Guardrails**). When the account is connected and the project has a GitHub remote, the smoke test reads that repository instead. ## Flags | Flag | Default | Meaning | | --- | --- | --- | | `--yes` | off | Confirm without prompting. Required when not interactive, as in an agent's shell. | | `--pack ` | none | Also install this catalogue pack (`github`, `hubspot`, ...) or a pack directory, and connect its account. | | `--wait ` | none | Wait this long for what needs you in the browser: a sign-off, or the pack's account. Without it, `init` prints the links and goes on. | | `--mcp ` | the ones found | `claude`, `cursor`, `codex`, comma-separated, or `none`. | | `--no-install` | off | Do not install the SDK; print the command. | | `--no-smoke` | off | Skip the governed call. | | `--api-url ` | `https://api.anlyon.com` | The API to sign in to. Written to the env file as `ANLYON_API_URL` when it is not the default. | | `--no-browser` | off | Print links instead of opening a browser. | Exit codes: 0 when the smoke test succeeded or was skipped, 12 when an approval policy holds it, 14 when it failed, 15 when a sign-off is pending, 10 when the env file holds a key for another environment. See [Scripting and CI](/cli/scripting#read-the-exit-code). ## What needs a browser, and why | Step | Why a person does it | | --- | --- | | Sign in or sign up | A person proves who they are; a key cannot. | | A provider's consent page | The account's owner grants access to it. | | A sign-off for something new an agent may do | An agent may never loosen its own guardrails. | | Payment | Card details go to the payment page, never the terminal. See [`anlyon billing upgrade`](/cli/commands#anlyon-billing-upgrade). | ## Next **[Keep guardrails in code](/cli/config-as-code)** `anlyon pull`, `plan` and `apply`: actions, policies, limits and budgets in `anlyon.yaml`, reviewed in pull requests. **[Quickstart by hand](/quickstart)** The same loop step by step, for one of your users' own accounts.