CLI

The tracevault CLI captures AI session traces, pushes them to the server, and verifies commit compliance.

Installation

# Via Cargo
cargo install tracevault-cli

# Via Homebrew
brew install softwaremill/tracevault/tracevault

Quick Start

1. Log in

Authenticate with your TraceVault server using the device authorization flow. This opens a browser window for approval.

tracevault login --server_url https://your-server.example.com

Credentials are saved to ~/.tracevault/credentials.json. You can also authenticate via environment variables:

export TRACEVAULT_SERVER_URL=https://your-server.example.com
export TRACEVAULT_API_KEY=your-api-key

2. Initialize a repository

Run this in any Git repository you want to trace:

tracevault init

This creates a .tracevault/ directory, installs Claude Code hooks, and sets up git pre-push and post-commit hooks. If you're authenticated, it also registers the repository with the server.

You can pass the server URL directly if not yet logged in:

tracevault init --server_url https://your-server.example.com

3. Work normally

Once initialized, TraceVault works in the background. AI coding sessions are captured automatically via hooks. Commits are pushed to the server via the post-commit hook. Before each git push, policies are checked automatically via the pre-push hook.

4. Verify commits

Check that commits are registered and cryptographically sealed on the server:

# Verify specific commits
tracevault verify --commits abc1234,def5678

# Verify a range
tracevault verify --range abc1234..def5678

Verify shows the policy check result, signature status, and chain integrity for each commit. Exits with code 1 if any commit fails verification — useful for CI/CD gates.

Commands