CLI

A standalone binary with no runtime dependency, and a ready-made skill file for coding agents.

unseal-space is a single executable that bundles the SDK and its runtime. The target machine needs no Node.js, Bun, or installed JavaScript dependencies — which is what makes it the right surface for a coding agent working inside a sandbox.

Install

curl -fsSL https://assets.unseal.space/cli/install.sh | sh

Then set the key and confirm it works:

export UNSEAL_SPACE_API_KEY=…
unseal-space --help

The CLI updates itself from the same release channel with unseal-space upgrade (--check for a read-only check).

Discover commands from the CLI, not from here

unseal-space --help, then unseal-space <group> <command> --help, is the source of truth for commands, options, outputs, and the permissions each one needs. It is progressively disclosed, so a listing here would go stale.

The command groups are: projects and preview, messages and attachments, publish, env (write-only environment variables), version (history and restore), domain (registered domains), connected-domain (domains you own elsewhere), and mcp (serve the same capabilities to an MCP Host).

Every command writes JSON Lines to stdout and structured failures to stderr, so output is machine-readable without a parsing layer.

Configuration

Variable	Meaning
`UNSEAL_SPACE_API_KEY`	Workspace API key
`UNSEAL_SPACE_API_URL`	API base URL. Defaults to `https://api.unseal.space`

The older builder binary name and BUILDER_* variables still work as deprecated aliases.

Values never appear in output

env set takes its value from stdin (a TTY gets a hidden prompt) or --value-file. There is no --value argument, and no command output ever contains a value — including error messages. This is enforced, not a convention.

printf '%s' "$DATABASE_URL" | unseal-space env set --name DATABASE_URL
unseal-space env list   # metadata only, and `stale` until preview restarts

Serving it to an MCP Host

The same binary can serve the platform's tools over MCP with unseal-space mcp serve. Reach for that when the agent is driven by an MCP Host and you want typed tools, stated permissions and approval prompts instead of shell invocations.

Driving it from an agent

The platform publishes a SKILL.md integration pack for coding agents. Point your agent at it and it will follow the discover → execute → verify loop the CLI is designed for:

Discover — run --help down to the exact command path.
Execute — run it, reusing an idempotency key only on an identical retry.
Verify — pair message send with message wait, and deployment create with deployment wait.

version restore rewrites the working tree the project keeps building on. deployment create --version ships an old version without touching the working tree. They are not interchangeable — pick by whether you want to change what you build on, or only what production serves.