Cadance CLI

Command-line tool for Cadance tunnels and persona configuration.

Installation

Linux & macOS

curl -fsSL https://raw.githubusercontent.com/cadance-io/cli/main/install.sh | sh

• Linux: Downloads prebuilt static binary to ~/.local/bin
• macOS: Installs via cargo install (installs Rust if needed)

Options:

• CADANCE_VERSION - Install specific version (default: latest)
• CADANCE_INSTALL_DIR - Custom directory (Linux only)

Windows / WSL / All Platforms

cargo install cadance

Verify: cadance --version

Direct Download

GitHub Releases - Linux binaries (static musl):

Architecture	File
x86_64	cadance-x86_64-unknown-linux-musl.tar.gz
ARM64	cadance-aarch64-unknown-linux-musl.tar.gz

Commands

tunnel

Expose a local port via Cadance tunnel.

cadance tunnel <PORT> --token <TOKEN> -e <ENVIRONMENT_ID>

persona set

Set persona environment config. Secret values are read from stdin (one per line, matching --secret order). Designed so secret values never appear in command arguments or LLM conversation context.

Generated secrets (passwords, random tokens) — value is born and consumed inside the pipe, never enters context:

openssl rand -base64 32 | cadance persona set <PID> <EID> -t <TOKEN> --secret DB_PASSWORD --stdin > /dev/null 2>&1 && echo "Done"

Multiple generated secrets:

{ openssl rand -base64 32; openssl rand -hex 16; } | cadance persona set <PID> <EID> -t <TOKEN> -s API_KEY -s DB_PASS --stdin > /dev/null 2>&1

User-known secrets (third-party API keys, existing credentials) — the LLM provides the command template, the user runs it themselves in a separate terminal:

# Run this in a separate terminal — paste your value and press Enter
cadance persona set <PID> <EID> -t <TOKEN> --secret STRIPE_KEY --stdin

Attributes (non-secret, safe to show in context):

cadance persona set <PID> <EID> -t <TOKEN> --attribute locale=fr --attribute region=us-east-1

persona get

Get persona environment config as JSON. Output should be piped directly to a consumer process — never captured into the LLM context.

# Pipe directly to a process (values never enter LLM context)
cadance persona get <PID> <EID> -t <TOKEN> | my-process --config -

# Write to a file for a local process to read
cadance persona get <PID> <EID> -t <TOKEN> > /tmp/.config.json && my-process --config /tmp/.config.json && rm /tmp/.config.json

Secret handling rules for LLM clients

When an LLM uses these commands via MCP, it must follow these rules:

1. Generated secrets: pipe generation directly into the command, suppress all output
2. User-known secrets: provide the command template, instruct the user to run it in a separate terminal
3. Never capture: never use $(...) or backticks to capture secret output into shell variables within the LLM's own context

Environment Variables

Variable	Description
CADANCE_TOKEN	Auth token (alternative to --token)
CADANCE_API_URL	API endpoint (default: https://api.cadance.io)
CADANCE_ENVIRONMENT_ID	Environment ID for tunnel (alternative to -e)

License

MIT