How do I install the CLI Auth skill?

Run npx skillmds@latest add pymc-labs/cli-auth in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the CLI Auth skill do?

Obtain CLI access tokens via the daimon MCP server's get_cli_token tool. It is listed under AI & ML on SkillMD.

Is CLI Auth safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with CLI Auth?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is CLI Auth free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published CLI Auth?

pymc-labs (@pymc-labs) published this skill. Their other Agent Skills are listed on their SkillMD profile.

CLI Auth by pymc-labs — Agent Skill

Name: CLI Auth
Author: pymc-labs

File contents

cli-auth

Use the daimon MCP server's get_cli_token(service) tool to obtain access tokens for external CLIs. Export the result under the appropriate name before running CLI commands.

Service	Tool call	Name to export
GitHub	`get_cli_token("github")`	`GH_TOKEN` (or `GITHUB_TOKEN`)
Google Cloud / Workspace	`get_cli_token("gcloud")`	`CLOUDSDK_AUTH_ACCESS_TOKEN`

Call the MCP tool first, then pass its result privately to the shell process environment before running a command such as gh repo list. get_cli_token is an MCP tool, not a shell command.

The tool requires:

For github: the caller must already have a matching GitHub token binding. An account-only call reads the account's token; an agent-bound call reads that agent's token. Ordinary chat currently uses account-only identity, so request_repo_binding saving a target agent's token does not make it available to this tool. A GitHub App installation alone does not supply it either. If access is missing, ask the operator to configure CLI token access for the calling identity; do not repeatedly ask the person to bind the repo.
For gcloud: the operator must configure deployment Google access and bind the agent to a Google identity with daimon agents bind-google <agent> <email> --scopes <scope>, repeating --scopes for additional scopes. Tokens are short-lived (≈1 hour) impersonated access tokens. The call also needs an agent-bound identity, which ordinary chat does not currently provide. Binding the Google identity alone cannot fix a missing caller agent_id; hand that limitation to the operator.

Each call resolves access afresh. GitHub returns the stored personal token; Google mints a short-lived impersonated token. Never print either value.

---name: cli-authdescription: Obtain CLI access tokens via the daimon MCP server's get_cli_token tool.---# cli-authUse the daimon MCP server's `get_cli_token(service)` tool to obtain accesstokens for external CLIs. Export the result under the appropriate namebefore running CLI commands.| Service | Tool call | Name to export ||--------------------------|----------------------------|-------------------------------|| GitHub | `get_cli_token("github")` | `GH_TOKEN` (or `GITHUB_TOKEN`)|| Google Cloud / Workspace | `get_cli_token("gcloud")` | `CLOUDSDK_AUTH_ACCESS_TOKEN` |Call the MCP tool first, then pass its result privately to the shell processenvironment before running a command such as `gh repo list`.`get_cli_token` is an MCP tool, not a shell command.The tool requires:- For `github`: the caller must already have a matching GitHub token binding. An account-only call reads the account's token; an agent-bound call reads that agent's token. Ordinary chat currently uses account-only identity, so `request_repo_binding` saving a target agent's token does not make it available to this tool. A GitHub App installation alone does not supply it either. If access is missing, ask the operator to configure CLI token access for the calling identity; do not repeatedly ask the person to bind the repo.- For `gcloud`: the operator must configure deployment Google access and bind the agent to a Google identity with `daimon agents bind-google <agent> <email> --scopes <scope>`, repeating `--scopes` for additional scopes. Tokens are short-lived (≈1 hour) impersonated access tokens. The call also needs an agent-bound identity, which ordinary chat does not currently provide. Binding the Google identity alone cannot fix a missing caller `agent_id`; hand that limitation to the operator.Each call resolves access afresh. GitHub returns the stored personal token;Google mints a short-lived impersonated token. Never print either value.

Frequently asked questions

CLI Auth