# Official CLI Catalog

This catalog lists services with official or first-party CLIs that are natural Toolbelt targets. It is intentionally broader than the author's personal stack.

Toolbelt's model: install/login to the official CLI locally, then let Toolbelt expose safe, structured, policy-gated operations to Pi.

## How users should install CLIs

You can ask Pi directly:

```text
Install the official GitHub CLI on this machine, verify it works, and then configure Toolbelt to use it.
```

Good Pi installation flow:

1. Detect OS and package manager.
2. Install the official CLI from the vendor-recommended source.
3. Run `<cli> --version` or equivalent.
4. Guide the user through `<cli> login` if needed.
5. Run a read-only status command.
6. Add or verify the Toolbelt provider definition.

## Cloud and infrastructure

| Service | CLI | Common install path | Good agent-safe reads |
| --- | --- | --- | --- |
| AWS | `aws` | AWS CLI installer / package manager | identity, regions, resources, logs, costs metadata |
| Google Cloud | `gcloud` | Google Cloud SDK | projects, services, deploys, logs |
| Azure | `az` | Azure CLI | account, groups, resources, deployments |
| Cloudflare | `wrangler` | npm | workers, deployments, routes, KV/R2 metadata |
| DigitalOcean | `doctl` | package manager / GitHub releases | droplets, apps, databases, registries |
| Linode/Akamai | `linode-cli` | pip | instances, volumes, networking |
| Scaleway | `scw` | package manager / releases | projects, instances, storage |
| Oracle Cloud | `oci` | OCI CLI installer | identity, compute, storage |
| IBM Cloud | `ibmcloud` | IBM Cloud CLI installer | account, resources, services |
| Hetzner Cloud | `hcloud` | package manager / releases | servers, networks, volumes |

## Hosting, deploy, and frontend platforms

| Service | CLI | Common install path | Good agent-safe reads |
| --- | --- | --- | --- |
| Vercel | `vercel` | npm | projects, deployments, logs, domains, env names |
| Netlify | `netlify` | npm | sites, deploys, functions, env names |
| Railway | `railway` | npm / official installer | projects, services, deployments, variables metadata |
| Render | `render` | official installer | services, deploys, logs, blueprints |
| Fly.io | `fly` | official installer | apps, machines, deploys, logs, volumes |
| Heroku | `heroku` | official installer / npm | apps, releases, dynos, logs, config names |
| Firebase | `firebase` | npm | projects, deploys, functions, hosting channels |
| Supabase | `supabase` | npm / package manager | projects, DB branches, functions, migrations |
| Cloud Foundry | `cf` | package manager | orgs, spaces, apps, services |
| Platform.sh | `platform` | official installer | projects, environments, activities |

## Source control and CI/CD

| Service | CLI | Common install path | Good agent-safe reads |
| --- | --- | --- | --- |
| GitHub | `gh` | package manager | repos, PRs, issues, checks, runs, releases |
| GitLab | `glab` | package manager | merge requests, issues, pipelines, releases |
| Bitbucket / Atlassian | `acli` | Atlassian CLI | repos, pipelines, tickets where supported |
| Buildkite | `bk` | package manager / releases | pipelines, builds, agents |
| CircleCI | `circleci` | official installer | pipelines, workflows, jobs |
| Travis CI | `travis` | gem | repos, builds, logs |
| Jenkins | `jenkins-cli.jar` | Jenkins server | jobs, builds, queue, logs |
| Argo CD | `argocd` | official releases | apps, sync status, history |
| Flux | `flux` | official releases | reconciliation status, resources |

## Observability and incident response

| Service | CLI | Common install path | Good agent-safe reads |
| --- | --- | --- | --- |
| Sentry | `sentry-cli` | npm / releases | orgs, projects, releases, issues, deploys |
| Datadog | `datadog-ci` / `datadog` | npm / pip | CI visibility, synthetics, monitors where supported |
| New Relic | `newrelic` | official CLI | entities, deployments, diagnostics |
| Grafana | `grafana` / `grr` / `grafana-cli` | official tools | dashboards, plugins, resources where supported |
| Prometheus | `promtool` | Prometheus distribution | rules, config, metrics checks |
| PagerDuty | `pd` / official tooling | package manager where available | incidents, services, on-call |
| Opsgenie | `opsgenie` | Atlassian tooling / API CLI | alerts, schedules |

## Payments, billing, and commerce

| Service | CLI | Common install path | Good agent-safe reads |
| --- | --- | --- | --- |
| Stripe | `stripe` | official installer / package manager | balance, events, customers metadata, invoices, products |
| Shopify | `shopify` | npm / Ruby gem | apps, themes, stores, deploy previews |
| Paddle | community/API CLI if available | generated/custom | products, prices, transactions metadata |
| Square | API/generator path | generated/custom | payments, catalog metadata |

## Auth, identity, and user management

| Service | CLI | Common install path | Good agent-safe reads |
| --- | --- | --- | --- |
| Auth0 | `auth0` | official installer / package manager | tenants, apps, connections, logs |
| Clerk | `clerk` | npm | apps, envs, auth resources |
| Okta | `okta` | package manager / official releases | org info, apps, users metadata |
| 1Password | `op` | official installer | item metadata, vault metadata; avoid secret values |
| Doppler | `doppler` | official installer | projects, configs, secret names only |
| Infisical | `infisical` | npm / official installer | projects, environments, secret names only |
| Phase | `phase` | official CLI | apps, environments, secret names only |

## Databases and data platforms

| Service | CLI | Common install path | Good agent-safe reads |
| --- | --- | --- | --- |
| Neon | `neonctl` | npm | projects, branches, databases, operations |
| PlanetScale | `pscale` | package manager | orgs, databases, branches, deploy requests |
| MongoDB Atlas | `atlas` | package manager | projects, clusters, backups |
| CockroachDB | `cockroach` | official binary | clusters, SQL metadata |
| Databricks | `databricks` | package manager | workspaces, jobs, clusters, apps |
| Snowflake | `snow` | Snowflake CLI | connections, stages, objects metadata |
| dbt Cloud / dbt | `dbt` | pip | runs, models, docs, tests |
| Redis Cloud | API/generator path | generated/custom | databases, subscriptions metadata |

## Messaging, email, and communications

| Service | CLI | Common install path | Good agent-safe reads |
| --- | --- | --- | --- |
| Twilio | `twilio` | npm | projects, phone numbers, messaging services |
| SendGrid | API/generator path | generated/custom | sender identities, templates, stats |
| Resend | `resend` | npm | domains, API key metadata, emails, broadcasts |
| Mailgun | API/generator path | generated/custom | domains, routes, events |
| Slack | `slack` | official CLI | apps, manifests, deploys |
| Discord | API/generator path | generated/custom | app/bot metadata where appropriate |

## AI and developer APIs

| Service | CLI | Common install path | Good agent-safe reads |
| --- | --- | --- | --- |
| OpenAI | `openai` | official CLI / package manager | models, files, batch metadata |
| Anthropic | `ant` | official CLI where available | API resources, usage where supported |
| Hugging Face | `huggingface-cli` / `hf` | pip | repos, models, datasets, spaces |
| Ollama | `ollama` | official installer | local models, pulls, running models |
| Modal | `modal` | pip | apps, functions, deployments |
| Replicate | community/API CLI | generated/custom | models, predictions metadata |

## Media, realtime, and product APIs

| Service | CLI | Common install path | Good agent-safe reads |
| --- | --- | --- | --- |
| LiveKit | `lk` | official releases | projects, rooms, egresses, tokens metadata |
| Mux | API/generator path | generated/custom | assets, live streams, playback IDs |
| Algolia | `algolia` | npm / official | apps, indexes, settings |
| Meilisearch | `meilisearch` / API CLI | official/custom | indexes, tasks, stats |
| Contentful | `contentful` | npm | spaces, environments, entries metadata |
| Sanity | `sanity` | npm | projects, datasets, deploys |
| Storyblok | `storyblok` | npm | spaces, components, stories metadata |

## If the CLI is missing

Use a generator path:

- CLI-Anything: https://github.com/HKUDS/CLI-Anything
- CLI-Anything Web: https://github.com/ItamarZand88/CLI-Anything-WEB
- OpenAPI-to-CLI tools such as OnlyCLI when a clean OpenAPI spec exists

Then wrap the generated CLI with Toolbelt by defining safe, mutating, and blocked commands.

## Catalog policy

A CLI belongs in this catalog when it has at least one of:

- official vendor support
- widely adopted first-party repository
- stable documented auth flow
- JSON output or machine-readable mode
- safe read operations useful to agents

Toolbelt adapters should prefer official CLIs first, generated CLIs second, and raw API calls last.