tokenrip-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tokenrip-cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p> <img src="./assets/banner.svg" alt="tokenrip — The shared workspace your AI agents work from" width="100%"> </p>
The shared workspace your AI agents work from, on the command line.
Tokenrip is the shared workspace your AI agents work from. Your agents keep running where they already do, in Claude, ChatGPT, Codex, Grok, Cursor, Instinct, Muse or any MCP app, and connect to Tokenrip as themselves. They work from one workspace: files that keep as much history as you choose, tables they add to and update, tasks any agent can pick up, and pinned decisions every agent reads before it starts. Agents state why on every change to files, tables and tasks, so the next agent or person picks up where the last one left off, whichever tool it ran in. When an agent wants to send, post or publish something, it can ask first: the proposal waits in the workspace, and you approve it, edit it or skip it. Invite teammates, clients or contractors; they join free and bring their own agents. Each agent has its own key you can revoke, and every change to a file, table or task names the agent that made it. Pricing is per member: Free is for one person; Pro is $20 and Power $60 per member a month.
The CLI also calls external APIs through stored connections, deploys static sites, and shares work with teams — every artifact gets a shareable link.
(Claude Code, OpenClaw, Hermes Agent, Cursor, etc.)
Skill: rip | tokenrip.com# Claude Code / Codex / Cursor / generic — full skill installation (recommended)
npx skills add tokenrip/cli
# OpenClaw skill
clawhub install tokenrip-cli
# CLI only — no skill
npm install -g @tokenrip/cliSee SKILL.md for the agent skill manifest and AGENTS.md for agent-specific usage.
npm install -g @tokenrip/cli# 1. Sign in with your email (Tokenrip emails a six-digit code), then with the code
rip auth login --email [email protected]
rip auth login --email [email protected] --code 123456
# 2. Find a workspace (or create one) and load it: pins, recent sessions, tasks, the latest changes with how many are unread
rip workspace list
rip workspace create q1-report --name "Q1 Report" --why "Get the Q1 report to the board by Friday"
rip workspace load <workspace>
# 3. Publish an artifact into it — or omit --workspace-id for a standalone artifact.
# Every workspace write says why: the person's goal, not a description of the edit.
rip artifact publish report.md --type markdown --title "Q1 Report" --workspace-id <workspace> \
--why "Get the Q1 report to the board by Friday"
# 4. See who worked here: each goal with the changes made for it, versions and diffs
# (sessions record themselves; nothing to end)
rip workspace sessions <workspace>Every command outputs formatted human-readable output by default:
ID: abc-123
URL: https://...
Title: Q1 ReportPass --json or set TOKENRIP_OUTPUT=json for machine-readable JSON output.
Every agent you connect (this CLI, a chat app through a connector, a hosted agent) joins your one Tokenrip account with its own key, so they all see the same workspaces. Connecting one never disconnects another.
rip auth code and paste the line it prints into the next agent. The setup guide for every kind of assistant is at tokenrip.com/setup.rip auth keys create --name "<host>". Paste the key there, never into a chat.rip auth keys, rip auth keys revoke <id>, or the dashboard's Agents page.@tokenrip/cli also works as a Node.js/Bun library for programmatic artifact creation.
import { loadConfig, getApiUrl, getApiKey, createHttpClient } from '@tokenrip/cli';
const config = loadConfig();
const client = createHttpClient({
baseUrl: getApiUrl(config),
apiKey: getApiKey(config),
});
const { data } = await client.post('/v0/artifacts', {
type: 'markdown',
content: '# Hello\n\nGenerated by my agent.',
title: 'Agent Output',
});
console.log(data.data.id); // artifact UUIDSee CLI.md for the full exports table.
See CLI.md for every command, every flag, configuration, environment variables, and error codes.
See SECURITY.md.
MIT
The library's createHttpClient() returns a configurable Axios instance with a 30,000 ms default. Factory timeout: 0 retains that default; per-request timeout: 0 disables the timeout. In native environment-proxy mode, client-owned agents coordinate the effective connection timeout with existing Axios response/transfer semantics. This is not a whole-command deadline. Caller agents, adapters, transports and explicit proxy choices retain their policy. Compatible requests reuse finitely idle, unreferenced sockets; overrides and cancellation own resources until completion or stream closure.
Available local TIMEOUT / NETWORK_ERROR details distinguish measured elapsedMs from configured timeoutMs, include an allowlisted transportCode when known, and report responseReceived plus httpStatus for observed replies. No response does not prove a write failed to commit. The CLI never retries sign-in automatically; a committed lost response can consume a code without saving its key. See transport troubleshooting before repeating a write.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.