Skip to navigation

Sign in

One browser sign-in, shared by the CLI and every agent on this computer.

talotrace login          # opens your browser; tunnels only
talotrace login --tools  # also lets your agent start runs and read evidence
talotrace status         # who you are signed in as
talotrace logout         # revoke and forget this sign-in

Two levels of sign-in

CommandWhat it allows
talotrace loginServe your local ports to TaloTrace runs. Nothing else.
talotrace login --toolsThe above, and let this computer start runs and read their evidence. Your coding agent needs this level.

A tool that needs the wider level answers INSUFFICIENT_SCOPE. Sign in with --tools yourself, or let your agent run it after you say yes. An agent never signs in wider on its own, and a non-interactive session never counts as consent.

Where it is kept

The sign-in lives in your operating system’s keychain and is shared by the CLI and every MCP process. If the keychain does not answer, login refuses. Use a project API key instead.

On a computer with no browser, talotrace login --no-browser prints the sign-in address instead of opening it.

Sign out

talotrace logout revokes the sign-in on this computer. talotrace logout --all-scopes ends every sign-in of this server, not just the active one.

A session that a sign-in opened is visible only to that sign-in. A run started with an API key cannot use a tunnel opened by your browser sign-in, and the other way round. The refusal says which one owns the tunnel.