> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tinfoil.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI

> Command-line interface for verifying Tinfoil enclave attestations and making verified HTTP requests

<Card title="View on GitHub" icon="github" href="https://github.com/tinfoilsh/tinfoil-cli" horizontal>
  tinfoilsh/tinfoil-cli
</Card>

## Overview

The Tinfoil CLI verifies enclave attestations, audits TLS certificates, and makes verified HTTP requests against Tinfoil enclaves. For a local OpenAI-compatible proxy, see the [Local Proxy](/local-proxy/app) section.

## Installation

### Pre-built Binaries

Download the latest release for your OS from the [Releases](https://github.com/tinfoilsh/tinfoil-cli/releases) page.

### Install Script

You can install tinfoil CLI using our install script. This script automatically detects your operating system and architecture, downloads the correct binary, and installs it to `/usr/local/bin`.

```bash theme={"dark"}
curl -fsSL https://github.com/tinfoilsh/tinfoil-cli/raw/main/install.sh | sh
```

<Note>
  If you receive permission errors (for example, if you're not running as root), you may need to run the command with sudo.
</Note>

### Build from Source

1. Ensure you have Go installed.
2. Clone the repository:

```bash theme={"dark"}
git clone https://github.com/tinfoilsh/tinfoil-cli.git
cd tinfoil-cli
```

3. Build the binary:

```bash theme={"dark"}
go build -o tinfoil
```

## Command Reference

```text theme={"dark"}
Usage:
  tinfoil [command]

Available Commands:
  attestation Attestation commands
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  http        Make verified HTTP requests

Flags:
  -h, --help          Help for tinfoil
  -e, --host string   Enclave hostname
  -r, --repo string   Enclave config repo
  -t, --trace         Trace output
  -v, --verbose       Verbose output

Use "tinfoil [command] --help" for more information about a command.
```

## HTTP Requests

The `http` command makes verified HTTP requests to Tinfoil enclaves with attestation verification.

### GET Request

```bash theme={"dark"}
tinfoil http get https://inference.tinfoil.sh/health \
  -e inference.tinfoil.sh \
  -r tinfoilsh/confidential-model-router
```

### POST Request

```bash theme={"dark"}
tinfoil http post https://inference.tinfoil.sh/v1/chat/completions \
  -e inference.tinfoil.sh \
  -r tinfoilsh/confidential-model-router \
  -H "Authorization: Bearer $TINFOIL_API_KEY" \
  -H "Content-Type: application/json" \
  -b '{"model": "<MODEL_NAME>", "messages": [{"role": "user", "content": "Hello"}]}'
```

#### Streaming

Use the `-s` flag to stream the response line by line:

```bash theme={"dark"}
tinfoil http post https://inference.tinfoil.sh/v1/chat/completions \
  -e inference.tinfoil.sh \
  -r tinfoilsh/confidential-model-router \
  -H "Authorization: Bearer $TINFOIL_API_KEY" \
  -H "Content-Type: application/json" \
  -s \
  -b '{"model": "<MODEL_NAME>", "stream": true, "messages": [{"role": "user", "content": "Hello"}]}'
```

### Command Options

* `-b, --body`: HTTP POST body
* `-H, --header`: HTTP request header, in `Name: Value` format. May be repeated
* `-s, --stream`: Stream response output (POST only)

## Attestation Verification

### Verify Attestation

Use the `attestation verify` command to manually verify that an enclave is running the expected code. The output will be a series of INFO logs describing each verification step.

Sample successful output:

```bash theme={"dark"}
$ tinfoil attestation verify \
  -e inference.tinfoil.sh \
  -r tinfoilsh/confidential-model-router
INFO[0000] Fetching latest release for tinfoilsh/confidential-model-router
INFO[0000] Fetching sigstore bundle from tinfoilsh/confidential-model-router for digest f2f48557c8b0c1b268f8d8673f380242ad8c4983fe9004c02a8688a89f94f333
INFO[0001] Fetching trust root
INFO[0001] Verifying code measurements
INFO[0001] Fetching attestation doc from inference.tinfoil.sh
INFO[0001] Verifying enclave measurements
INFO[0001] Public key fingerprint: 5f6c24f54ed862c404a558aa3fa85b686b77263ceeda86131e7acd90e8af5db2
INFO[0001] Measurements match
```

### JSON Output

You can also record the verification to a machine-readable audit log:

```bash theme={"dark"}
tinfoil attestation verify \
  -e inference.tinfoil.sh \
  -r tinfoilsh/confidential-model-router \
  -j > verification.json
```

Or use the `-l` flag to specify the output file directly:

```bash theme={"dark"}
tinfoil attestation verify \
  -e inference.tinfoil.sh \
  -r tinfoilsh/confidential-model-router \
  -j -l verification.json
```

The audit log record includes the timestamp, enclave host, code and enclave measurement fingerprints, and the verification status.

### Command Options

* `-j, --json`: Output in JSON format
* `-l, --log-file`: Path to write the JSON log
* `-e, --host`: The hostname of the enclave. If omitted, auto-selects the default router.
* `-r, --repo`: The enclave config repo. If omitted, skips code measurement verification.

## Docker

A docker image is available at `ghcr.io/tinfoilsh/tinfoil-cli`.