tridentctl is the Trident command-line client. Use it to scan your local development environment for LLM API keys and SDK wiring, run promptfoo-based security evaluations with watch mode, and verify Trident agent certificates without needing an account. It communicates only with public Trident endpoints — no credentials required for cert, verify, and jwks commands.
Requirements
- Node.js 18 or later —
tridentctlis an ESM Node.js script that uses the built-infetch,crypto, andfs/promisesAPIs.
Install globally
Install once and use from anywhere in your terminal:Use without installing
Run any command on-demand withnpx — no global install required:
Set your API credentials (optional)
Theinit command inspects your local environment without any credentials. The cert, verify, and jwks commands also require no authentication — they hit public endpoints.
If you are using tridentctl in scripts that call authenticated Trident API endpoints, set these environment variables:
You can find both keys in the Trident dashboard under Project Settings → API Keys.
Add them to your shell profile or a
.env file that your scripts load:
Quick test: scan your local environment
Runtridentctl init from the root of any project directory to see what Trident can detect and what it recommends you wire up:
tridentctl init reads your environment variables, .env/.env.local files, AWS credentials, gcloud config, 1Password vault, package.json dependencies, and source files — then prints a table of what it found and what to connect to Trident. It is read-only and never modifies your environment.
Override the base URL
By default,tridentctl connects to http://localhost:3000 (for local development) or the value of the VOUCH_BASE_URL environment variable. To point at the production Trident service, pass --base: