> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetrident.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Install and Configure the tridentctl CLI for Trident

> Install tridentctl to scan your local environment, run promptfoo security evaluations, and verify agent certificates from the command line.

`tridentctl` is the Trident command-line client. Use it to scan your local development environment for LLM API keys and SDK wiring, run promptfoo-based security evaluations with watch mode, and verify Trident agent certificates without needing an account. It communicates only with public Trident endpoints — no credentials required for `cert`, `verify`, and `jwks` commands.

## Requirements

* **Node.js 18 or later** — `tridentctl` is an ESM Node.js script that uses the built-in `fetch`, `crypto`, and `fs/promises` APIs.

## Install globally

Install once and use from anywhere in your terminal:

```bash theme={null}
npm install -g @trident/cli
```

Verify the installation:

```bash theme={null}
tridentctl --version
# 0.1.0

tridentctl --help
```

## Use without installing

Run any command on-demand with `npx` — no global install required:

```bash theme={null}
npx tridentctl <command>
```

This is useful in CI environments where you do not want a global install or when you want to pin to the latest published version.

## Set your API credentials (optional)

The `init` command inspects your local environment without any credentials. The `cert`, `verify`, and `jwks` commands also require no authentication — they hit public endpoints.

If you are using `tridentctl` in scripts that call authenticated Trident API endpoints, set these environment variables:

| Variable                     | Description                                  |
| ---------------------------- | -------------------------------------------- |
| `TRIDENT_PROJECT_PUBLIC_KEY` | Your project Public Key (prefix `pk_live_…`) |
| `TRIDENT_PROJECT_SECRET_KEY` | Your project Secret Key (prefix `sk_live_…`) |

You can find both keys in the Trident dashboard under **Project Settings → API Keys**.

Add them to your shell profile or a `.env` file that your scripts load:

```bash theme={null}
export TRIDENT_PROJECT_PUBLIC_KEY="pk_live_abc123"
export TRIDENT_PROJECT_SECRET_KEY="sk_live_xyz789"
```

## Quick test: scan your local environment

Run `tridentctl init` from the root of any project directory to see what Trident can detect and what it recommends you wire up:

```bash theme={null}
cd ~/my-ai-project
tridentctl init
```

`tridentctl init` reads your environment variables, `.env`/`.env.local` files, AWS credentials, gcloud config, 1Password vault, `package.json` dependencies, and source files — then prints a table of what it found and what to connect to Trident. It is read-only and never modifies your environment.

## Override the base URL

By default, `tridentctl` connects to `http://localhost:3000` (for local development) or the value of the `VOUCH_BASE_URL` environment variable. To point at the production Trident service, pass `--base`:

```bash theme={null}
tridentctl cert <hash> --base https://app.usetrident.dev
```

Or set the environment variable once:

```bash theme={null}
export VOUCH_BASE_URL=https://app.usetrident.dev
tridentctl cert <hash>
```

## Next steps

See the [Command Reference](/cli/reference) for full documentation of every command, including flags, example output, and CI usage patterns.