Docs · How to

How to: connect from the terminal

Install the NibWP CLI and connect a site with one command: your browser opens, your site asks what to allow, and no password is stored anywhere.

The CLI connects a site in one command. Your browser opens, your own site asks which permissions to grant, you approve — and nothing is stored on your machine except a token you can revoke.

It exists because the alternative is fiddly: pick your client from a list, copy a block of JSON, find the right file on disk, merge it in without breaking the servers already there, restart the app. That works, and the Connect screen still walks you through it. This is the shorter road.

TL;DR

Install with one line, run nibwp auth login https://yoursite.com, approve in the browser. Then nibwp agent add cursor sets up your editor for you.

Install it

You need Node.js 20 or newer. Pick the line for your system — everything after this is identical, and the command is always nibwp.

macOS & Linuxshell
curl -fsSL https://raw.githubusercontent.com/nibwp/nibwp-cli/main/install.sh | sh
Windowspowershell
irm https://raw.githubusercontent.com/nibwp/nibwp-cli/main/install.ps1 | iex

Both installers do the same thing: check your Node version, install the package, and confirm it runs. If you would rather do it yourself, or you already know npm:

any systemshell
npm install -g nibwp-cli

# or run it once, without installing
npx nibwp-cli auth login https://yoursite.com

Connect a site

Sign in to that site as an administrator in your browser first, then run:

connectshell
nibwp auth login https://yoursite.com

Your browser opens on your own site’s approval screen. Nothing is brokered through us: the site issues the token itself, so this works behind a VPN or on an intranet just as well.

Choose what it may do

By default a connection is granted reading and writing. You can ask for less, or for more, and the site is what enforces the answer — a connection approved for reading cannot write, whatever the client asks for.

scopesshell
# read only — safe to leave in a script or a CI job
nibwp auth login https://yoursite.com --scope read

# everything, including files and running code
nibwp auth login https://yoursite.com --scope read,write,manage,files,code
ScopeTypeWhat it allows
readreadView posts, pages, media, settings and site information. Changes nothing.
writewriteAdd and update content. Cannot delete.
managedangerDelete content, users and media, and run bulk changes.
filesdangerRead and write theme and plugin files, uploads and configuration.
codedangerWrite and run PHP in the sandbox. The widest permission there is.
Start narrowGive a new connection read and watch it work for an afternoon. Widening later is one command; explaining a deleted page is not.

Point your editor at it

Once a site is connected, the CLI can write that connection into your editor’s own configuration — merged into whatever is already there, with a backup of the previous file.

editorsshell
nibwp agent add cursor --project
nibwp agent add vscode
nibwp agent add claude-code

Supported: cursor, vscode, claude-code, codex, windsurf, gemini-cli, opencode, cline. Clients whose settings live in a format that cannot be merged safely get the exact command to run instead — a half-written config file is worse than a line you paste yourself.

For a client that can only talk to local programs, nibwp mcp bridges it over the connection you already approved, so no password has to exist for it either.

Use it

everydayshell
nibwp discover "build a landing page"     # what this site can do
nibwp describe nibwp/find-tools           # what that ability needs
nibwp run nibwp/find-tools --input '{"query":"pending updates"}'
nibwp auth list                           # every site you have connected

Add --json to anything you want to pass to another tool.

When something is not working

doctorshell
nibwp doctor
  • Node too old — the CLI needs 20 or newer, and says so rather than failing strangely.
  • Site unreachable — wrong address, or the plugin is not active.
  • AI Abilities switched off — the connection works but reaches nothing. Turn it on under NibWP → Connect.
  • Token rejected — the connection was revoked on the site. Sign in again.
Signing outnibwp auth logout asks the site to revoke the token and deletes the local copy either way, so a credential never survives a logout.

FAQ

Do I need the CLI to use NibWP?
No. Everything it does can be done from the Connect screen and your assistant. The CLI is faster to set up and adds things a browser cannot do, like working across every site at once.
Where are my credentials kept?
In a file separate from your settings, readable only by your user account. It is never printed, never logged, and removed when you log out.
Is it safe to pipe an installer into a shell?
It runs a script from a public repository you can read first. If you would rather not, npm install -g nibwp-cli does exactly the same thing.
Does it work with an older NibWP?
Yes. On a site that predates the CLI it falls back to the standard discovery documents, so connecting works; only the finer diagnostics need a current version.
Can I use it in CI?
Yes. Connect once with --scope read, and every command returns proper exit codes and --json output.

Work across every site

Once more than one site is connected, one command can reach all of them.

Several sites at once

Connect your first agent.

Follow the quickstart, or book a demo and we'll walk you through it.