Prefer local CLI execute

When Node is 22 or newer and @kodycodes/cli is available, run one-off modules with local execute. Do not use hosted MCP execute. This skill and Local CLI execute (guide:local_execute) are the source of truth. Open API fallback: Open API (guide:open_api).

Local CPU is not counted as execute or dynamic_worker_day. Capabilities called through the proxy still meter normally. Prefer KODY_API_TOKEN in the environment over --token so the secret is not visible in process arguments.

Command

Agents already on MCP: call cliCredentialBootstrap with a required lifetime (single-task agents use short), then run the returned cli_command (it already includes lifetime flags). Humans who can finish browser OAuth: npx @kodycodes/cli login once. CI with no MCP session and no interactive login: set KODY_API_TOKEN in the environment. Never paste a kody_at_… into chat.

{
	"operationId": "cliCredentialBootstrap",
	"params": { "lifetime": "short" }
}

npx @kodycodes/cli auth bootstrap --code 'kody_bc_…' --lifetime short
npx @kodycodes/cli execute --local --code 'import { kody } from "kody:runtime"; export default async function main() { return await kody.metaGetCurrentUser({}) }'

Saved packages keep --local and a static kody:@… import.

Failure

The CLI errors name the fix for a missing lifetime, a rejected bootstrap code, and insufficient_scope (including search:read; scopes replace the defaults, see ADR 0056). Follow the message. Judgment calls the CLI cannot make:

• Node is below 22, the CLI is missing, or the host cannot run workerd. Use Open API / MCP api, or fix the environment. Hosted MCP execute stays banned.
• While an MCP session exists, remint with cliCredentialBootstrap instead of switching to kody login or tokenCreate.
• Saved packages keep --local and a static kody:@… import.
• Credential priority is --token / KODY_API_TOKEN, then the stored bootstrap token, then kody login.