Hive MCP 命令行工具

hive-mcp-cli

The hive command: sets up hive-mcp on your machine and signs you in to your hive account. hive-mcp gives Claude Code persistent memory, a knowledge graph, kanban and swarm coordination.

Quick start

curl -fsSL https://hive-mcp.com/install.sh | sh    # 1. the hive CLI (10 seconds)
hive setup                                         # 2. everything else (about 5 minutes)
hive start                                         # 3. boot the backend (about a minute)

Install with curl -fsSL https://hive-mcp.com/install.sh | sh then hive setup. hive setup installs bb-mcp, publishes it at ~/.local/share/hive-mcp/bb-mcp, and registers hive with your MCP clients (Claude Code, Codex) through bb-mcp. Already have bb-mcp checked out somewhere? Run <that checkout>/bb-mcp setup: wherever bb-mcp lives becomes the reference. Verify with bb-mcp setup --check.

Open a new terminal, start claude (or codex) in any project, and hive is there. That is the free (FOSS) build, and it needs no account.

{
  "mcpServers": {
    "hive": {
      "command": "${HOME}/.local/share/hive-mcp/bb-mcp/start-bb-mcp.sh"
    }
  }
}

Subscribers add one more step:

hive login                  # opens your browser; sign in; you are done
hive addon add hive-carto   # any addon on your plan; then restart Claude Code

No keys to copy, no XML to paste.

Signing in

hive login works like gh auth login:

• With a browser, it opens the sign-in page and waits for the redirect back to the CLI. You sign in the way you do on the web, including a second factor if your account has one.

• Over ssh, or on a machine without a display, it prints a one-time code instead:

  复制

    First copy your one-time code: WDJB-MJHT
    Then open:                     https://auth.hive-mcp.com/realms/hive/device
  

  Open that URL on your laptop or phone, enter the code, and approve. The terminal continues. hive login --device forces this mode.

Once signed in, the CLI:

1. keeps your session in the system keyring: GNOME Keyring or KWallet, the macOS Keychain, or the Windows Credential Manager. A machine without a keyring uses ~/.config/hive/credentials.json instead, mode 0600, and hive login says so.
2. creates an artifact token for this machine only, named after its hostname. It writes the token to ~/.m2/settings.xml, which is what lets Maven download paid addons. The token appears in your dashboard, so you can revoke it there.
3. prints who you are signed in as and what your plan includes.

hive auth status   # who is signed in, where the session is stored, what is set up
hive auth token    # a current access token, for scripts that call the store API
hive logout        # revokes this machine's token, removes it, ends the session

In CI, where no browser is available, pass a token you created in the dashboard: printf %s "$HIVE_ARTIFACT_TOKEN" | hive login --with-token. Setting HIVE_STORE_TOKEN overrides the session for store API calls.

Adding addons

hive addon search            # the whole shelf; `hive addon search graph` narrows it
hive addon show hive-carto   # what it does and needs, and whether your plan includes it
hive addon add hive-carto    # load it into your host

addon add writes the coordinate to ~/hive-mcp/local.deps.edn, your personal overlay. It is gitignored, and the launcher merges it over the starter pack at every boot. If you already wrote that file yourself, the command leaves it alone and prints the lines to add. After adding, restart Claude Code, or run /mcp and reconnect hive.

Updating

Your MCP clients launch bb-mcp through the anchor ~/.local/share/hive-mcp/bb-mcp, so an update is a fast-forward of the checkout it points at. bb-mcp prints one line on stderr when a newer release exists; then:

hive update --dry-run   # the plan: which checkout, which commands
hive update             # git fetch + fast-forward bb-mcp, then bb-mcp setup --check
hive update --all       # also the hive-mcp checkout ($HIVE_MCP_DIR, ~/hive-mcp)

It never stashes, rebases or switches branch for you. A checkout with local changes to tracked files, a detached HEAD, or no tracked branch is left alone, with the command that gets it unstuck. Restart your MCP clients afterwards (and hive start the backend again after --all).

Let Claude do it

The installer also teaches Claude Code the whole procedure. It installs two skills and a small setup MCP server. In Claude Code you can then say:

set up hive for me

I have a hive subscription, set up the paid addons

Claude runs hive setup, hive login and hive addon add for you. Your password and tokens never pass through the conversation: the sign-in happens in your browser.

When something is wrong

hive doctor          # every check, with the fix for each failure
hive doctor --fix    # applies the fixes it can

Verifying the installer

Every binary is checked against a signed SHA256SUMS before it is made executable, and the installer prints which checks it managed. To read the script first, and check it against a second origin:

curl -fsSL https://hive-mcp.com/install.sh -o install.sh
curl -fsSL https://hive-mcp.com/install.sh.sha256    # served from our cluster, not GitHub
sha256sum -c install.sh.sha256
less install.sh && sh install.sh

sh -s -- --setup runs hive setup in the same pass. It is opt-in, because a script piped from the internet should not edit your shell config unless you ask it to. Verifying the install explains what each check proves.

With Go, instead of the installer:

go install github.com/hive-agi/hive-mcp-cli/cmd/hive@latest
go install github.com/hive-agi/hive-mcp-cli/cmd/hive-setup-mcp@latest
hive guide --install && claude mcp add hive-setup --scope user -- hive-setup-mcp

Command reference

Environment variables:

hive-setup-mcp exposes these commands as MCP tools (hive_setup, hive_doctor, hive_addon_*, and so on). Its schemas are generated by Bonzai from each command's Mcp metadata.

Development

go test ./...                        # unit tests
test/auth/e2e.sh                     # hive login/logout against a real Keycloak 26 (docker)
test/vm/customer-journey.sh --dev    # a customer's first run on a fresh Ubuntu VM

• test/auth/e2e.sh starts the Keycloak version production runs, with the hive-cli client configured as in k8s-agi/terraform/keycloak-hive-realm/clients-cli.tf. It also starts a stand-in store that enforces the real store's aud check. It then drives the real binary through both sign-in flows, token refresh, re-login and logout. A scripted browser fills in the Keycloak pages.
• test/vm/customer-journey.sh needs VirtualBox, but no root. It installs Claude Code, runs install.sh and hive setup (which registers hive through bb-mcp setup), and checks claude mcp list from an unrelated project. It prints PASS or FAIL for each stage. HIVE_MCP_LAUNCHER swaps in a dev launcher, and test/vm/hive-vm drives the VM by hand.

How sign-in is built

internal/auth is stratified by the house pattern (CPPB, DDD, SOLID). Each layer is its own Go package, so the compiler enforces the layering:

Adding a sign-in method or a credential backend is a registration, never an edit. internal/auth/strata_test.go reads every package's imports and fails the build when a layer reaches past its stratum.

License

MIT