CLI commands

Run vando on its own first: it says where this computer stands and the one command to run next. vando help <command> prints any section below.

vando help

vando keeps your secrets on your phone and gives them to the programs you run,
and makes risky commands in Claude Code wait for your OK.

Start here
  connect     Connect this computer to the Vando app on your phone. The code
              is in the app: Connections → Connect an AI. Your own terminal.
              e.g. vando connect K7M2XQ4B
  setup       Tell Claude Code in this project how to ask for secrets, and
              make risky commands wait for your phone.
              e.g. vando setup
  init        Move this project's .env files into Vando: one Save on your phone.
              Names only first, no values shown or sent:
              e.g. vando init --dry-run, then vando init
  add         Save one secret (typed hidden, or in a page in your browser).
              e.g. vando add STRIPE_KEY
  run         Run a command with the secrets your phone gives it.
              e.g. vando run -- pnpm dev   (a project: after vando init)
                   vando run --secret STRIPE_KEY -- node send.js

Not sure what's next? Run vando on its own. Something wrong? vando doctor.

More
  status      What is connected, and what this computer can use now. (--json)
  doctor      Check this computer's setup; says how to fix each thing. (--json)
  request     Ask your phone early, without waiting.
              e.g. vando request --secret STRIPE_KEY
  grants      What your phone gave this computer, until when (a grant).
              e.g. vando grants; vando grants end --all ends it all
  env         The names vando run would set, and where each comes from.
              --reveal prints the values too (your own terminal only).
  get         Print one value (your own terminal only; an AI uses vando run).
              e.g. vando get STRIPE_KEY
  clean       Move env files that still hold plain values to the trash.
  guard       Only the guard (vando setup turns it on): risky commands wait for
              your phone. --global: every project. sudo vando guard --managed:
              a guard Claude can't edit.
  unguard     Turn the guard off in this project.
  test        Send a harmless ask to your phone.
  logout      End everything this computer can use, disconnect, remove its keys.
  disconnect  Remove this computer's connection (turn the guard off first).
  help        This list. vando help <command> for one command.

connect also takes --api <address> (the app's command shows it),
--name and --machine.
Exit codes: 0 done · 1 failed · 2 not understood · 75 waiting for your phone
· 77 you said no on your phone.

vando connect

  connect     Connect this computer to the Vando app on your phone. The code
              is in the app: Connections → Connect an AI. Your own terminal.
              e.g. vando connect K7M2XQ4B

Usage: vando connect <code> [--api <address>] [--name <name>] [--machine <short name>]

Who runs it: You, in your own terminal. An AI agent should not run it.

Flag	What it does
`--code <code>`	The 8-character code from your phone (Connections → Connect an AI → Claude Code), if you’d rather name it. It works once, for 10 minutes.
`--api <address>`	The Vando server, when your phone’s command names one. Run the command exactly as your phone shows it.
`--name <name>`	What your phone calls this connection, e.g. `"Claude (laptop)"`.
`--machine <short name>`	The computer’s name on your phone (default: its host name).

Exit codes: 0 · 1 · 2

vando connect K7M2XQ4B

vando setup

  setup       Tell Claude Code in this project how to ask for secrets, and
              make risky commands wait for your phone.
              e.g. vando setup

Usage: vando setup (or vando setup claude)

Who runs it: You or an AI agent.

Exit codes: 0 · 1 · 2

vando setup

vando init

  init        Move this project's .env files into Vando: one Save on your phone.
              Names only first, no values shown or sent:
              e.g. vando init --dry-run, then vando init

Usage: vando init [--dry-run] [--as-file] [--vault <name>] [--project <name>] [--rewrite] · vando init --reconcile [--env <name>]

Who runs it: You, in your own terminal. An AI agent may run only --dry-run.

Flag	What it does
`--dry-run`	Show the environments, folders and names it would send, with no values, and send nothing. Needs no connection; an AI may run it.
`--as-file`	Keep each env file as one thing in your vault instead of one thing per variable.
`--vault <name>`	The vault to fill (default: Work).
`--project <name>`	The project’s folder name (default: this folder’s name).
`--rewrite`	Also replace the values in your env files with `vando://` references (asks you first).
`--reconcile`	Compare the env files with your vault again and send what changed.
`--env <name>`	With `--reconcile`: only this environment.

Exit codes: 0 · 1 · 2 · 75

vando init --dry-run
vando init

vando add

  add         Save one secret (typed hidden, or in a page in your browser).
              e.g. vando add STRIPE_KEY

Usage: vando add NAME [--variable] [--from-file <file>] [--on-phone]

Who runs it: You or an AI agent.

Flag	What it does
`--variable`	It’s a setting, not a secret: saved as a variable and shown in full.
`--from-file <file>`	Read the value from a file only you can read (mode 0600), then offer to move the file to the trash.
`--on-phone`	Type the value on your phone instead.

Exit codes: 0 · 1 · 2 · 75

vando add STRIPE_KEY
vando add API_BASE_URL --variable

vando run

  run         Run a command with the secrets your phone gives it.
              e.g. vando run -- pnpm dev   (a project: after vando init)
                   vando run --secret STRIPE_KEY -- node send.js

Usage: vando run [--secret NAME[=path]…] [--folder <path> | --env <name>] [--all] [--ttl once|1h|8h|1d|<seconds>] [--stop-at-end] [--no-scrub] [--wait <seconds>] -- <command>

Who runs it: You or an AI agent.

Flag	What it does
`--secret NAME[=path]`	A secret by its variable name, or `NAME=Folder/path/ITEM` for one stored under another name. Repeat it for more.
`--folder <path>`	Everything directly in this vault folder, e.g. `Work/acme/dev`.
`--env <name>`	An environment of this project (`.vando.toml`), e.g. `staging`. Without it: the current one.
`--all`	Include the folders inside the folder too.
`--ttl once\|30m\|1h\|8h\|1d\|<seconds>`	How long to ask for. Your phone shows it, and you pick the real length there.
`--for once\|30m\|1h\|8h\|1d\|<seconds>`	The same as `--ttl`.
`--stop-at-end`	Stop the program when the access ends (otherwise it keeps running with what it got).
`--scrub`	Hide the secrets in what the program prints (the default; best effort).
`--no-scrub`	Don’t hide them.
`--wait <seconds>`	How long to wait for your phone, at most 600. Without a terminal it stops sooner and exits 75; the ask stays on your phone.

Exit codes: 0 · 1 · 2 · 75 · 77

vando run -- pnpm dev
vando run --secret STRIPE_KEY -- node send.js
vando run --env staging -- pnpm dev
vando run --folder Work/acme/dev -- pnpm dev

vando status

  status      What is connected, and what this computer can use now. (--json)

Usage: vando status [--json]

Who runs it: You or an AI agent.

Flag	What it does
`--json`	The same, as JSON for scripts.

Exit codes: 0 · 1

vando status

vando doctor

  doctor      Check this computer's setup; says how to fix each thing. (--json)

Usage: vando doctor [--json]

Who runs it: You or an AI agent.

Flag	What it does
`--json`	The same, as JSON for scripts.

Exit codes: 0 · 1

vando doctor

vando request

  request     Ask your phone early, without waiting.
              e.g. vando request --secret STRIPE_KEY

Usage: vando request [--secret NAME[=path]…] [--folder <path> | --env <name>] [--all] [--ttl once|30m|1h|8h|1d|<seconds>] [--wait <seconds>]

Who runs it: You or an AI agent.

Flag	What it does
`--secret NAME[=path]`	A secret by its variable name, or `NAME=Folder/path/ITEM` for one stored under another name. Repeat it for more.
`--folder <path>`	Everything directly in this vault folder, e.g. `Work/acme/dev`.
`--env <name>`	An environment of this project (`.vando.toml`), e.g. `staging`. Without it: the current one.
`--all`	Include the folders inside the folder too.
`--ttl once\|30m\|1h\|8h\|1d\|<seconds>`	How long to ask for. Your phone shows it, and you pick the real length there.
`--for once\|30m\|1h\|8h\|1d\|<seconds>`	The same as `--ttl`.
`--wait <seconds>`	How long to wait for your phone, at most 600. Without a terminal it stops sooner and exits 75; the ask stays on your phone.

Exit codes: 0 · 1 · 2 · 75 · 77

vando request --secret STRIPE_KEY

vando grants

  grants      What your phone gave this computer, until when (a grant).
              e.g. vando grants; vando grants end --all ends it all

Usage: vando grants [end <grant id> | end --all]

Who runs it: You or an AI agent.

Flag	What it does
`--all`	With `end`: end everything this computer can use.

Exit codes: 0 · 1 · 2

vando grants
vando grants end --all

vando env

  env         The names vando run would set, and where each comes from.
              --reveal prints the values too (your own terminal only).

Usage: vando env [--folder <path> | --env <name>] [--secret NAME[=path]…] [--reveal [--yes-print]]

Who runs it: You or an AI agent.

Flag	What it does
`--secret NAME[=path]`	A secret by its variable name, or `NAME=Folder/path/ITEM` for one stored under another name. Repeat it for more.
`--folder <path>`	Everything directly in this vault folder, e.g. `Work/acme/dev`.
`--env <name>`	An environment of this project (`.vando.toml`), e.g. `staging`. Without it: the current one.
`--all`	Include the folders inside the folder too.
`--ttl once\|30m\|1h\|8h\|1d\|<seconds>`	How long to ask for. Your phone shows it, and you pick the real length there.
`--for once\|30m\|1h\|8h\|1d\|<seconds>`	The same as `--ttl`.
`--wait <seconds>`	How long to wait for your phone, at most 600. Without a terminal it stops sooner and exits 75; the ask stays on your phone.
`--reveal`	Also print the values. Your own terminal only: it refuses when the output isn’t one.
`--yes-print`	Print even when the output isn't a terminal (it warns first). Never for an AI.

Exit codes: 0 · 1 · 2 · 75 · 77

vando env --env dev

vando get

  get         Print one value (your own terminal only; an AI uses vando run).
              e.g. vando get STRIPE_KEY

Usage: vando get NAME [--folder <path> | --env <name>] [--yes-print]

Who runs it: You, in your own terminal. An AI agent should not run it.

Flag	What it does
`--folder <path>`	Everything directly in this vault folder, e.g. `Work/acme/dev`.
`--env <name>`	An environment of this project (`.vando.toml`), e.g. `staging`. Without it: the current one.
`--ttl once\|30m\|1h\|8h\|1d\|<seconds>`	How long to ask for. Your phone shows it, and you pick the real length there.
`--for once\|30m\|1h\|8h\|1d\|<seconds>`	The same as `--ttl`.
`--wait <seconds>`	How long to wait for your phone, at most 600. Without a terminal it stops sooner and exits 75; the ask stays on your phone.
`--yes-print`	Print even when the output isn't a terminal (it warns first). Never for an AI.

Exit codes: 0 · 1 · 2 · 75 · 77

vando get STRIPE_KEY

vando clean

  clean       Move env files that still hold plain values to the trash.

Usage: vando clean

Who runs it: You, in your own terminal. An AI agent should not run it.

Exit codes: 0 · 1 · 2

vando clean

vando guard

  guard       Only the guard (vando setup turns it on): risky commands wait for
              your phone. --global: every project. sudo vando guard --managed:
              a guard Claude can't edit.

Usage: vando guard [--global | --managed] [--timeout <seconds>] [--settings <file>]

Who runs it: You or an AI agent.

Flag	What it does
`--global`	Every project: writes your own `~/.claude/settings.json`.
`--managed`	With `sudo`: puts the guard where Claude can’t edit it (the system’s managed settings).
`--timeout <seconds>`	How long Claude Code waits for your phone before the command is refused (default 600).
`--settings <file>`	Write this settings file instead.

Exit codes: 0 · 1 · 2

vando guard
vando guard --global
sudo vando guard --managed

vando unguard

  unguard     Turn the guard off in this project.

Usage: vando unguard

Who runs it: You, in your own terminal. An AI agent should not run it.

Exit codes: 0 · 1

vando unguard

vando test

  test        Send a harmless ask to your phone.

Usage: vando test [--wait <seconds>]

Who runs it: You or an AI agent.

Flag	What it does
`--wait <seconds>`	How long to wait for your answer (default 120).

Exit codes: 0 · 1

vando test

vando logout

  logout      End everything this computer can use, disconnect, remove its keys.

Usage: vando logout

Who runs it: You, in your own terminal. An AI agent should not run it.

Exit codes: 0 · 1

vando logout

vando disconnect

  disconnect  Remove this computer's connection (turn the guard off first).

Usage: vando disconnect

Who runs it: You, in your own terminal. An AI agent should not run it.

Exit codes: 0 · 1

vando disconnect

vando help

  help        This list. vando help <command> for one command.

Usage: vando help [<command>] · vando <command> --help

Who runs it: You or an AI agent.

Exit codes: 0 · 2

vando help
vando help run

Last verified 15 October 2026

CLI commands

vando helpCopy Anchor Link

vando connectCopy Anchor Link

vando setupCopy Anchor Link

vando initCopy Anchor Link

vando addCopy Anchor Link

vando runCopy Anchor Link

vando statusCopy Anchor Link

vando doctorCopy Anchor Link

vando requestCopy Anchor Link

vando grantsCopy Anchor Link

vando envCopy Anchor Link

vando getCopy Anchor Link

vando cleanCopy Anchor Link

vando guardCopy Anchor Link

vando unguardCopy Anchor Link

vando testCopy Anchor Link

vando logoutCopy Anchor Link

vando disconnectCopy Anchor Link

vando helpCopy Anchor Link

On this page

vando help

vando connect

vando setup

vando init

vando add

vando run

vando status

vando doctor

vando request

vando grants

vando env

vando get

vando clean

vando guard

vando unguard

vando test

vando logout

vando disconnect

vando help