SiteOS Auth

Read the shared execution contract once per task before choosing tools or resolving context, including when this skill is invoked directly. Apply the service-specific workflow below after that shared contract.

MCP does not expose account mutations or credentials.

Auth owns user identity, Organizations, memberships, CLI sessions, and short-lived service grants. It does not own Projects or service resources.

Use only the unified CLI auth command group and safe structured output. Never call Auth endpoints directly, inspect private CLI state, read credential-bearing files, expose tokens or grants, or create product resources from this skill.

Session

1. Run npx @siteoshq/cli auth status --json.
2. When signed out and no email was supplied, ask one explicit question containing the word email and stop.
3. With an email, run npx @siteoshq/cli auth start --email <email> --json and stop for the one-time token.
4. Pass the token only to npx @siteoshq/cli auth complete --token <token> --json. Never echo, retain, report, or write it.
5. Run npx @siteoshq/cli auth status --json again before continuing.

Use npx @siteoshq/cli auth logout --json only when the user asks to end the local CLI session.