Run the command. Get the access. Lose the access when you're done.

Use the CLI to check a policy, open a tunnel, or run a command with temporary access.

The command line today

skimasque connect opens a tunnel to one destination through your gateway. Tools that honour ALL_PROXY can use the local SOCKS5 relay instead.

connect to a private service

# Bridge one TCP tunnel to stdin/stdout, signed in with skimasque login
$ skimasque connect db.internal:5432 --proxy gateway.example.com --org acme

# Or run a local SOCKS5 relay and point ALL_PROXY at it
$ skimasque-client --proxy gateway.example.com --org acme --app curl socks5 --listen 127.0.0.1:1080
$ ALL_PROXY=socks5h://127.0.0.1:1080 curl https://api.internal

Developer
CLIskimasque connect db.prod:5432
proves identitycontrol plane
Identity
checkedcontrol plane
Policy
active
Sessiontemporary ACTIVE
active
Servicedb.prod:5432

A developer runs skimasque connect, the CLI proves who they are, the policy is checked, and a temporary session reaches the private service.

Quick start

Sign in with GitHub, create an organisation, scaffold a policy, and test it offline. The tests run without a network and fit in CI.

$ skimasque login
$ skimasque org create "Acme"
$ skimasque init
$ skimasque policy test

Local development

Check what a policy would do before you run anything: check, explain and why evaluate a request locally, with no network.

check policy locally

$ skimasque policy check developer-db dev-db.internal:5432 --app psql
$ skimasque policy explain developer-db dev-db.internal:5432 --app psql
$ skimasque why dev-db.internal:5432 --app psql --repository acme/platform --branch main

The same command can reach different destinations under different policies.

CLIskimasque connect

staging identitycontrol plane
1. staging policy
  active
2. Databasedb.staging:5432
The staging policy reaches the staging database.
production identitycontrol plane
1. production policy10 min
  active
2. Databasedb.prod:5432
The production policy reaches the production database with tighter limits.

The same command reaches different destinations depending on which policy applies.

Run a command with access

skimasque exec requests the access a command needs, runs the command, and drops the access when it exits. Tools that honour HTTPS_PROXY or ALL_PROXY can use its local proxy; for tools that don't, --forward opens a local port to one destination.

wrap a command

$ skimasque exec \
    --policy production \
    --app terraform \
    -- terraform apply

COMMAND
IDENTITY
POLICY
active
SESSION
active
COMMAND EXECUTION

A command is checked for identity and policy, given a session, and then run.

No network ceremony

Avoid:

connect VPN
wait
change network
run command
remember to disconnect

Prefer:

one command

$ skimasque exec --policy production -- terraform apply

Developer flow

what it prints

$ skimasque exec --policy production --forward 15432:db.prod:5432 -- psql -h 127.0.0.1 -p 15432
SkiMasque

Identity     alice
Policy       production
Application  psql
Gateway      gateway.skimasque.com

Access
  db.prod:5432     ✓  → 127.0.0.1:15432

Session
  20m

Connected.

Coding agents

Use skimasque exec --agent --sandbox srt with allowed domains to run a coding agent through the gateway, or explicitly choose --unsandboxed. SkiMasque integrates with an external sandbox; proxy variables alone do not confine a process.

Agent sessions default to 30 minutes, are capped at 4 hours or a lower organisation limit, and support delegation. End a session in the CLI or console to revoke it and its children. Gateways apply revocation updates when received; expiry bounds access during outages.

What is not finished yet

PLANNED control-plane-backed connect

The client can mint a developer credential from your signed-in session. Automatic discovery of a customer gateway is not implemented: use --proxy for connect or --gateway for exec when the Cloud default is not your destination.