Tools

Pikbase CLI

Every gsb command, with its real flags and output.

Contract sourcePikbase docs

The binary is gsb. It syncs serverless functions and libraries, manages tenant users, and exposes the same MCP tool catalog the MCP server does.

Commands that touch a tenant read .gsb/<tenantCode>/credentials.json, written by gsb init. The tenant is chosen by --tenant <code>, else GSB_TENANT_CODE, else the only folder under .gsb/.

Setup

`gsb init`

Signs in to a tenant and stores a token in .gsb/<tenantCode>/credentials.json.

Flag	Description
`-t, --tenant <tenantCode>`	Tenant code, for example `dev1`
`-e, --email <email>`	User email
`--api-url <url>`	Override the API base URL
`--no-remember`	Request a short-lived token instead of a remembered one
`-f, --force`	Overwrite existing credentials without asking

gsb init --tenant dev1 --email you@example.com

The password is prompted for. Do not pass it on the command line — shell history is not a secret store.

`gsb config`

Prints the current configuration: tenant, API URL, and where the credentials came from.

gsb config

Serverless functions and libraries

`gsb pull [name]`

Pulls resources from the backend into the working directory. Pulls everything matching the selected types when name is omitted.

Flag	Description
`-f, --function`	Pull functions
`-l, --library`	Pull libraries
`-d, --doc-template`	Pull document templates
`-v, --verbose`	Verbose output

gsb pull --function
gsb pull "Calculate Order Total" --function --verbose

`gsb push <filepath>`

Pushes one TypeScript file, or a document template folder, to the backend.

Flag	Description
`-t, --type <type>`	`function`, `library`, or `auto` (default `auto`)
`-d, --doc-template`	Push a document template from a folder
`--dry-run`	Show what would be pushed without pushing
`-v, --verbose`	Verbose output

gsb push src/functions/calculate-order-total.ts --dry-run
gsb push src/functions/calculate-order-total.ts --type function

Run --dry-run first. A push overwrites the tenant-side record.

`gsb list`

Lists local resources on disk, not tenant records.

Flag	Description
`-f, --function`	List functions
`-l, --library`	List libraries
`-d, --doc-template`	List document templates
`-v, --verbose`	Verbose output

`gsb test <filepath>`

Executes a function against the tenant without saving it.

Flag	Description
`--entity <entity>`	JSON string for the entity context
`--params <params>`	JSON string for the parameters
`-v, --verbose`	Verbose output

gsb test src/functions/calculate-order-total.ts \
  --entity '{"id":"order-123"}' \
  --params '{"applyDiscounts":true}'

`gsb find [searchTerm]`

Searches the tenant for existing serverless functions and libraries — GsbWfFunction and GsbWfCodeLibrary records. It does not search documentation.

Flag	Description
`-n, --count <count>`	Max results per type (default `25`)

gsb find order
gsb find --count 50

Run this before push so you do not create a second function under a name that already exists.

Tools

`gsb tools`

Lists the MCP tools callable through gsb call, each with its risk classification and whether it needs --yes.

Flag	Description
`-r, --read-only`	Only list tools classified `read`

gsb tools --read-only

`gsb call <tool>`

Calls one MCP tool against the configured tenant. Same implementations as the MCP server; only the transport differs.

Flag	Description
`-i, --input <json>`	Tool input as a JSON string (default `{}`)
`--input-file <path>`	Read tool input from a JSON file
`-y, --yes`	Approve a write, destructive, or side-effecting tool
`--raw`	Print raw JSON without the summary header

gsb call query --raw --input '{
  "queryParams": { "entDefName": "Order", "startIndex": 0, "count": 10 }
}'

gsb call save --yes --input-file ./payload.json

Read tools run without --yes. Everything else refuses without it — do not add --yes to a script by default.

`gsb mcp [args...]`

Runs the MCP server. Unknown options are forwarded. See MCP server.

gsb mcp -y

Users and roles

`gsb users add <email>`

Creates a user and optionally assigns a role.

Flag	Description
`-r, --role <role>`	Role name or ID
`-p, --password <password>`	Password; generated securely when omitted
`-n, --name <name>`	Given name
`-s, --surname <surname>`	Surname
`--write-env <paths...>`	Write `GSB_TEST_*` credentials to one or more ignored env files
`--yes`	Skip confirmation

gsb users add qa@example.com --role Tester --write-env .env.test

Omit --password and let the CLI generate one. Every --write-env target must be git-ignored.

`gsb users list`

Lists users in the configured tenant.

Flag	Description
`-l, --limit <count>`	Maximum users to return (default `20`)

`gsb users roles`

Lists the roles available in the configured tenant. Takes no flags.

`gsb users assign-role <email> <role>`

Assigns an existing role to an existing user.

Flag	Description
`--yes`	Skip confirmation

`gsb users reset-password <email>`

Resets a user's password.

Flag	Description
`-p, --password <password>`	Password; generated securely when omitted
`--write-env <paths...>`	Write `GSB_TEST_*` credentials to one or more ignored env files
`--yes`	Skip confirmation

Assistant

`gsb assistant seed [manifest]`

Creates or updates LlmConfiguration rows from a checked-in manifest. Defaults to .gsb/<tenantCode>/assistant/manifest.json.

Flag	Description
`--deployment <name>`	Override the LLM deployment name for this tenant

gsb assistant seed --deployment your-deployment

Documentation from the terminal

Documentation tools are local, read-only calls that need no tenant.

gsb call getDocs --input '{"methodName":"query"}' --raw
gsb call getApiDocs --raw
gsb call getSchemaDocs --raw
gsb call getServerlessFunctionDocs --raw

Safety

Inspect a tool with gsb tools before invoking it. Write and destructive tools require --yes; do not bypass that in scripts or agent workflows. Keep tokens out of command history and out of committed files.