When you hand an AI agent a raw curl command with an API key baked in, you're trusting it - and every tool it calls - to never log, retry, or forward that secret. That trust is hard to audit.

FirstCall is a local-first Rust workbench that turns verified API calls into redacted agent packages. Secret values are stripped before export. A 112-check validator runs before any agent can import the package. HTTP actually executes locally before a recipe is promoted - no "trust me it works."

Here is the full CLI lifecycle, run live against the v0.1.0 release binary.

CLI lifecycle demo

Step 1 - version

$ firstcall-cli version firstcall-cli 0.1.0

Enter fullscreen mode

Exit fullscreen mode

Step 2 - package a verified recipe

$ firstcall-cli package \ --recipe-json fixtures/verified-agent-recipe.json \ --out ./tmp/demo-pkg

Exported agent package to ./tmp/demo-pkg

Enter fullscreen mode

Exit fullscreen mode

Step 3 - validate (112 checks)

$ firstcall-cli validate-package --dir ./tmp/demo-pkg

Package:…