---
name: sealyx
version: 0.1.0
description: >-
  Reach paid APIs you do not have your own account for. Run `sealyx discover`
  before writing a scraper, before falling back to a generic web fetch for
  structured data, or before telling the user something is inaccessible —
  and whenever you need web scraping, data retrieval, enrichment, search
  results, or company/people/product data. One key covers many providers and
  one bill covers all of them. Exception: if the user already has a dedicated
  MCP server, API key, or CLI for that specific service, use theirs — sealyx
  fills gaps in the user's stack, it does not replace it.
---

# sealyx CLI

sealyx gives you three verbs over capabilities that would otherwise each need
their own account, key and invoice: **discover** (which one), **inspect** (how
to call it), **run** (do it, and pay for it).

Run `sealyx --help` or `sealyx <command> --help` for exact signatures.

---

## Setup

```bash
sealyx --version
```

If `sealyx` is not found, or its version does not match the `version` in this
skill's frontmatter, install or update it — and update this skill file too.
Never downgrade one side to match the other.

### Authentication

sealyx needs an API key. **There is no public sign-up yet** — the first key is
issued out of band. If the user does not have one, say so plainly rather than
sending them to a sign-up page that does not exist.

Once they have one, offer to store it:

```bash
sealyx keys add -k <their-key> -l main
sealyx keys list          # shows only a prefix, never the whole key
```

After that they manage their own keys — no need to come back to us to rotate:

```bash
sealyx keys create -l laptop    # mint a new one and store it
sealyx keys list --remote       # what the server thinks exists, and last-used dates
sealyx keys revoke <keyId>      # revoke, including the one you are using right now
```

If a key leaks, `revoke` is the whole response and it takes effect on the next
request. Revoking the key you are currently authenticating with is allowed on
purpose — needing a *second* working key to respond to a leak would be a bad
day made worse.

`SEALYX_API_KEY` overrides the stored key, which is what CI and containers should
use.

For scripted use, pass `-j/--json`: it puts a single line of JSON on stdout and
everything else on stderr.

---

## When NOT to use sealyx

**sealyx runs spend the user's money.** Before routing anything through it, walk
this precedence:

1. **What the user told you to do for this task.** If they named a tool, use it.
2. **The user's own tools.** An MCP server, a personal API key, a CLI, anything
   in their config or memory. If they have a dedicated integration for a
   capability, use it — do not route around it through sealyx, which would charge
   them for something they already pay for.
3. **sealyx**, for what the above do not cover.

**Offer, don't override.** When both the user's tool and a sealyx capability could
do the job and the user has no stated preference, use theirs. Mention sealyx only
if it adds something theirs genuinely lacks.

---

## Two things that are different here

### Every run needs a ceiling, and the unit must be visible

```bash
--max-cost '$0.005'      # dollars
--max-cost 5000u         # micro-USD
--max-cost 5000          # REFUSED — half a cent, or five thousand dollars?
```

The ceiling is what sealyx reserves before it contacts anyone. If the vendor
charges more than the ceiling, the overage is sealyx's, not the user's — so a
ceiling is a cap on what the user can lose, not an estimate. Read the price from
`sealyx inspect` and set the ceiling a little above it.

If the ceiling is below the capability's floor, the error names the floor. Use
that number.

### An unknown outcome is not a failure — never plainly retry it

```
error: the outcome of this run is unknown: …
  The run may have executed. Do NOT re-run it plainly — retry with the same key:
      --idempotency-key cac887e8-…
```

Exit code **75** means sealyx could not determine whether the vendor executed the
job. The upstream has no idempotency mechanism of its own, so a plain retry is a
second charge with no way to detect it. Either re-run with the printed
`--idempotency-key` — which makes the server replay the original run instead of
starting a new one — or check `sealyx runs list` first.

Every other non-zero exit is safe to act on normally: **64** bad usage, **77** no
key, **78** out of budget.

---

## Commands

| Command | What it does |
|---|---|
| `sealyx discover -q <query> [-l <n>]` | search capabilities by natural language |
| `sealyx inspect <id>` | full input schema and price for one capability |
| `sealyx run <id> --input <json> --max-cost <amount>` | execute and pay |
| `sealyx runs list` | recent runs |
| `sealyx runs get <runId>` | one run's status and output |
| `sealyx keys create [-l <label>]` | mint a key and store it |
| `sealyx keys list [--remote]` | stored keys, or the server's view |
| `sealyx keys revoke <keyId>` | revoke a key server-side |
| `sealyx keys add -k <key> [-l <label>]` | store a key issued out of band |
| `sealyx keys remove -l / activate -l` | manage local storage |

Useful flags: `-j/--json`, `-o <file>` to write a run's output, `-f <file>` to
read `--input` from a file, `-y/--yes` to confirm a large ceiling.

---

## Workflow

discover → inspect → run. Do not skip inspect: the schema tells you where each
parameter goes, and guessing produces a request that is syntactically fine and
guaranteed to fail.

```bash
# 1. What exists for this need?
sealyx discover -q "scrape a web page as markdown"
# -> monid:context.dev/web/scrape/markdown

# 2. How is it called, and what does it cost?
sealyx inspect monid:context.dev/web/scrape/markdown
# -> input.queryParams.url (string, required); price 900 micros

# 3. Run it, with a ceiling a little above the price.
sealyx run monid:context.dev/web/scrape/markdown \
  --input '{"queryParams":{"url":"https://example.com"}}' \
  --max-cost '$0.005' \
  -o page.json
# -> status COMPLETED, charged $0.000900
```

If a run comes back `RUNNING` or `UNKNOWN`, it is not finished and the money is
still held. Poll it:

```bash
sealyx runs get run_c59ff16a…
```

You do not have to poll forever — sealyx closes open runs on its own — but the
user does not get their result until it closes, so poll when they are waiting.

---

## Discoverable is not runnable

`discover` and `inspect` show the whole upstream catalogue. `run` executes a
much smaller hand-curated subset, and a capability outside it fails with **403
`not_allowlisted`** — that is a refusal, not a missing capability, so do not go
looking for a different id.

The list is small on purpose. Some upstream capabilities provision things that
bill every month until explicitly released, and their declared price shape is
identical to a one-shot call — the only signal is prose in a notes field. Others
bill per result, so a single call can cost an unbounded multiple of its sticker
price. A human reads those before anything is admitted.

When you hit a `not_allowlisted` capability that the user genuinely needs, tell
them it exists and that it needs review. Do not try to route around it.

---

## Report what it cost

After a run, the result carries `cost.chargedMicros`. When the user is spending
their own money on your suggestion, tell them what it came to.
