CLI Commands

waap-cli supports EVM, Sui, and Solana.

waap-cli commands --json (alias schema --json) emits the authoritative machine-readable command schema for your installed version. Every command path, option, alias, and each command’s authentication boundary. Prefer it over this page or --help when generating automation.

Global Options

`--json`

Force JSON output on stdout and suppress plaintext progress logs. This is highly recommended for AI agents and scripts parsing the CLI output.


waap-cli whoami --json
# → {"evmWalletAddress":"0x...","suiWalletAddress":"0x..."}

`--quiet`

Suppress progress output on stderr. Combine with --json for a clean machine-readable stream.

Environment

The CLI reads exactly two environment variables. It does not load a .env file from the working directory.

Variable	Purpose
`WAAP_CLI_ENV`	Which deployment to target. `production` (default), `staging`, or `development`. `SILK_NODE_ENV` is still accepted as the former name; `WAAP_CLI_ENV` wins when both are set.
`WAAP_CLI_SESSION_DIR`	Where the session is stored.

Give every agent or CI job its own WAAP_CLI_SESSION_DIR. Two processes sharing one session directory will fight over the same session file.

Sessions are not scoped by environment, so changing WAAP_CLI_ENV without also changing WAAP_CLI_SESSION_DIR lets a staging session overwrite a production one.

Chain identifiers

Every signing command requires an explicit --chain.

Chain	Identifier	Example
EVM	`<id>`, `evm:<id>`, or `eip155:<id>`	`evm:8453`
Sui	`sui:<network>`	`sui:mainnet`
Solana	`solana:<network>`	`solana:mainnet`

solana:mainnet-beta aliases solana:mainnet. Friendly EVM names such as base are not accepted.

There is no global chain

--chain is required on every signing command and cannot be defaulted, so a transaction always names the network it is going to.


waap-cli send-tx --to 0xRecipient --value 0.01 --chain evm:1
waap-cli sign-message --message "hello" --chain sui:mainnet

--rpc is optional and also per-call; without it the CLI resolves a public endpoint for the chain you named.

`signup`

Create a new WaaP wallet account and immediately log in. Returns both your EVM and Sui wallet addresses.


waap-cli signup --email youremail+agent007@example.com --password 'S3cur3Pass!'
# optional display name:
waap-cli signup --email youremail+agent007@example.com --password 'S3cur3Pass!' --name "My Agent 007"
 
# recommended for automation — keeps the password out of argv and shell history:
printf '%s\n' "$WAAP_PASSWORD" | waap-cli signup \
  --email youremail+agent007@example.com --name "My Agent 007" --password-stdin --json
 
# resume an interrupted signup from the same session directory:
waap-cli signup --resume --json

Note: To create multiple agent accounts, use different email addresses with the + alias syntax (e.g., “youremail+agent001@example.com”, “youremail+agent002@example.com”, etc.).

Passwords must be 8+ characters. The Sui testnet faucet (faucet.testnet.sui.io) rate-limits aggressively from VPS and cloud IPs. Use a browser-based faucet or fund from an exchange if you hit limits.

`login`

Authenticate with an existing account and save a local session. Returns both your EVM and Sui wallet addresses.


waap-cli login --email youremail+agent007@example.com --password 'S3cur3Pass!'
 
# recommended for automation:
printf '%s\n' "$WAAP_PASSWORD" | waap-cli login \
  --email youremail+agent007@example.com --password-stdin --json

Legacy two-party accounts convert to standard mode during login; there is no separate conversion command. Re-running login is safe.

`logout`

Delete the local session file.


waap-cli logout

`whoami`

Print the wallet addresses derived from the current session’s keyshare. The waap-cli securely generates both an EVM and a Sui address from the same underlying keyshare.


waap-cli whoami
# → evmWalletAddress: "0xAbc..."
# → suiWalletAddress: "0xDef..."

`session-info`

Inspect the raw metadata stored in ~/.waap-cli/session.json.


waap-cli session-info

`sign-message`

Sign an arbitrary message.

EVM. Signs using EIP-191 (personal_sign format). Accepts plain text or 0x-prefixed hex.


waap-cli sign-message --message "Hello WaaP"
waap-cli sign-message --message 0x48656c6c6f
# consume an existing Privilege (pipe it — never place it in argv):
printf '%s' "$PRIVILEGE" | waap-cli sign-message --message "Hello" --privilege-stdin

--privilege-stdin consumes a Privilege that privilege create minted. Treat it as a bearer secret: piping keeps it out of shell history, ps output, and logs. The older --privilege <encoded> and --permission-token <encoded> flags still work but are deprecated. See Privileges.

Sui. Signs using Blake2b hashing. Returns a Base64-encoded signature and message bytes.


waap-cli sign-message --message "Hello Sui" --chain sui:mainnet
waap-cli sign-message --message "Hello Solana" --chain solana:mainnet

`sign-typed-data`

Sign EIP-712 typed data (eth_signTypedData_v4). Pass the full typed-data object as a JSON string.


waap-cli sign-typed-data --data '{
  "types": {
    "EIP712Domain": [{"name":"name","type":"string"}],
    "Mail": [{"name":"contents","type":"string"}]
  },
  "domain": {"name":"Ether Mail","chainId":1},
  "primaryType": "Mail",
  "message": {"contents":"Hello!"}
}'
 
# consume an existing Privilege (pipe it — never place it in argv):
printf '%s' "$PRIVILEGE" | waap-cli sign-typed-data --data '{...}' --privilege-stdin

`sign-tx`

Sign a transaction and print the result without broadcasting.

EVM. Returns a raw 0x-prefixed hex string ready for eth_sendRawTransaction.


# EIP-1559 (default) — ETH transfer
waap-cli sign-tx \
  --to 0xRecipientAddress \
  --value 0.01 \
  --chain evm:1 \
  --rpc https://eth.llamarpc.com
 
# Specific chain (Base)
waap-cli sign-tx \
  --to 0xRecipientAddress \
  --value 0.001 \
  --chain evm:8453 \
  --rpc https://mainnet.base.org
 
# Legacy (Type 0)
waap-cli sign-tx \
  --to 0xRecipientAddress \
  --value 0.01 \
  --chain evm:1 \
  --legacy

Sui. Returns a Base64-encoded signature and transaction bytes.


# Simple SUI transfer (value in MIST)
waap-cli sign-tx \
  --to 0xRecipientSuiAddress \
  --value 1000 \
  --chain sui:mainnet
 
# Pre-built BCS-encoded transaction bytes
waap-cli sign-tx \
  --tx "AAABA..." --tx-format base64 \
  --chain sui:mainnet
 
# JSON-serialized TransactionBlock
waap-cli sign-tx \
  --tx '{"version": 1, ...}' --tx-format json \
  --chain sui:testnet

`send-tx`

Build, sign, and broadcast a transaction in one step.

EVM. Returns a transaction hash.


# ETH transfer on mainnet
waap-cli send-tx \
  --to 0xRecipientAddress \
  --value 0.01 \
  --chain evm:1 \
  --rpc https://eth.llamarpc.com
 
# Transfer on Base
waap-cli send-tx \
  --to 0xRecipientAddress \
  --value 0.001 \
  --chain evm:8453 \
  --rpc https://mainnet.base.org
 
# bypass 2FA by consuming an existing Privilege:
printf '%s' "$PRIVILEGE" | waap-cli send-tx --to 0xRecipient --value 0.01 --chain evm:1 --privilege-stdin

Sui. Returns a transaction digest.


# Simple SUI transfer (value in MIST)
waap-cli send-tx \
  --to 0xId \
  --value 1000 \
  --chain sui:mainnet
 
# Pre-built BCS-encoded transaction bytes (Programmable Transaction Blocks)
# You can generate this using the official MystenLabs `sui` CLI:
RAW_TX_BYTES=$(sui client ptb \
  --assign coin @gas \
  --transfer-objects "[coin]" 0xRecipientSuiAddress \
  --serialize-unsigned-transaction)
 
waap-cli send-tx \
  --tx "$RAW_TX_BYTES" --tx-format base64 \
  --chain sui:mainnet
 
# JSON-serialized TransactionBlock
waap-cli send-tx \
  --tx '<json-string>' --tx-format json \
  --chain sui:testnet

Solana


# Native SOL — --value is whole SOL
waap-cli send-tx --to <address> --value 0.01 --chain solana:mainnet
 
# SPL token — with --mint, --value is the raw token base-unit amount
waap-cli send-tx --to <address> --mint <mint-address> --value 1000000 \
  --chain solana:mainnet
 
# Chain-native input from stdin
waap-cli send-tx --tx - --tx-format v0-message --chain solana:mainnet

--tx-format accepts json, legacy-message, or v0-message on Solana. EIP-712 typed-data signing is EVM-only and has no Solana equivalent.

`chain get` and `chain set` (deprecated)

Both are deprecated and neither affects signing. chain set saves nothing. It prints a warning and returns without storing a value. chain get reads a session field that nothing writes any more, so it reports not set. Pass --chain on each command instead.

They remain only so existing scripts fail loudly rather than silently sending on an unintended network.

`request`

Generic EIP-1193 JSON-RPC interface. Takes optional params as a JSON array string.


# Get wallet address
waap-cli request eth_accounts
 
# Get chain ID
waap-cli request eth_chainId
 
# Get ETH balance
waap-cli request eth_getBalance '["0xYourAddress","latest"]' --chain evm:1 --rpc https://eth.llamarpc.com
 
# Sign a message (personal_sign)
waap-cli request personal_sign '["0x48656c6c6f20576161502021","0xYourAddress"]'
 
# EIP-712 typed data sign
waap-cli request eth_signTypedData_v4 '["0xYourAddress","{\"types\":{...},\"domain\":{...},\"primaryType\":\"Mail\",\"message\":{...}}"]'
 
# Send transaction via EIP-1193
waap-cli request eth_sendTransaction \
  '[{"from":"0xYourAddress","to":"0xRecipient","value":"0x2386F26FC10000","chainId":"0x1"}]' \
  --chain evm:1 --rpc https://eth.llamarpc.com

`policy get`

Show current wallet policy settings.


waap-cli policy get
# →
# Policy Settings:
#    2FA Method:        EMAIL_AUTHZ
#    Daily Spend Limit: $100
#    Min Risk for 2FA:  HighWarn

The output includes three fields:

2FA Method: Current authorization method: EMAIL_AUTHZ, PHONE_AUTHZ, EXTERNAL_WALLET_AUTHZ, or DISABLED.
Daily Spend Limit: Cumulative USD cap per calendar day (default: $5,000, max: $10,000).
Min Risk for 2FA: The risk threshold at which 2FA is triggered (default: HighWarn). See Risk Levels.

`policy set`

Update wallet policy settings. Currently supports --daily-spend-limit.


# Set daily spend limit to $500 (requires 2FA approval if enabled)
waap-cli policy set --daily-spend-limit 500

Valid range: 0. 10,000 USD. The limit is floored to the nearest integer.

`2fa status`

View the current Two-Factor Authentication method configured for the wallet.


waap-cli 2fa status

`2fa enable`

Enable 2FA using email, phone, Telegram, or an external hardware wallet.


# Email 2FA — a verification link is sent to the provided address
waap-cli 2fa enable --email agent@example.com
 
# Phone 2FA
waap-cli 2fa enable --phone "+1234567890"
 
# Telegram 2FA
waap-cli 2fa enable --telegram 7381029636
 
# External wallet (hardware wallet) 2FA
waap-cli 2fa enable --wallet 0xHardwareWalletAddress

If an existing 2FA method is already active, enabling a new one is a 2-step flow:

approve with your current method, then
verify the new method.

`2fa disable`

Disable 2FA, allowing autonomous signing without out-of-band approval.


waap-cli 2fa disable

Disabling 2FA requires approval from the currently-configured 2FA method before taking effect.

`privilege create`

Mint a scoped, time-bounded Privilege that lets an agent transact without a fresh 2FA prompt, within limits you set.


waap-cli privilege create \
  --chain evm:84532 \
  --allow 0xRecipient --amount-usd 1 --expiry-seconds 900 --json

A Privilege binds the CLI origin, chain, wallet mode, recipients, USD allowance, and expiry.

The wallet mode is the command path, not an option. There is no --wallet-mode:


waap-cli privilege create ...        # standard mode
waap-cli squid privilege create ...  # Squid

A Privilege minted on one path cannot be redeemed by the other, so mint it on the same path the transaction will use.

By default a Privilege lets ordinary threshold findings proceed without another 2FA prompt when the Policy Engine accepts its scope. Add --require-2fa-for-high-risk-tx to keep that challenge.

--json returns an object; permissionToken is the encoded grant. Extract it and pipe it into a matching transaction with --privilege-stdin (... --json | jq -r .permissionToken). permission-token create remains as a command-group alias.

`wallet-balance`

Show balances for the selected chain.


waap-cli wallet-balance --chain evm:8453 --json

The deprecated balance command is a hidden alias for this.

Squid commands

Every signing command has a Squid counterpart under waap-cli squid, plus squid init, squid status, squid addresses, and squid refill. See Squid for Agents.

Removed and deprecated

Status	Item	Use instead
Removed	`broadcast-tx`	`send-tx`, or an external broadcaster for artifacts.
Removed	`cancel --msg-hash --authz-kind`	Cancellation is owned by the transaction runner.
Removed	Fee, top-up, referral, and announcement groups	Inspect `commands --json` before adapting automation.
Removed	`--prepare`, `@file` transaction inputs	`--tx` with `--tx-format`, or `--tx -` for stdin.
Deprecated	`--chain-id`	`--chain`
Deprecated	`--tx-bytes`, `--tx-json`	`--tx` with `--tx-format`
Deprecated	`--privilege`, `--permission-token`	`--privilege-stdin`
Deprecated	`balance`	`wallet-balance`
Deprecated	`chain set`	Pass `--chain` per command. Stores nothing.
Deprecated	`chain get`	Nothing writes the value it reads.

Run commands --json after upgrading and regenerate stored command templates from its schema.

CLI Commands

Global Options

--json

--quiet

Environment

Chain identifiers

There is no global chain

signup

login

logout

whoami

session-info

sign-message

sign-typed-data

sign-tx

send-tx

chain get and chain set (deprecated)

request

policy get

policy set

2fa status

2fa enable

2fa disable

privilege create

wallet-balance