orthanc.sh

A Foundry CLI
built for agents.

One Rust binary for Palantir Foundry, with structured JSON output and plan-first writes.

curl -fsSL https://github.com/zaycruz/orthanc/releases/latest/download/install.sh | sh

SHA-256 verified. Installs to ~/.local/bin. No GitHub account required. More install options

ORT-01Live runs · recorded against Foundry
Foundry, recorded live during the run

Plan-first writes: create a folder, read it back, delete it. Real commands and output, recorded live against a Foundry sandbox with Orthanc 0.3.0. The Foundry window beside it was recorded during the same run, on the same clock; long waits play at 20× on both sides. Everything created is deleted afterwards.

Transcript
# agent: make a folder for Q3 docs. Plan first.
$ orthanc folder create q3-docs -p $P
{
  "mode": "plan",
  "request": {
    "body": {
      "displayName": "q3-docs",
      "parentFolderRid": "ri.compass.main.folder.f23e9fb1-b130-401d-9612-c6b8a1edb159"
    },
    "path": "/v2/filesystem/folders",
    "verb": "POST"
  }
}
# agent: plan looks right; apply it
$ F=$(orthanc folder create q3-docs -p $P --apply | jq -r .rid)
$ orthanc folder get $F | jq "{display_name, path}"
{
  "display_name": "q3-docs",
  "path": "/Sandbox-c0c396/orthanc-e2e/q3-docs"
}
# agent: done with it. Plan the delete.
$ orthanc resource delete $F
{
  "mode": "plan",
  "request": {
    "body": null,
    "path": "/v2/filesystem/resources/ri.compass.main.folder.bfcd49bd-7d5c-4113-8300-78a84234f830",
    "verb": "DELETE"
  }
}
# agent: apply the delete (moves it to trash)
$ orthanc resource delete $F --apply >/dev/null
$ orthanc resource get $F | jq .trash_status
"DIRECTLY_TRASHED"
# agent: the project is back as it was
ORT-02Guarantees

Plan first

Every command that changes Foundry prints the exact request as a plan and changes nothing until you add --apply.

See it in Basics

One envelope

Add --agent and any command, including a parse error, returns one foundry-agent-v1 object: data, errors, warnings, pagination, always in the same place.

Typed errors

Every error has a type and a nonzero exit code. API errors carry Foundry's error name and say whether a retry can help.

Credentials out of band

Tokens are stored once per profile, in the macOS Keychain or the Linux Secret Service (a 0600 file on a headless host), and read from stdin or the environment. They never enter argv, logs, or output.

ORT-03Install

Install

Two channels, one installer.

Stable

Latest tagged release.

curl -fsSL https://github.com/zaycruz/orthanc/releases/latest/download/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
orthanc --version

Nightly

Rebuilt after every merge to main. Published as a prerelease. Installs beside stable.

curl -fsSL https://github.com/zaycruz/orthanc/releases/download/nightly/install.sh | \
  ORTHANC_CHANNEL=nightly ORTHANC_INSTALL_DIR="$HOME/.local/orthanc-nightly/bin" sh
"$HOME/.local/orthanc-nightly/bin/orthanc" --version

Pinned

Any stable tag via ORTHANC_VERSION.

curl -fsSL https://github.com/zaycruz/orthanc/releases/latest/download/install.sh | \
  ORTHANC_VERSION=v0.7.3 sh

First run

In an interactive terminal the installer starts onboarding: it creates a profile and stores the token once, in the Keychain on macOS and in the Secret Service on Linux, or in a 0600 file on a headless Linux host. Set ORTHANC_SKIP_ONBOARDING=1 to defer.

orthanc onboarding
orthanc configure set-active PROFILE
Manual download and verification
TargetArchiveChecksum
macOS, Apple Siliconorthanc-aarch64-apple-darwin.tar.gz.sha256
macOS, Intelorthanc-x86_64-apple-darwin.tar.gz.sha256
Linux x86_64, glibc ≥ 2.35orthanc-x86_64-unknown-linux-gnu.tar.gz.sha256
shasum -a 256 -c orthanc-aarch64-apple-darwin.tar.gz.sha256
tar -xzf orthanc-aarch64-apple-darwin.tar.gz
install -m 755 orthanc ~/.local/bin/orthanc