Skip to content
Back to skills

Jam Cli

CSecurity

Use the `jam` CLI when the Jam MCP server is not connected (Cloud Agents, CI, headless shells) or when you need shell-composable output. Reads a Jam's console, network, frames, and transcript with `jam get`, and records proof of a fix with `jam record run`. Install, auth with JAM_TOKEN, and the triage and proof loops.

  • 5 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 22, 2026
ai-agentsshellbashdebuggingbackend

Works with

  • cursor
  • terminal
  • cli
  • mcp

Security analysis

C71/100
  • criticalPipes output to a shell interpreter
  • mediumUses curl or wget to download content
  • criticalDownloads and executes remote scripts — classic supply chain attack

Pro shows the line behind each finding and how to fix it

Scanned October 22, 2026

npx -y skills add jamdotdev/skills --skill jam-cli --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Jam Cli?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Jam Cli
[![Security: C — Skills Directory](https://www.skillsdirectory.com/api/skills/jamdotdev-jam-cli-skills/badge)](https://www.skillsdirectory.com/skills/jamdotdev-jam-cli-skills)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: jam-cli
description: Use the `jam` CLI when the Jam MCP server is not connected (Cloud Agents, CI, headless shells) or when you need shell-composable output. Reads a Jam's console, network, frames, and transcript with `jam get`, and records proof of a fix with `jam record run`. Install, auth with JAM_TOKEN, and the triage and proof loops.
---

# Jam CLI

The Jam MCP server and the `jam` CLI read the same data with the same personal access token. Prefer the MCP tools when they are connected. Reach for the CLI when they are not (cloud agents, CI, a container) or when you want `--json` output to pipe through `jq`.

## Install

```bash
command -v jam >/dev/null || curl -fsSL https://native.jam.dev/install | bash
export PATH="$HOME/.local/bin:$PATH"
jam --version
```

Windows: `powershell -c "irm https://native.jam.dev/install.ps1 | iex"`.

## Authenticate

Check first, then pick the path that fits the environment:

```bash
jam auth status --json
```

- **Headless (Cloud Agents, CI):** set `JAM_TOKEN` to a personal access token. The CLI reads it for the life of the process and never writes it to disk. Create tokens under Settings → MCP at https://jam.dev/s/settings/mcp. Ask the user to add it as a secret; never paste a token into a file or a commit.
- **A machine with a browser:** `jam auth login` opens OAuth.
- **A token on stdin:** `echo "$TOKEN" | jam auth login --token`.

Exit code 3 means not authenticated. Branch on exit codes, not on stderr text.

## Load the full command reference

The binary ships its own skills. Install them into this repo so the agent gets the complete `jam get`, `jam list`, `jam create`, and `jam record` surface:

```bash
jam skills install --target <agent> --project
```

`<agent>` is one of `claude`, `cursor`, `codex`, or `opencode`. Pick the one you are running in.

`jam agent-context` prints the machine-readable command surface if you need a flag the skill does not mention.

## Triage a Jam link

A Jam id is the UUID at the end of `https://jam.dev/c/<id>`.

```bash
jam get jam "$ID" --json                      # what kind of Jam, title, URL
jam get intents "$ID" --json                  # cached summary: what the user tried, what broke
jam get console "$ID" --level error --json    # JS errors first
jam get network "$ID" --status 5xx --json     # failing backend calls
jam get events "$ID" --json                   # clicks, inputs, navigation
jam get frames "$ID" --overview               # one labeled grid of the video
jam get transcript "$ID" --json               # what the reporter said
```

Paginated reads return `{ items, next_cursor, truncated, hint }`. `hint` appears only when `truncated` is true. Pass `--after <cursor>` for the next page. Stop when you have the cause; do not fetch everything by reflex.

Leave findings on the Jam:

```bash
jam create comment "$ID" "Root cause: ..." --at 4200
```

## Record proof of a fix

`jam record run` records a window or display until the wrapped command exits, uploads the video, and prints `{ id, url, durationMs, width, height, target }`. Use it to attach evidence to a PR.

```bash
jam record windows --json                     # pick a windowId; ids change on reopen
jam record run --window-id <id> --title "Checkout completes after fix" --json -- bun run e2e/checkout.ts
```

- Proving a browser fix: add `--cdp <endpoint>` (a debug port such as `9222` from Chrome started with `--remote-debugging-port=9222 --user-data-dir=<dir>`, a `ws://` DevTools URL, or `auto`). The Jam's Console and Network panels fill from every open tab. `jam record start` prints a `cdpProxy`; point your browser driver at it instead of Chrome and its clicks and typing are recorded too.
- Driving several steps instead of one command: `jam record start [target flags]`, do the steps, then `jam record stop` uploads the Jam. `jam record cancel` discards it.
- No `--window-id` records the primary display. Fine on a box you own (CI runner, container). On a person's machine record one window and launch your own app instance so nothing of theirs is captured.
- macOS needs Screen Recording permission for the terminal. Linux needs an X11 display plus `ffmpeg wmctrl x11-xserver-utils`. Windows is not supported. `jam doctor` reports readiness.
- For a bug fix, record two Jams: the bug, then the fix. Comment each Jam's URL on the other.
- Title is the claim being proven, not "proof".

Create a Jam from an existing video or Playwright trace instead of recording live:

```bash
jam create jam '{"kind":"video","videoPath":"./run.mp4","playwrightTracePath":"./trace.zip","title":"Checkout"}'
```

Trace console, network, and user events are attached to the timeline, with typed secrets redacted.

## Deletes

Every `jam delete ...` needs `--yes` when piped, and nothing deleted can be restored. Confirm with the user before passing `--yes`.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.