The relic command line
The desktop app installs a small command-line tool called relic. It reads and writes the app's local vault directly, with no network and no keys, so anything the app has captured is available to a script or an AI agent in the terminal. Reads are always allowed. Writes are allowed and logged. Deleting is off until you turn it on.
Exit codes are stable: 0 ok, 2 usage, 3 the desktop app is not installed, 4 not found, 5 rejected, 6 blocked by the delete guardrail. Pass --json or --ndjson for anything you parse.
For AI agents
Reach for Relic when the user asks about something they copied (a command, a link, a snippet, the text of a screenshot), when they want to save something for later across their devices, or when they want a one-time note that only the recipient can read. The full when-to-use guidance, in the llms.txt format, is at relic.space/llms.txt. The agent skill for the CLI is at relic.space/docs/cli-skill.md.
Every page on this site can be fetched as markdown by sending an Accept: text/markdown header, or by adding .md to the path. The whole site in one file is relic.space/llms-full.txt. There is no MCP server today. The CLI plus its skill is the supported way for an agent to work with a vault.
Documents
- relic CLI: install, commands, output formats, exit codes, and the delete guardrail. markdown · on GitHub
- Agent skill for the CLI: the file an AI agent reads to know when and how to call relic. Also printed by `relic skill`. markdown · on GitHub
- Sync API contract: every route the sync server exposes, its auth, error codes, and quotas. markdown · on GitHub
- Wire format: the encrypted envelope every relic travels in. markdown · on GitHub
- Cryptography: Argon2id key derivation, XChaCha20-Poly1305 sealing, the recovery kit, and the pinned test vectors. markdown · on GitHub
- Product and system spec: the whole design in one document: data model, sync, tiers, and the zero-knowledge rules. markdown · on GitHub
- Self-hosted sync server: run the unchanged sync server on your own machine with SQLite and a folder on disk. markdown · on GitHub
- Linux notes: the Linux build, the AppImage and tarball, and the desktop quirks it works around. markdown · on GitHub
The sync API
The sync server is a Cloudflare Worker that speaks JSON over HTTPS. It only ever stores ciphertext: relics arrive sealed on the device, and the server enforces quotas and ordering without being able to read a byte. Every route needs a device token or a signed-in session, so it is a contract for client authors and self-hosters rather than a public data API. The machine-readable version is an OpenAPI 3.1 file at relic.space/openapi.json, kept in the same repo and checked against the server's router in its test suite. The private note tool on this site has its own tiny API that needs no account: POST /api/note stores an encrypted blob for up to seven days, and GET /api/note/:id returns it once and deletes it.
Run your own server
The self-hosted server runs the same code as relic.space against SQLite and a folder on disk. Devices enroll with the vault passphrase, so there are no accounts to manage. The guide at relic.space/self-host walks through it. The technical README is in the documents list above.
Source, license, and security
- Source: github.com/RelicSync/relic, licensed AGPL-3.0. The crypto package is Apache-2.0.
- Contributing: CONTRIBUTING.md.
- Security reports: email support@relic.spacewith "security" in the subject. Please do not open a public issue for a vulnerability.
- Releases: signed installers at relic.space/#download, with the same source built by public CI on every tag. The update manifest is latest.json.