curl-first · the cli is optional
Everything works with curl. The CLI is just shorter.
You don't need to install anything — every tool answers to the curl you already have. The curlhub CLI is a tiny, optional wrapper for when you'd rather type curlhub uuid than curl https://curlhub.sh/uuid: it forces HTTPS, keeps your token off the command line, and fails closed. Open source, MIT, checksum-verified.
No install needed — just curl:
Prefer the shortcut? Install the optional CLI:
install
Three ways to install.
The default drops a single script into your user path — no sudo needed. Prefer it system-wide, or building an image with no network? Pick a lane.
Per-user default
Installs to ~/.local/bin as your own user.
System-wide
Into /usr/local/bin for every user on the box.
Offline / pinned
Install from a vendored copy — no network at build time.
Runs as a normal user (no root required for the default), verifies the download against a published sha256 before it writes anything, and is fetched straight from github.com/tuxxin/curlhub.sh-cli — read it before you pipe it.
everyday use
One command, every tool.
The wrapper is thin on purpose: it turns a short path into a verified HTTPS request and hands you the same text you'd get from curl.
A few subcommands
| Command | What it does |
|---|---|
curlhub help [tool] | List every tool, or print the reference for one — e.g. curlhub help hash. |
curlhub version [--check] | Show the installed version; --check asks GitHub whether a newer release exists. |
curlhub update | Fetch and checksum-verify the latest wrapper, then replace this one in place. |
curlhub login | Validate your email and store an API token (needed to vote, discuss, or edit the wiki). |
curlhub logout | Forget the stored token and remove it from disk. |
curlhub token path|show|status | Print where the token lives, reveal it, or report whether one is present and valid. |
curlhub completion bash|zsh|fish | Emit a shell-completion script to source from your rc file. |
built to be safe
Fail-closed, by design.
A wrapper that carries your token has to be paranoid. This one passes through only vetted flags and refuses anything that could redirect, downgrade, or exfiltrate the request.
01 Allowlist passthrough
Only vetted curl flags reach the wire. A second URL, -K/--config, -k/--insecure, or -x/--proxy is refused outright — so your token can't be pointed at a host you didn't mean.
02 HTTPS or nothing
Every request is pinned with --proto '=https'. There is no plaintext fallback and no way to talk the wrapper down to http://.
03 Ignores hostile config
It calls curl -q, so a tampered ~/.curlrc can't sneak in a redirect, a proxy, or an insecure downgrade behind your back.
04 Token never on the command line
Your API token is written 0600 and read from disk into the request — never passed as an argument, so it stays out of ps, your shell history, and process listings.
05 Checksum-verified & open source
The installer and every curlhub update verify a published sha256 before writing a byte. The whole wrapper is MIT-licensed and readable at github.com/tuxxin/curlhub.sh-cli — audit it, pin it, fork it.