Your agent is fluent in shell. Crypto only speaks browser.

Every route to swapping crypto ends at a browser — an extension, an account, a human clicking approve. OpenSwap CLI is a crosschain swap you run as a command, with no account, no KYC and no keys held. We cover why the terminal is the right shape for this, what happens when you run one, the limits worth knowing, and your first swap in six steps.

Your AI agent drives command-line tools better than most people do. It chains curl and jq and git rebase without being told the syntax, because shell is everywhere in what it learned from. What it cannot do is swap. Every route to moving value across chains ends at a browser: a wallet extension that needs a human to click approve, a web app that needs an account, an exchange that needs a passport. Crypto is programmable money with an interface only a person can operate. So we shipped a swap that is just a command.

npx openswap@latest

§ 01 Why agents get a CLI and not a server

There is an argument running through developer circles this year about how agents should use tools. One camp says MCP servers — a protocol where a tool advertises its whole schema to the model. The other says: just give it a CLI.¹⁰

The mechanical case for the CLI is about cost. An MCP server injects its tool definitions into context on every turn, whether or not the agent ever calls it. A command-line tool costs nothing until it is invoked, and the agent already knows how to invoke it, because it has read a million shell sessions.⁰⁹

This is not a fight I want to win. A CLI can be wrapped as an MCP server; the reverse is harder. But for an operation where being wrong costs money, there is a second argument that I think is the real one. A CLI has a surface you can audit. It has exit codes. It has --dry-run. It writes files you can read afterwards. When an agent proposes to move $4,000 across a bridge, I would rather that intent pass through something with a frozen contract than something with a schema.

§ 02 What actually happens when you run a swap

The part that surprises people is that the CLI never touches your keys, and this is architectural rather than a promise.

You ask for a route. Quotes stream in live over SSE from every protocol the backend can reach, and the tool normalizes them — expected receive, every fee, the ones nobody could price. You pick one. You give it a destination address and a refund address. It then asks the protocol for a deposit address: a one-time address that belongs to the swap, not to us.

From there the commitment is a plain on-chain send. You pay that address from whatever wallet you already use — hardware, mobile, whatever signs. Scan the QR in the terminal or copy the string. There is no approve transaction, no token allowance, no browser extension, and no seed phrase anywhere near the process. The protocol watches for your deposit, fills it, and sends the output to your destination address.⁰¹⁰²⁰³

Two details that exist because the alternative is a bug that costs someone money. The payment URI is rebuilt locally from an address the CLI validated itself, never rendered from a string the server sent — otherwise bitcoin:<attacker>?label=<our address> passes a naive "does it contain our address" check while paying the attacker. And in the deposit flow the receipt is written to disk before payment instructions render, so a swap cannot exist on-chain without existing on your machine. Close the terminal mid-swap and openswap resume picks it up.⁰⁴

§ 03 What we shipped

One command, no install, no account, no API key. It runs on a built-in community key; bring your own and the affiliate fees route to you instead, which is also why we are relaxed about forks. It publishes MIT-licensed with zero runtime dependencies and a provenance attestation you can check yourself with npm audit signatures.⁰⁵⁰⁶

The part built for machines is the part I care about. Every command a bot would call takes --json and returns a versioned envelope — watch, being a live feed, streams one JSON object per line instead. The exit codes are frozen: 4 is "no route, policy rejected, quote expired," 6 is "signer unavailable," 7 is "broadcast failed or unknown." A bot branches on a number, not on English prose that might get reworded next release.⁰⁷

openswap bot init scaffolds a policy — allowlists, USD ceilings, fee caps, cooldowns, a kill-switch file — where a script or an LLM may propose a trade but only the policy can authorize it. openswap agent setup installs the Claude Code skill.

None of this is novel as a category. Kraken shipped a CLI for agents in March, CoinMarketCap in March, MoonPay in February, Alpaca in April, and LI.FI's CLI makes the same context-cost argument we do.⁰⁸ Kraken's is the better tool if you already have a Kraken account — it can do things a non-custodial CLI structurally cannot, and it does them faster. The difference shows up when you would rather not have an account: each of those runs on rails the company itself operates, and this one runs on protocols we do not control. That costs us the ability to fix your swap when a protocol has a bad day. It is the trade we wanted.

§ 04 The honest limits

Now the part the launch post usually skips.

The most interesting thing in the codebase is a feature that is turned off. There is a wallet-signing lane that would unlock routes needing a signed transaction rather than a deposit address. It ships disabled, behind OPENSWAP_ENABLE_SIGNER=1, and the comment above the flag gives three reasons, starting with the sharpest: the validator accepts backend-authored calldata, and an ERC-20 transfer of your whole balance carries no native value and is not an approve, so it clears every check currently written. Until those are fixed, a hostile or compromised backend could drain a signing wallet. So it is off.⁰⁴

Any tool can add a feature. Refusing to enable one you cannot yet prove safe is the part that costs something.

That has consequences you should know before you install. With a default install, the protocols the tool can execute on are Chainflip, NEAR and Relay. Everything else quotes — you will see the routes and the prices — but cannot be paid. From an EVM source chain the signer lane would unlock some of them; from a non-EVM source like Bitcoin or Solana they are quote-only regardless of any flag. THORChain and Maya sit in that second group today. And bot mode rides the same signing lane, so on a default install it will gate, price and simulate a trade — but --live cannot spend.

Two more. Twenty of the twenty-five non-EVM chains the CLI knows about have no dedicated address validator yet, so those destinations get a weaker format check than an EVM address does. And this is a front end to protocols we do not operate: their liquidity, their outages, their bugs.

And nobody outside my team has audited this code. There is no third-party security review of v0.1.1, and I am not going to describe an internal one as though it were. It is MIT and it is public specifically so that sentence can stop being true.

None of that is disqualifying. All of it is cheaper to know now than at the confirm screen.

§ 05 Your first swap, in six steps

Nothing below requires an account, and the first two steps move no money at all.

1. Take the tour first. openswap tour walks a complete swap in about two minutes on real live prices with an entirely simulated payment. No deposit address, no receipt, nothing about the swap saved.
2. Compare routes, read-only. openswap quote -a 100 -f arb:USDC -t btc:BTC. Assets take natural forms — base usdc and usdc on base both resolve, and a bare USDC prompts you to pick the chain.
3. Read the fees, including the missing ones. A fee nobody could price renders as "not provided" — never as zero — and a route carrying one is ineligible for the cheapest badge. A usd: 0 against a non-zero amount means unpriced, not free.
4. Start the swap. openswap swap -a 100 -f arb:USDC -t btc:BTC. Enter a destination address, then the address you are paying from, which doubles as your refund address. Review, then confirm — creating the address is free; paying it is what commits the swap.
5. Pay the deposit address from your own wallet. Scan the QR or copy the address. That on-chain send is the entire commitment. The CLI never asks for a key, a seed, or a signature.
6. Track it, or walk away. openswap status <receipt> --watch, or openswap resume later. Every swap from this machine is in openswap history, and the receipt is on your disk whether or not the terminal is open.

Here is step 2 actually running, in test mode:

$ openswap quote -a 100 -f arb:USDC -t btc:BTC --plain
[test mode] simulated environment — no real funds move

protocol    expected_receive  usd    fees_usd  eta_s  deposit_address_support  flags
rango       0.00150716        99.47  0.4698    30     no                       best-output,cheapest
relay       0.00150625        99.41  0.5298    8      yes                      fastest
near        0.00150247        99.16  0.7797    45     yes
chainflip   0.00150216        99.14  0.7997    90     yes

Docs live at leokit.dev/cli/docs; the source is MIT at github.com/steemleo/openswap.

A swap should not require a browser, an account, or a human to click approve. It should be a command — something a person can run over SSH, a cron job can call at 3am, and an agent can invoke without anyone handing it a private key.¹¹

That is the whole idea, and the flag that ships turned off is the honest measure of how seriously we take it.

Survive > maximise. When you cannot prove it is safe, ship it switched off.