Skip to main content
Siclaw stores most runtime data in a .siclaw/ folder relative to the directory where you start it. Create a dedicated working directory and reuse it: 
mkdir -p ~/siclaw-work
cd ~/siclaw-work

​
Install

npm install -g siclaw

siclaw local
Launches the Web UI at http://localhost:3000. On first startup, the local server creates a default admin account:
  • Username: admin
  • Password: admin
Change it after logging in, or set SICLAW_ADMIN_PASSWORD before the first start.

​
CLI (TUI)

siclaw
Personal terminal mode. Same investigation engine, no server.

​
From Source

git clone https://github.com/scitix/siclaw.git
cd siclaw
npm ci
npm run build:web
npm run build

# TUI
node siclaw.mjs

# Local server
node siclaw.mjs local

​
Configuration

By default, Siclaw reads and writes these paths relative to your current working directory: 
.siclaw/
├── config/
│   └── settings.json     ← LLM provider, model, API key
├── credentials/           ← Imported kubeconfigs, SSH keys, API tokens
├── skills/
└── user-data/
    ├── memory/
    │   └── .memory.db
    └── ...

​
LLM Configuration

TUI mode reads .siclaw/config/settings.json. The easiest path is to let the first-run wizard create it for you. Minimal example: 
{
  "providers": {
    "openai": {
      "baseUrl": "https://api.openai.com/v1",
      "apiKey": "sk-...",
      "api": "openai-completions",
      "models": [{ "id": "gpt-4o", "name": "GPT-4o" }]
    },
    "anthropic": {
      "baseUrl": "https://api.anthropic.com/v1",
      "apiKey": "sk-ant-...",
      "api": "anthropic",
      "models": [{ "id": "claude-sonnet-4-20250514", "name": "Claude Sonnet 4" }]
    }
  }
}
Once inside the TUI session, use /setup to manage providers, models, and credentials. In Local Server mode, configure providers and models in the Models page of the Web UI. See LLM Providers for provider examples.

​
Kubernetes Credentials

Siclaw tools resolve kubeconfig from its own credential store, not from your shell’s KUBECONFIG.
  • In TUI mode, use /setup to import a kubeconfig
  • In Local Server mode, add it in Credentials
After import, Siclaw can route kubectl calls through that stored credential.

​
Embedding (Optional)

To enable Investigation Memory with semantic search, add an embedding config: 
{
  "embedding": {
    "baseUrl": "https://api.example.com/v1",
    "apiKey": "sk-...",
    "model": "bge-m3",
    "dimensions": 1024
  }
}
If embedding.apiKey is omitted, Siclaw falls back to the default LLM provider key.

​
Reports

Deep investigation reports are written to: 
~/.siclaw/reports/