Slew
Sign in

Slew · developer platform

Developer docs

Publish products from the CLI, MCP, REST API, or GitHub App.

Get API credentialsOpenAPI schema

Getting started

Quickstart

Create a credential once, connect GitHub once, and then let the CLI or an agent do the repeatable work.

  1. Connect GitHub

    Install the Slew GitHub App from developer integrations and select the repositories Slew may read.

  2. Create a credential

    Create an organization credential with the smallest scopes your workflow needs. Copy it when shown; Slew stores only a digest.

  3. Authenticate your tool

    Use the same bearer credential with the CLI, MCP server, or REST API.

  4. Import, scan, then publish

    Importing creates private drafts. Publishing stays separate until scan evidence and seller authority are explicit.

shell4 lines
slew auth login --host https://slew.com
slew github connections
slew github repositories
slew github import owner/repository --version 1.0.0 --output id

Security

Credentials

API credentials are organization-bound, independently revocable, optionally expiring, and cannot impersonate a different actor or organization.

Authorization header

Authorization: Bearer YOUR_SLEW_API_CREDENTIAL

Treat a credential like a password. Prefer environment variables in CI, never put it in a repository, screenshot, prompt, or product artifact.

ScopeAllows
projects:readInspect products, releases, deliverables, and scan status.
projects:writeCreate and edit product and release drafts.
projects:publishPublish an externally visible, immutable release.
github:readList workspace-granted GitHub repositories for an API credential.

Confirm the active identity

shell2 lines
curl --request GET 'https://slew.com/v1/integrations/me' \
  --header 'Authorization: Bearer YOUR_SLEW_API_CREDENTIAL'

Command line

CLI

The dependency-free Python client works for a person at a terminal and for deterministic automation. Tables are the default; add --json or --output id when another tool consumes the result.

Private beta distribution

Until registry distribution is enabled, install it from an authorized source checkout.

shell3 lines
uv tool install --editable ./cli
slew --version
slew auth login --host https://slew.com
CommandPurpose
slew auth loginVerify and securely save an organization credential.
slew products listList product projects owned by the organization.
slew github importCreate a product and initial release from a repository ref.
slew github releaseCreate the next release of an existing product from GitHub.
slew deliverables listInspect quarantine, scan status, and eligible evidence.
slew releases publishExplicitly attest and publish an immutable release.

Create the next version from GitHub

shell5 lines
slew github release PRODUCT_ID owner/repository \
  --version 1.1.0 \
  --ref v1.1.0 \
  --parent-release PREVIOUS_RELEASE_ID \
  --json

Publish after scanning

shell6 lines
slew deliverables list
slew releases publish RELEASE_ID \
  --submission ARTIFACT_SUBMISSION_ID \
  --terms-name 'Standard commercial license' \
  --terms-file ./LICENSE.txt \
  --attest

Agents

MCP

Connect an MCP-capable agent to a small set of high-level tools. The server is stateless Streamable HTTP and uses the same bearer credential and scopes as REST.

json11 lines
{
  "mcpServers": {
    "slew": {
      "type": "http",
      "url": "https://slew.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_SLEW_API_CREDENTIAL"
      }
    }
  }
}

MCP client configuration formats and environment-variable substitution differ. Use your client's secure secret mechanism instead of committing the credential above.

ToolPurpose
list_github_repository_grantsList only the credential organization’s workspace grants; use each grant id as grant_id with a ref.
create_project_from_githubImport a granted repository ref and create the initial product release.
create_release_from_githubImport a granted repository ref into an existing product.
list_projects / get_projectInspect product and release state.
create_project / create_releaseCreate private drafts without publishing.
list_deliverablesInspect uploaded files and scan evidence.
publish_releasePublish with terms, evidence, and seller attestation.

Recommended agent instruction

Create and inspect drafts freely. Ask before calling publish_release.

HTTP

REST API

Use REST for custom integrations, CI systems, and clients that need direct control of the underlying resources. JSON request and response contracts are published through OpenAPI.

OpenAPI JSON Download schema
ResourceMethodPath
Credential identityGET/v1/integrations/me
GitHub installation connections (global; connector-only)GET/v1/integrations/organizations/{organization_id}/github/connections
Workspace repository grants (organization publishing access)GET/v1/integrations/organizations/{organization_id}/github/repository-grants
Product draftsGET · POST/v1/publishing/organizations/{organization_id}/products
DeliverablesGET/v1/artifacts/organizations/{organization_id}/submissions
Initial GitHub import (grant_id + ref)POST/v1/automation/organizations/{organization_id}/projects/from-github
New version from GitHub (grant_id + ref)POST/v1/automation/organizations/{organization_id}/projects/{product_id}/releases/from-github

Idempotent import

http5 lines
POST /v1/automation/organizations/{organization_id}/projects/from-github HTTP/1.1
Host: slew.com
Authorization: Bearer YOUR_SLEW_API_CREDENTIAL
Idempotency-Key: 7dd48599-f9e8-48be-8caa-c4c86cb06752
Content-Type: application/json

Reuse an idempotency key only when retrying the exact same operation. Slew pins the resolved commit and resumes partial work instead of creating duplicates.

Source imports

GitHub imports

Slew uses a platform-owned GitHub App with read-only metadata and contents access. Installation tokens are minted on demand and expire after one hour.

Repository refbranch, tag, or SHA
Exact commit40-character SHA
Quarantineprivate archive
Scannerscan evidence
Draftnot yet public

New product

Import the first release

Creates the product, quarantined artifact, and initial release draft together.

slew github import owner/repository

Existing product

Import the next release

Associates a new exact ref and release lineage with an existing product.

slew github release PRODUCT_ID owner/repository

Release safety

Publishing lifecycle

A release becomes public only when every required decision is explicit.

Exact bytes

Every deliverable is identified by a SHA-256 digest and immutable scan evidence.

Eligible evidence

Passed evidence—or disclosed findings—is required for every published file.

Versioned terms

The exact terms text is captured with the release and customer acceptance.

Seller authority

The publishing actor attests to distribution rights for every deliverable.