CLI for interacting with Penpot's full REST and RPC API
  • Rust 95.3%
  • Just 4.6%
  • Shell 0.1%
Find a file
Charles Jacquin f72cae07f7
All checks were successful
qa / qa (push) Successful in 25s
release / build-x86_64 (push) Successful in 38s
release / build-aarch64 (push) Successful in 49s
release / publish (push) Successful in 4s
release: v0.2.0
2026-05-22 12:33:28 +02:00
.forgejo/workflows ci: add full QA steps (fmt, clippy, test) 2026-05-22 00:43:17 +02:00
hooks feat: add git hooks for fmt-check + clippy/test, fix formatting 2026-05-22 00:48:46 +02:00
src fix: rewrite token commands with correct Penpot change types 2026-05-22 11:37:54 +02:00
tests feat: add integration tests against live Penpot instance (17 tests) 2026-05-22 01:22:40 +02:00
.gitignore feat: add unit tests for pure functions (16 tests) 2026-05-22 01:01:39 +02:00
Cargo.lock release: v0.2.0 2026-05-22 12:33:28 +02:00
Cargo.toml release: v0.2.0 2026-05-22 12:33:28 +02:00
justfile feat: add integration tests against live Penpot instance (17 tests) 2026-05-22 01:22:40 +02:00
README.md docs: update README with cookie auth support 2026-05-22 00:30:58 +02:00

penpot-api-cli

CLI for interacting with Penpot's full REST and RPC API.

Built as a Rust binary for agent consumption — JSON output by default, no MCP server required.

Installation

cargo build --release
cp target/release/penpot-api-cli ~/.local/bin/penpot

Configuration

Env var Default Description
PENPOT_URL http://localhost:3449 Penpot instance base URL (also reads PENPOT_BASE_URL)
PENPOT_ACCESS_TOKEN (empty) Access token (Profile → Access tokens). Takes priority over cookie auth.
PENPOT_AUTH_TOKEN_COOKIE (empty) OIDC session cookie for instances without access tokens. Falls back automatically.

Usage

# List teams
penpot team list

# List projects in a team
penpot project list <team-id>

# List files in a project
penpot file list <project-id>

# Get file metadata
penpot file info <file-id>

# Get full file data
penpot file get <file-id>

# Create a file
penpot file create --project-id <id> --name "My File"

# Export a frame as PNG
penpot export png <file-id> --page-id <id> --object-id <id>

# Design tokens
penpot token get <file-id>
penpot token create-color <file-id> --set global --name brand/primary --value "#0066ff"
penpot token create-dimension <file-id> --set spacing --name md --value "16px" --token-type spacing
penpot token import <file-id> tokens.json

# Canvas primitives
penpot page create <file-id> --name "Page 1"
penpot page create-frame <file-id> --page-id <id> --name "Header" --x 0 --y 0 --width 1440 --height 80
penpot page create-text <file-id> --page-id <id> --parent-id <id> --content "Hello" --x 20 --y 20 --width 200 --height 30

Architecture

Mirrors forgejo-cli conventions:

  • config.rs — API client + env var resolution
  • cli.rs — Clap derive definitions
  • commands/ — One module per domain (profile, team, project, file, page, export, token, comment, webhook, access-token)
  • output.rs — JSON formatting (default for agent consumption)

All Penpot interaction goes through the RPC command API (/api/rpc/command/<cmd>) with Authorization: Token <PAT> authentication, matching the MCP server's transport layer.