CLI & API reference.

# install (macOS / Linux via Homebrew, or Go)
brew install almata-ai/tap/veil
# or:  go install github.com/almata-ai/veil-cli@latest

# sign in from the browser (people), stores a token locally
veil login
veil whoami

# exposure scan — free, unmetered (what a decompiler + AI read first)
veil scan app.o

# or use an API key (CI)
export VEILCC_KEY="veil_sk_live_…"        # or pass --api-key

veil protect [FLAGS] <input.o | module.ll> -o <output>

# seal a crown-only C/C++ object
veil protect --seal crown.o --proto "uint32_t check_license(const char*)" -o crown.sealed.o

# seal by symbol + signature (Rust / any C-ABI object)
veil protect --seal --symbols check_license \
  --proto "uint32_t check_license(const unsigned char*, size_t)" \
  liblicense.o -o license.sealed.o

# obfuscate, seal, then harden source with one veil:seal annotation
veil protect crown.c --obfuscate --seal --post-obfuscate -o crown.o

# strip an existing object without sealing
veil protect --strip app.o -o app.stripped.o

# seal with a device-bound key, unwrapped at runtime, never in the file
veil protect --seal --seal-key device-bound --key-provider veil_key \
  attest.o --proto "uint32_t attest(const char*)" -o attest.sealed.o --receipt build-receipt.json

veil verify build-receipt.json --artifact app.sealed.o
# → receipt hash matches · sealed: check_license · level seal · ok

curl https://veilcc.com/api/protect \
  -H "Authorization: Bearer $VEILCC_KEY" \
  -F "binary=@license.o" \
  -F "seal=1" \
  -F "proto=uint32_t check_license(const char*)" \
  -F "anti_debug=1" \
  -o response.json

{
  "ok": true,
  "artifact_b64": "f0VMRgIBAQ…",          // the protected object, base64
  "receipt": {
    "protect": "seal",
    "obfuscate": "off",
    "seal": "on",
    "sealed_symbol": "check_license",
    "target": "arm64-macos",
    "plaintext_in_file": "none",
    "hot_paths": "left native",
    "key_cache": "ephemeral (scrubbed per call)",
    "anti_debug": "on (traced process decrypts to garbage)",
    "seed": "0x9f3ac1…",
    "receipt_hash": "b7a4…e39c"
  },
  "quota": { "used": 42, "limit": 500 }
}