Ping CLI
PingOne DaVinci Authorize Credentials MFA Protect Verify PingFederate
Ping CLI is a cross-platform command-line tool for performing AI-first headless identity operations against Ping Identity services. It’s the workflow execution layer: the piece that lets AI agents and developers automate, script, and promote identity configuration without opening a browser console.
Where MCP servers give your AI agent interactive, natural language access to Ping Identity platforms, Ping CLI handles repeatable, scriptable operations: running commands in CI/CD pipelines, promoting configuration across environments, and automating tasks that happen outside of an IDE session.
Ping CLI plays two distinct roles in agentic workflows depending on the environment:
-
In development and sandbox environments, it gives agent harnesses a direct interface to Ping Identity platform APIs when MCP is not available, enabling rapid prototyping with full CLI-managed authentication.
-
In production environments, the agent uses Ping CLI to export configuration from a development environment, creates a pull request against a config-as-code repository, and initiates the GitOps promotion workflow. The agent can then drive that workflow — triggering runs, monitoring status, and retrying failures. The pipeline itself invokes Ping CLI to apply configuration deterministically to the target environment. The agent never calls production APIs directly; the pipeline is the governance gate.
Role in the AI-first stack
| Layer | Tool | Context |
|---|---|---|
Discovery |
Agent-ready docs and |
All environments |
Domain expertise |
Agent Skills |
All environments |
Interactive configuration |
AIC MCP Server, DaVinci MCP Server |
IDE sessions with MCP host available |
Workflow execution |
Ping CLI, Terraform |
Sandbox (direct); production (export → GitOps PR → pipeline applies) |
Deployment contexts
Development and sandbox
In development and sandbox environments, an agent harness can use Ping CLI commands directly as tools. The CLI manages authentication to Ping Identity platform APIs, so the agent inherits whatever authorization has been granted to it, and can invoke commands without holding credentials directly.
This pattern supports rapid prototyping and is suitable for environments that are not subject to strict governance requirements.
Refer to Using Ping CLI in development environments for authentication delegation patterns, OAuth client recommendations for headless harnesses, and example operations.
CI/CD and production
In production environments, Ping CLI is used alongside, or as an alternative to Terraform to feed configuration into a CI/CD pipeline. The agent triggers and monitors the pipeline; the pipeline applies changes to production after a review gate. The agent never holds production credentials, nor is it directly interacting with the live production instance configuration.
Refer to Ping CLI with CI/CD pipelines for the full governance model, config-as-code patterns, and a worked example.
Agent Skills for Ping CLI
Ping CLI ships with its own Agent Skills support. Installing a Ping CLI skill gives your AI coding assistant direct knowledge of available commands, subcommands, flags, and service connectors, so it can construct valid CLI invocations without trial and error.
|
The Agent Skills for Ping CLI are designed to be used for specific use cases relating to the CLI and are not included with the Ping Identity agent plugins. |
You can install the "Ping CLI usage" skill, designed to reduce the need for agents to request and interpret --help output:
pingcli agent-skills install pingcli-usageAfter installation, your agent can reason about Ping CLI commands in context, alongside any active MCP tools or SDK skills.