---
name: nordvpn-client
description: Use when managing NordVPN on macOS or Linux, including install/bootstrap, login, connect, disconnect, status checks, or verifying a VPN location before running another skill.
---

# NordVPN Client

Cross-platform NordVPN lifecycle management for macOS and Linux hosts.

## What This Skill Is For

- Probing whether NordVPN is already installed
- Bootstrapping NordVPN if it is missing
- Logging in through the Linux CLI or the macOS app/CLI path
- Connecting to a country or city before a follow-up action such as `web-automation`
- Disconnecting and checking VPN status
- Verifying public IP and geolocation after connect

## Command Surface

```bash
node scripts/nordvpn-client.js status
node scripts/nordvpn-client.js install
node scripts/nordvpn-client.js login
node scripts/nordvpn-client.js verify
node scripts/nordvpn-client.js verify --country "Italy"
node scripts/nordvpn-client.js verify --country "Italy" --city "Milan"
node scripts/nordvpn-client.js connect --country "Italy"
node scripts/nordvpn-client.js connect --city "Milan"
node scripts/nordvpn-client.js connect --country "Italy" --city "Milan"
node scripts/nordvpn-client.js disconnect
```

## Platform Notes

- Linux:
  - uses the official `nordvpn` CLI
  - install path follows NordVPN's Linux installer
  - token login is supported through `NORDVPN_TOKEN`
- macOS:
  - prefers Homebrew cask install: `brew install --cask nordvpn`
  - prefers a usable `nordvpn` CLI if the installed package exposes one
  - otherwise falls back to opening the NordVPN app and guiding the manual login/connect path

## Credentials

Do not store secrets in this skill.

Supported env vars:

- `NORDVPN_TOKEN`
- `NORDVPN_USERNAME`
- `NORDVPN_PASSWORD`

Optional credential file env vars:

- `NORDVPN_TOKEN_FILE`
- `NORDVPN_PASSWORD_FILE`

## Verification Behavior

`status`, `verify`, and `connect` report machine-readable JSON including:

- platform
- install state
- control mode (`cli` vs `app-manual`)
- auth state
- connection state
- requested target
- public IP lookup and geolocation

Use this skill first, then run the follow-up task under the active VPN session.
Use `verify` when you want an explicit post-connect location check without changing VPN state.

## Known Boundaries

- Linux country connect is official CLI behavior.
- Linux city connect is attempted through the CLI target string and then validated by post-connect IP/location checks.
- macOS app-only fallback cannot guarantee non-interactive login/connect if the installed app does not expose a CLI. In that case the skill will open the app and return a clear manual-action-required result.
- On macOS, Homebrew can install only the GUI app. That still counts as a supported install state; `status` will report `controlMode: "app-manual"` rather than treating the app as missing.