diff --git a/cmd/hmsecrets/main.go b/cmd/hmsecrets/main.go
new file mode 100644
index 0000000..637184f
--- /dev/null
+++ b/cmd/hmsecrets/main.go
@@ -0,0 +1,7 @@
+package main
+
+import "git.handmadecities.com/HMC/shhh/internal/clis/hmsecrets"
+
+func main() {
+	hmsecrets.Execute()
+}
diff --git a/internal/clis/hmsecrets/cli.go b/internal/clis/hmsecrets/cli.go
new file mode 100644
index 0000000..70f0481
--- /dev/null
+++ b/internal/clis/hmsecrets/cli.go
@@ -0,0 +1,11 @@
+package hmsecrets
+
+import "git.handmadecities.com/HMC/shhh/pkg/secretsclient"
+
+func getClient(base, ca, cert, certKey string) secretsclient.Client {
+	cli, err := secretsclient.New(base, ca, cert, certKey)
+	if err != nil {
+		panic(err)
+	}
+	return cli
+}
diff --git a/internal/clis/hmsecrets/delete.go b/internal/clis/hmsecrets/delete.go
new file mode 100644
index 0000000..e4426d7
--- /dev/null
+++ b/internal/clis/hmsecrets/delete.go
@@ -0,0 +1,23 @@
+package hmsecrets
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rootCmd.AddCommand(delCmd)
+}
+
+var delCmd = &cobra.Command{
+	Use:   "del",
+	Short: "del [key]",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		cli := getClient(apiBase, caFile, clientCert, clientKey)
+		err := cli.Delete(args[0])
+		if err != nil {
+			return err
+		}
+		return nil
+	},
+}
diff --git a/internal/clis/hmsecrets/get.go b/internal/clis/hmsecrets/get.go
new file mode 100644
index 0000000..5ccd16d
--- /dev/null
+++ b/internal/clis/hmsecrets/get.go
@@ -0,0 +1,26 @@
+package hmsecrets
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rootCmd.AddCommand(getCmd)
+}
+
+var getCmd = &cobra.Command{
+	Use:   "get",
+	Short: "get [key]",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		cli := getClient(apiBase, caFile, clientCert, clientKey)
+		secret, err := cli.GetString(args[0])
+		if err != nil {
+			return err
+		}
+		fmt.Println(secret)
+		return nil
+	},
+}
diff --git a/internal/clis/hmsecrets/rootcmd.go b/internal/clis/hmsecrets/rootcmd.go
new file mode 100644
index 0000000..4333501
--- /dev/null
+++ b/internal/clis/hmsecrets/rootcmd.go
@@ -0,0 +1,59 @@
+package hmsecrets
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+var apiBase string
+var caFile string
+var clientCert string
+var clientKey string
+
+func init() {
+	rootCmd.PersistentFlags().StringVar(
+		&apiBase,
+		"api-base",
+		"",
+		"base url for the service",
+	)
+	rootCmd.MarkPersistentFlagRequired("api-base")
+
+	rootCmd.PersistentFlags().StringVar(
+		&caFile,
+		"ca-file",
+		"",
+		"CA cert file",
+	)
+	rootCmd.MarkPersistentFlagRequired("ca-file")
+
+	rootCmd.PersistentFlags().StringVar(
+		&clientCert,
+		"client-cert",
+		"",
+		"certificate to be used for client mTLS auth",
+	)
+	rootCmd.MarkPersistentFlagRequired("client-cert")
+
+	rootCmd.PersistentFlags().StringVar(
+		&clientKey,
+		"client-key",
+		"",
+		"private key for the certificate to be used for client mTLS auth",
+	)
+	rootCmd.MarkPersistentFlagRequired("client-key")
+}
+
+var rootCmd = &cobra.Command{
+	Use:   "hmsecrets",
+	Short: "Interact with the HandMade secrets service",
+}
+
+func Execute() {
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
diff --git a/internal/clis/hmsecrets/set.go b/internal/clis/hmsecrets/set.go
new file mode 100644
index 0000000..420e176
--- /dev/null
+++ b/internal/clis/hmsecrets/set.go
@@ -0,0 +1,23 @@
+package hmsecrets
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	rootCmd.AddCommand(setCmd)
+}
+
+var setCmd = &cobra.Command{
+	Use:   "set",
+	Short: "set [key] [value]",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		cli := getClient(apiBase, caFile, clientCert, clientKey)
+		err := cli.PutString(args[0], args[1])
+		if err != nil {
+			return err
+		}
+		return nil
+	},
+}
diff --git a/pkg/secretsclient/cli.go b/pkg/secretsclient/cli.go
index 8273c5d..770e5bb 100644
--- a/pkg/secretsclient/cli.go
+++ b/pkg/secretsclient/cli.go
@@ -33,6 +33,7 @@ func New(base, ca, cert, certKey string) (Client, error) {
 	}, nil
 }
 
+// TODO: Propagate errors to the callers.
 type client struct {
 	base string
 	h    *http.Client