diff --git a/CHANGELOG-3.0.md b/CHANGELOG-3.0.md
index 8d8adfd1e3566..4b8dedd333884 100644
--- a/CHANGELOG-3.0.md
+++ b/CHANGELOG-3.0.md
@@ -28,6 +28,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Deprecate CamelCase `PathHierarchy` tokenizer name in favor to lowercase `path_hierarchy` ([#10894](https://github.com/opensearch-project/OpenSearch/pull/10894))
 - Breaking change: Do not request "search_pipelines" metrics by default in NodesInfoRequest ([#12497](https://github.com/opensearch-project/OpenSearch/pull/12497))
 - Refactor `:libs` module `bootstrap` package to eliminate top level split packages [#17117](https://github.com/opensearch-project/OpenSearch/pull/17117))
+- Refactor `:server` and `:distribution:tools:keystore-cli` module to eliminate top level split packages. [#17153](https://github.com/opensearch-project/OpenSearch/pull/17153))
 
 ### Deprecated
 
diff --git a/distribution/src/bin/opensearch-keystore b/distribution/src/bin/opensearch-keystore
index 9f6cb65feeeeb..1f673f933a7af 100755
--- a/distribution/src/bin/opensearch-keystore
+++ b/distribution/src/bin/opensearch-keystore
@@ -2,7 +2,7 @@
 
 set -e -o pipefail
 
-OPENSEARCH_MAIN_CLASS=org.opensearch.common.settings.KeyStoreCli \
+OPENSEARCH_MAIN_CLASS=org.opensearch.cli.keystore.KeyStoreCli \
   OPENSEARCH_ADDITIONAL_CLASSPATH_DIRECTORIES=lib/tools/keystore-cli \
   "`dirname "$0"`"/opensearch-cli \
   "$@"
diff --git a/distribution/src/bin/opensearch-keystore.bat b/distribution/src/bin/opensearch-keystore.bat
index f6ab163199b77..a77fb89b7aa7a 100644
--- a/distribution/src/bin/opensearch-keystore.bat
+++ b/distribution/src/bin/opensearch-keystore.bat
@@ -3,7 +3,7 @@
 setlocal enabledelayedexpansion
 setlocal enableextensions
 
-set OPENSEARCH_MAIN_CLASS=org.opensearch.common.settings.KeyStoreCli
+set OPENSEARCH_MAIN_CLASS=org.opensearch.cli.keystore.KeyStoreCli
 set OPENSEARCH_ADDITIONAL_CLASSPATH_DIRECTORIES=lib/tools/keystore-cli
 call "%~dp0opensearch-cli.bat" ^
   %%* ^
diff --git a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/AddFileKeyStoreCommand.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/AddFileKeyStoreCommand.java
similarity index 97%
rename from distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/AddFileKeyStoreCommand.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/AddFileKeyStoreCommand.java
index b948be24350f4..baa2068504f18 100644
--- a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/AddFileKeyStoreCommand.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/AddFileKeyStoreCommand.java
@@ -30,7 +30,7 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import joptsimple.OptionSet;
 import joptsimple.OptionSpec;
@@ -39,6 +39,7 @@
 import org.opensearch.cli.UserException;
 import org.opensearch.common.SuppressForbidden;
 import org.opensearch.common.io.PathUtils;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.env.Environment;
 
 import java.nio.file.Files;
diff --git a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/AddStringKeyStoreCommand.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/AddStringKeyStoreCommand.java
similarity index 98%
rename from distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/AddStringKeyStoreCommand.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/AddStringKeyStoreCommand.java
index a8bc1dff8838f..4887cde6110a6 100644
--- a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/AddStringKeyStoreCommand.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/AddStringKeyStoreCommand.java
@@ -30,7 +30,7 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import joptsimple.OptionSet;
 import joptsimple.OptionSpec;
@@ -38,6 +38,7 @@
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
 import org.opensearch.common.CheckedFunction;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.env.Environment;
 
 import java.io.BufferedReader;
diff --git a/server/src/main/java/org/opensearch/common/settings/BaseKeyStoreCommand.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/BaseKeyStoreCommand.java
similarity index 65%
rename from server/src/main/java/org/opensearch/common/settings/BaseKeyStoreCommand.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/BaseKeyStoreCommand.java
index 73a2fc031fd7c..f2f451416763a 100644
--- a/server/src/main/java/org/opensearch/common/settings/BaseKeyStoreCommand.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/BaseKeyStoreCommand.java
@@ -30,14 +30,14 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import joptsimple.OptionSet;
 import joptsimple.OptionSpec;
 import org.opensearch.cli.ExitCodes;
-import org.opensearch.cli.KeyStoreAwareCommand;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.core.common.settings.SecureString;
 import org.opensearch.env.Environment;
 
@@ -53,13 +53,36 @@ public abstract class BaseKeyStoreCommand extends KeyStoreAwareCommand {
     private KeyStoreWrapper keyStore;
     private SecureString keyStorePassword;
     private final boolean keyStoreMustExist;
-    OptionSpec<Void> forceOption;
 
+    /**
+     * Option to force operations without prompting for confirmation.
+     * When specified, operations proceed without asking for user input.
+     */
+    protected OptionSpec<Void> forceOption;
+
+    /**
+     * Creates a new BaseKeyStoreCommand with the specified description and existence requirement.
+     *
+     * @param description The description of the command
+     * @param keyStoreMustExist If true, the keystore must exist before executing the command.
+     *                         If false, a new keystore may be created if none exists.
+     */
     public BaseKeyStoreCommand(String description, boolean keyStoreMustExist) {
         super(description);
         this.keyStoreMustExist = keyStoreMustExist;
     }
 
+    /**
+     * Executes the keystore command by loading/creating the keystore and handling password management.
+     * If the keystore doesn't exist and keyStoreMustExist is false, prompts to create a new one
+     * unless the force option is specified.
+     *
+     * @param terminal The terminal to use for user interaction
+     * @param options The command-line options provided
+     * @param env The environment settings
+     * @throws Exception if there are errors during keystore operations
+     * @throws UserException if the keystore is required but doesn't exist
+     */
     @Override
     protected final void execute(Terminal terminal, OptionSet options, Environment env) throws Exception {
         try {
@@ -96,19 +119,34 @@ protected final void execute(Terminal terminal, OptionSet options, Environment e
         }
     }
 
+    /**
+     * Gets the current keystore instance.
+     *
+     * @return The current {@link KeyStoreWrapper} instance being operated on
+     */
     protected KeyStoreWrapper getKeyStore() {
         return keyStore;
     }
 
+    /**
+     * Gets the password for the current keystore.
+     *
+     * @return The {@link SecureString} containing the keystore password
+     */
     protected SecureString getKeyStorePassword() {
         return keyStorePassword;
     }
 
     /**
-     * This is called after the keystore password has been read from the stdin and the keystore is decrypted and
-     * loaded. The keystore and keystore passwords are available to classes extending {@link BaseKeyStoreCommand}
-     * using {@link BaseKeyStoreCommand#getKeyStore()} and {@link BaseKeyStoreCommand#getKeyStorePassword()}
-     * respectively.
+     * Executes the specific keystore command implementation.
+     * This is called after the keystore password has been read and the keystore
+     * is decrypted and loaded. The keystore and keystore passwords are available using
+     * {@link #getKeyStore()} and {@link #getKeyStorePassword()} respectively.
+     *
+     * @param terminal The terminal to use for user interaction
+     * @param options The command line options that were specified
+     * @param env The environment configuration
+     * @throws Exception if there is an error executing the command
      */
     protected abstract void executeCommand(Terminal terminal, OptionSet options, Environment env) throws Exception;
 }
diff --git a/server/src/main/java/org/opensearch/common/settings/ChangeKeyStorePasswordCommand.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/ChangeKeyStorePasswordCommand.java
similarity index 70%
rename from server/src/main/java/org/opensearch/common/settings/ChangeKeyStorePasswordCommand.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/ChangeKeyStorePasswordCommand.java
index 74e09f6f233d5..1c617837ee5fe 100644
--- a/server/src/main/java/org/opensearch/common/settings/ChangeKeyStorePasswordCommand.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/ChangeKeyStorePasswordCommand.java
@@ -30,12 +30,13 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import joptsimple.OptionSet;
 import org.opensearch.cli.ExitCodes;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.core.common.settings.SecureString;
 import org.opensearch.env.Environment;
 
@@ -44,12 +45,27 @@
  *
  * @opensearch.internal
  */
-class ChangeKeyStorePasswordCommand extends BaseKeyStoreCommand {
+public class ChangeKeyStorePasswordCommand extends BaseKeyStoreCommand {
 
     ChangeKeyStorePasswordCommand() {
         super("Changes the password of a keystore", true);
     }
 
+    /**
+     * Executes the password change command by prompting for a new password
+     * and saving the keystore with the updated password.
+     * <p>
+     * This implementation will:
+     * 1. Prompt for a new password with verification
+     * 2. Save the keystore with the new password
+     * 3. Display a success message upon completion
+     *
+     * @param terminal The terminal to use for user interaction
+     * @param options The command-line options provided
+     * @param env The environment settings containing configuration directory
+     * @throws Exception if there are errors during password change
+     * @throws UserException if there are security-related errors
+     */
     @Override
     protected void executeCommand(Terminal terminal, OptionSet options, Environment env) throws Exception {
         try (SecureString newPassword = readPassword(terminal, true)) {
diff --git a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/CreateKeyStoreCommand.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/CreateKeyStoreCommand.java
similarity index 96%
rename from distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/CreateKeyStoreCommand.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/CreateKeyStoreCommand.java
index a4ab98ce730ee..c8fbb0994d6aa 100644
--- a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/CreateKeyStoreCommand.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/CreateKeyStoreCommand.java
@@ -30,14 +30,14 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import joptsimple.OptionSet;
 import joptsimple.OptionSpec;
 import org.opensearch.cli.ExitCodes;
-import org.opensearch.cli.KeyStoreAwareCommand;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.core.common.settings.SecureString;
 import org.opensearch.env.Environment;
 
diff --git a/server/src/main/java/org/opensearch/common/settings/HasPasswordKeyStoreCommand.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/HasPasswordKeyStoreCommand.java
similarity index 69%
rename from server/src/main/java/org/opensearch/common/settings/HasPasswordKeyStoreCommand.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/HasPasswordKeyStoreCommand.java
index 59d8a44846e11..38ae976501bc9 100644
--- a/server/src/main/java/org/opensearch/common/settings/HasPasswordKeyStoreCommand.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/HasPasswordKeyStoreCommand.java
@@ -30,18 +30,19 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import joptsimple.OptionSet;
-import org.opensearch.cli.KeyStoreAwareCommand;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.env.Environment;
 
 import java.nio.file.Path;
 
 /**
- * KeyStore command that has a password.
+ * KeyStore command that checks if the keystore exists and is password-protected.
+ * Exits with a non-zero status code if the keystore is missing or not password-protected.
  *
  * @opensearch.internal
  */
@@ -49,12 +50,29 @@ public class HasPasswordKeyStoreCommand extends KeyStoreAwareCommand {
 
     static final int NO_PASSWORD_EXIT_CODE = 1;
 
-    HasPasswordKeyStoreCommand() {
+    /**
+     * Creates a new HasPasswordKeyStoreCommand.
+     * This command checks for the existence of a password-protected keystore
+     * and exits with {@link #NO_PASSWORD_EXIT_CODE} if the keystore is missing
+     * or not password-protected.
+     */
+    protected HasPasswordKeyStoreCommand() {
         super(
             "Succeeds if the keystore exists and is password-protected, " + "fails with exit code " + NO_PASSWORD_EXIT_CODE + " otherwise."
         );
     }
 
+    /**
+     * Executes the password check command by verifying if the keystore exists
+     * and is password-protected.
+     *
+     * @param terminal The terminal for user interaction and output
+     * @param options The command-line options provided
+     * @param env The environment settings containing configuration directory
+     * @throws UserException with {@link #NO_PASSWORD_EXIT_CODE} if the keystore
+     *         is missing or not password-protected
+     * @throws Exception if there are other errors during execution
+     */
     @Override
     protected void execute(Terminal terminal, OptionSet options, Environment env) throws Exception {
         final Path configFile = env.configDir();
diff --git a/server/src/main/java/org/opensearch/cli/KeyStoreAwareCommand.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/KeyStoreAwareCommand.java
similarity index 69%
rename from server/src/main/java/org/opensearch/cli/KeyStoreAwareCommand.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/KeyStoreAwareCommand.java
index 6cd266252b369..1d67cf24ef3cb 100644
--- a/server/src/main/java/org/opensearch/cli/KeyStoreAwareCommand.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/KeyStoreAwareCommand.java
@@ -30,9 +30,14 @@
  * GitHub history for details.
  */
 
-package org.opensearch.cli;
+package org.opensearch.cli.keystore;
 
 import joptsimple.OptionSet;
+import org.opensearch.cli.ExitCodes;
+import org.opensearch.cli.KeystoreConstants;
+import org.opensearch.cli.Terminal;
+import org.opensearch.cli.UserException;
+import org.opensearch.common.cli.EnvironmentAwareCommand;
 import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.core.common.settings.SecureString;
 import org.opensearch.env.Environment;
@@ -42,19 +47,22 @@
 import java.util.Arrays;
 
 /**
- * An {@link org.opensearch.cli.EnvironmentAwareCommand} that needs to access the opensearch keystore, possibly
+ * An {@link EnvironmentAwareCommand} that needs to access the opensearch keystore, possibly
  * decrypting it if it is password protected.
  *
  * @opensearch.internal
  */
 public abstract class KeyStoreAwareCommand extends EnvironmentAwareCommand {
+
+    /**
+     * Creates a new KeyStoreAwareCommand with the given description.
+     *
+     * @param description A description of the command's purpose and functionality
+     */
     public KeyStoreAwareCommand(String description) {
         super(description);
     }
 
-    /** Arbitrarily chosen maximum passphrase length */
-    public static final int MAX_PASSPHRASE_LENGTH = 128;
-
     /**
      * Reads the keystore password from the {@link Terminal}, prompting for verification where applicable and returns it as a
      * {@link SecureString}.
@@ -69,9 +77,9 @@ protected static SecureString readPassword(Terminal terminal, boolean withVerifi
         if (withVerification) {
             passwordArray = terminal.readSecret(
                 "Enter new password for the opensearch keystore (empty for no password): ",
-                MAX_PASSPHRASE_LENGTH
+                KeystoreConstants.MAX_PASSPHRASE_LENGTH
             );
-            char[] passwordVerification = terminal.readSecret("Enter same password again: ", MAX_PASSPHRASE_LENGTH);
+            char[] passwordVerification = terminal.readSecret("Enter same password again: ", KeystoreConstants.MAX_PASSPHRASE_LENGTH);
             if (Arrays.equals(passwordArray, passwordVerification) == false) {
                 throw new UserException(ExitCodes.DATA_ERROR, "Passwords are not equal, exiting.");
             }
@@ -83,7 +91,15 @@ protected static SecureString readPassword(Terminal terminal, boolean withVerifi
     }
 
     /**
-     * Decrypt the {@code keyStore}, prompting the user to enter the password in the {@link Terminal} if it is password protected
+     * Decrypts the provided keystore using a password obtained from the terminal.
+     * If the keystore is password-protected, prompts the user to enter the password.
+     * If not password-protected, uses an empty password.
+     *
+     * @param keyStore The keystore to decrypt
+     * @param terminal The terminal to use for password input
+     * @throws UserException If there is an error with the provided password
+     * @throws GeneralSecurityException If there is an error during decryption
+     * @throws IOException If there is an error reading from the terminal
      */
     protected static void decryptKeyStore(KeyStoreWrapper keyStore, Terminal terminal) throws UserException, GeneralSecurityException,
         IOException {
@@ -94,5 +110,13 @@ protected static void decryptKeyStore(KeyStoreWrapper keyStore, Terminal termina
         }
     }
 
+    /**
+     * Executes the keystore command with the given parameters.
+     *
+     * @param terminal The terminal to use for user interaction
+     * @param options The command-line options provided
+     * @param env The environment settings
+     * @throws Exception if there are any errors during execution
+     */
     protected abstract void execute(Terminal terminal, OptionSet options, Environment env) throws Exception;
 }
diff --git a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/KeyStoreCli.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/KeyStoreCli.java
similarity index 95%
rename from distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/KeyStoreCli.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/KeyStoreCli.java
index 7a772526cd66b..3a322a9dddad3 100644
--- a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/KeyStoreCli.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/KeyStoreCli.java
@@ -30,10 +30,10 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
-import org.opensearch.cli.LoggingAwareMultiCommand;
 import org.opensearch.cli.Terminal;
+import org.opensearch.common.cli.LoggingAwareMultiCommand;
 
 /**
  * A CLI tool for managing secrets in the OpenSearch keystore.
diff --git a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/ListKeyStoreCommand.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/ListKeyStoreCommand.java
similarity index 95%
rename from distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/ListKeyStoreCommand.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/ListKeyStoreCommand.java
index 379b61efc5d32..d52154502e715 100644
--- a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/ListKeyStoreCommand.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/ListKeyStoreCommand.java
@@ -30,10 +30,11 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import joptsimple.OptionSet;
 import org.opensearch.cli.Terminal;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.env.Environment;
 
 import java.util.ArrayList;
diff --git a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/RemoveSettingKeyStoreCommand.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/RemoveSettingKeyStoreCommand.java
similarity index 96%
rename from distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/RemoveSettingKeyStoreCommand.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/RemoveSettingKeyStoreCommand.java
index c57959117af15..f30526a548d28 100644
--- a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/RemoveSettingKeyStoreCommand.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/RemoveSettingKeyStoreCommand.java
@@ -30,13 +30,14 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import joptsimple.OptionSet;
 import joptsimple.OptionSpec;
 import org.opensearch.cli.ExitCodes;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.env.Environment;
 
 import java.util.List;
diff --git a/server/src/main/java/org/opensearch/common/settings/UpgradeKeyStoreCommand.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/UpgradeKeyStoreCommand.java
similarity index 63%
rename from server/src/main/java/org/opensearch/common/settings/UpgradeKeyStoreCommand.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/UpgradeKeyStoreCommand.java
index 46da933e3bf11..47026e0e138d9 100644
--- a/server/src/main/java/org/opensearch/common/settings/UpgradeKeyStoreCommand.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/UpgradeKeyStoreCommand.java
@@ -30,10 +30,11 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import joptsimple.OptionSet;
 import org.opensearch.cli.Terminal;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.env.Environment;
 
 /**
@@ -43,10 +44,26 @@
  */
 public class UpgradeKeyStoreCommand extends BaseKeyStoreCommand {
 
-    UpgradeKeyStoreCommand() {
+    /**
+     * Creates a new UpgradeKeyStoreCommand instance.
+     * Initializes a command that requires an existing keystore to upgrade its format
+     * to the latest version. This command will fail if the keystore doesn't exist.
+     */
+    public UpgradeKeyStoreCommand() {
         super("Upgrade the keystore format", true);
     }
 
+    /**
+     * Executes the keystore upgrade command by upgrading the format of an existing keystore.
+     * Uses the current keystore and its password to create a new keystore with an upgraded format
+     * in the same location.
+     *
+     * @param terminal The terminal for user interaction and output messages
+     * @param options The command-line options provided
+     * @param env The environment settings containing the configuration directory
+     * @throws Exception if there are any errors during the upgrade process,
+     *                  such as IO errors or encryption/decryption issues
+     */
     @Override
     protected void executeCommand(final Terminal terminal, final OptionSet options, final Environment env) throws Exception {
         KeyStoreWrapper.upgrade(getKeyStore(), env.configDir(), getKeyStorePassword().getChars());
diff --git a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/package-info.java b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/package-info.java
similarity index 88%
rename from distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/package-info.java
rename to distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/package-info.java
index 3969fb4f91e49..979a215706a9a 100644
--- a/distribution/tools/keystore-cli/src/main/java/org/opensearch/common/settings/package-info.java
+++ b/distribution/tools/keystore-cli/src/main/java/org/opensearch/cli/keystore/package-info.java
@@ -9,4 +9,4 @@
 /**
  * Classes implementing a CLI tool for managing secrets in the OpenSearch keystore.
  */
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/bootstrap/BootstrapTests.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/bootstrap/BootstrapTests.java
index e9219de218aef..0292930a99fbd 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/bootstrap/BootstrapTests.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/bootstrap/BootstrapTests.java
@@ -31,7 +31,7 @@
 
 package org.opensearch.bootstrap;
 
-import org.opensearch.common.settings.KeyStoreCommandTestCase;
+import org.opensearch.cli.keystore.KeyStoreCommandTestCase;
 import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.common.settings.SecureSettings;
 import org.opensearch.common.settings.Settings;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/AddFileKeyStoreCommandTests.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/AddFileKeyStoreCommandTests.java
similarity index 99%
rename from distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/AddFileKeyStoreCommandTests.java
rename to distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/AddFileKeyStoreCommandTests.java
index b3cc7e10fdf8c..9be3a5e74327e 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/AddFileKeyStoreCommandTests.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/AddFileKeyStoreCommandTests.java
@@ -30,12 +30,13 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import org.opensearch.cli.Command;
 import org.opensearch.cli.ExitCodes;
 import org.opensearch.cli.UserException;
 import org.opensearch.common.collect.Tuple;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.env.Environment;
 
 import java.io.IOException;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/AddStringKeyStoreCommandTests.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/AddStringKeyStoreCommandTests.java
similarity index 99%
rename from distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/AddStringKeyStoreCommandTests.java
rename to distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/AddStringKeyStoreCommandTests.java
index 059c74ed8971c..e98067d9be661 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/AddStringKeyStoreCommandTests.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/AddStringKeyStoreCommandTests.java
@@ -30,11 +30,12 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import org.opensearch.cli.Command;
 import org.opensearch.cli.ExitCodes;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.env.Environment;
 
 import java.io.ByteArrayInputStream;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/ChangeKeyStorePasswordCommandTests.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/ChangeKeyStorePasswordCommandTests.java
similarity index 99%
rename from distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/ChangeKeyStorePasswordCommandTests.java
rename to distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/ChangeKeyStorePasswordCommandTests.java
index 55dbf59c8ad86..2ff1d21fb470c 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/ChangeKeyStorePasswordCommandTests.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/ChangeKeyStorePasswordCommandTests.java
@@ -30,7 +30,7 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import org.opensearch.cli.Command;
 import org.opensearch.cli.ExitCodes;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/CreateKeyStoreCommandTests.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/CreateKeyStoreCommandTests.java
similarity index 97%
rename from distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/CreateKeyStoreCommandTests.java
rename to distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/CreateKeyStoreCommandTests.java
index f554f17c50813..28928893a3d2c 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/CreateKeyStoreCommandTests.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/CreateKeyStoreCommandTests.java
@@ -30,11 +30,12 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import org.opensearch.cli.Command;
 import org.opensearch.cli.ExitCodes;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.env.Environment;
 
 import java.nio.charset.StandardCharsets;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/HasPasswordKeyStoreCommandTests.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/HasPasswordKeyStoreCommandTests.java
similarity index 98%
rename from distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/HasPasswordKeyStoreCommandTests.java
rename to distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/HasPasswordKeyStoreCommandTests.java
index 3b5abf30c4b85..b783df99bf7a9 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/HasPasswordKeyStoreCommandTests.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/HasPasswordKeyStoreCommandTests.java
@@ -30,7 +30,7 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import org.opensearch.cli.Command;
 import org.opensearch.cli.UserException;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/KeyStoreCommandTestCase.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/KeyStoreCommandTestCase.java
similarity index 97%
rename from distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/KeyStoreCommandTestCase.java
rename to distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/KeyStoreCommandTestCase.java
index 0ac653d35b07e..a27b67933e710 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/KeyStoreCommandTestCase.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/KeyStoreCommandTestCase.java
@@ -30,13 +30,15 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import com.google.common.jimfs.Configuration;
 import com.google.common.jimfs.Jimfs;
 import org.apache.lucene.tests.util.LuceneTestCase;
 import org.opensearch.cli.CommandTestCase;
 import org.opensearch.common.io.PathUtilsForTesting;
+import org.opensearch.common.settings.KeyStoreWrapper;
+import org.opensearch.common.settings.Settings;
 import org.opensearch.common.util.io.IOUtils;
 import org.opensearch.env.Environment;
 import org.opensearch.env.TestEnvironment;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/KeyStoreWrapperTests.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/KeyStoreWrapperTests.java
similarity index 99%
rename from distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/KeyStoreWrapperTests.java
rename to distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/KeyStoreWrapperTests.java
index 15771945fa199..bc4d1f58ecd4b 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/KeyStoreWrapperTests.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/KeyStoreWrapperTests.java
@@ -30,7 +30,7 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import org.apache.lucene.backward_codecs.store.EndiannessReverserUtil;
 import org.apache.lucene.codecs.CodecUtil;
@@ -39,6 +39,7 @@
 import org.apache.lucene.store.IndexOutput;
 import org.apache.lucene.store.NIOFSDirectory;
 import org.opensearch.common.Randomness;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.common.util.io.IOUtils;
 import org.opensearch.core.common.settings.SecureString;
 import org.opensearch.env.Environment;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/ListKeyStoreCommandTests.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/ListKeyStoreCommandTests.java
similarity index 98%
rename from distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/ListKeyStoreCommandTests.java
rename to distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/ListKeyStoreCommandTests.java
index 42452d5c12beb..a1516919971c6 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/ListKeyStoreCommandTests.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/ListKeyStoreCommandTests.java
@@ -30,7 +30,7 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import org.opensearch.cli.Command;
 import org.opensearch.cli.ExitCodes;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/RemoveSettingKeyStoreCommandTests.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/RemoveSettingKeyStoreCommandTests.java
similarity index 99%
rename from distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/RemoveSettingKeyStoreCommandTests.java
rename to distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/RemoveSettingKeyStoreCommandTests.java
index 5dab6eec121bd..07759ae6d5f5d 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/RemoveSettingKeyStoreCommandTests.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/RemoveSettingKeyStoreCommandTests.java
@@ -30,7 +30,7 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import org.opensearch.cli.Command;
 import org.opensearch.cli.ExitCodes;
diff --git a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/UpgradeKeyStoreCommandTests.java b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/UpgradeKeyStoreCommandTests.java
similarity index 97%
rename from distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/UpgradeKeyStoreCommandTests.java
rename to distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/UpgradeKeyStoreCommandTests.java
index 0fda83282c1f9..77db8c120bb0e 100644
--- a/distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/UpgradeKeyStoreCommandTests.java
+++ b/distribution/tools/keystore-cli/src/test/java/org/opensearch/cli/keystore/UpgradeKeyStoreCommandTests.java
@@ -30,10 +30,11 @@
  * GitHub history for details.
  */
 
-package org.opensearch.common.settings;
+package org.opensearch.cli.keystore;
 
 import org.opensearch.cli.Command;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.settings.KeyStoreWrapper;
 import org.opensearch.env.Environment;
 
 import java.io.InputStream;
diff --git a/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/InstallPluginCommand.java b/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/InstallPluginCommand.java
index d5a0102ba86af..1ec497103ee4e 100644
--- a/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/InstallPluginCommand.java
+++ b/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/InstallPluginCommand.java
@@ -52,12 +52,12 @@
 import org.bouncycastle.openpgp.operator.jcajce.JcaPGPContentVerifierBuilderProvider;
 import org.opensearch.Build;
 import org.opensearch.Version;
-import org.opensearch.cli.EnvironmentAwareCommand;
 import org.opensearch.cli.ExitCodes;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
 import org.opensearch.common.SuppressForbidden;
 import org.opensearch.common.bootstrap.JarHell;
+import org.opensearch.common.cli.EnvironmentAwareCommand;
 import org.opensearch.common.collect.Tuple;
 import org.opensearch.common.hash.MessageDigests;
 import org.opensearch.common.util.io.IOUtils;
diff --git a/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/ListPluginsCommand.java b/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/ListPluginsCommand.java
index 9ca42ac5f4ec1..32a9257df674b 100644
--- a/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/ListPluginsCommand.java
+++ b/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/ListPluginsCommand.java
@@ -34,8 +34,8 @@
 
 import joptsimple.OptionSet;
 import org.opensearch.Version;
-import org.opensearch.cli.EnvironmentAwareCommand;
 import org.opensearch.cli.Terminal;
+import org.opensearch.common.cli.EnvironmentAwareCommand;
 import org.opensearch.env.Environment;
 
 import java.io.IOException;
diff --git a/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/PluginCli.java b/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/PluginCli.java
index f87b72c7ecb5f..0155d44a2f16a 100644
--- a/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/PluginCli.java
+++ b/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/PluginCli.java
@@ -33,8 +33,8 @@
 package org.opensearch.plugins;
 
 import org.opensearch.cli.Command;
-import org.opensearch.cli.LoggingAwareMultiCommand;
 import org.opensearch.cli.Terminal;
+import org.opensearch.common.cli.LoggingAwareMultiCommand;
 import org.opensearch.common.util.io.IOUtils;
 
 import java.io.IOException;
diff --git a/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/RemovePluginCommand.java b/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/RemovePluginCommand.java
index 4ac99c816717a..6977e5343f80b 100644
--- a/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/RemovePluginCommand.java
+++ b/distribution/tools/plugin-cli/src/main/java/org/opensearch/plugins/RemovePluginCommand.java
@@ -34,10 +34,10 @@
 
 import joptsimple.OptionSet;
 import joptsimple.OptionSpec;
-import org.opensearch.cli.EnvironmentAwareCommand;
 import org.opensearch.cli.ExitCodes;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.cli.EnvironmentAwareCommand;
 import org.opensearch.common.util.io.IOUtils;
 import org.opensearch.env.Environment;
 
diff --git a/distribution/tools/upgrade-cli/src/main/java/org/opensearch/upgrade/UpgradeCli.java b/distribution/tools/upgrade-cli/src/main/java/org/opensearch/upgrade/UpgradeCli.java
index e625ad333d218..31d34a55b6461 100644
--- a/distribution/tools/upgrade-cli/src/main/java/org/opensearch/upgrade/UpgradeCli.java
+++ b/distribution/tools/upgrade-cli/src/main/java/org/opensearch/upgrade/UpgradeCli.java
@@ -9,10 +9,10 @@
 package org.opensearch.upgrade;
 
 import joptsimple.OptionSet;
-import org.opensearch.cli.EnvironmentAwareCommand;
 import org.opensearch.cli.ExitCodes;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.cli.EnvironmentAwareCommand;
 import org.opensearch.common.collect.Tuple;
 import org.opensearch.env.Environment;
 
diff --git a/libs/cli/build.gradle b/libs/cli/build.gradle
index a58c4dafac874..2e5d84a0cab0b 100644
--- a/libs/cli/build.gradle
+++ b/libs/cli/build.gradle
@@ -33,11 +33,11 @@ apply plugin: 'opensearch.publish'
 dependencies {
   api 'net.sf.jopt-simple:jopt-simple:5.0.4'
   api project(':libs:opensearch-common')
-}
 
-test.enabled = false
-// Since CLI does not depend on :server, it cannot run the jarHell task
-jarHell.enabled = false
+  testImplementation(project(":test:framework")) {
+    exclude group: 'org.opensearch', module: 'opensearch-cli'
+  }
+}
 
 tasks.named('forbiddenApisMain').configure {
   replaceSignatureFiles 'jdk-signatures'
diff --git a/libs/cli/src/main/java/org/opensearch/cli/Command.java b/libs/cli/src/main/java/org/opensearch/cli/Command.java
index cc9230bdb2282..c2ae43946a8c8 100644
--- a/libs/cli/src/main/java/org/opensearch/cli/Command.java
+++ b/libs/cli/src/main/java/org/opensearch/cli/Command.java
@@ -119,7 +119,7 @@ public final int main(String[] args, Terminal terminal) throws Exception {
     /**
      * Executes the command, but all errors are thrown.
      */
-    void mainWithoutErrorHandling(String[] args, Terminal terminal) throws Exception {
+    protected void mainWithoutErrorHandling(String[] args, Terminal terminal) throws Exception {
         final OptionSet options = parser.parse(args);
 
         if (options.has(helpOption)) {
diff --git a/libs/cli/src/main/java/org/opensearch/cli/KeystoreConstants.java b/libs/cli/src/main/java/org/opensearch/cli/KeystoreConstants.java
new file mode 100644
index 0000000000000..2e35ac0e217f1
--- /dev/null
+++ b/libs/cli/src/main/java/org/opensearch/cli/KeystoreConstants.java
@@ -0,0 +1,15 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.cli;
+
+public class KeystoreConstants {
+
+    /** Arbitrarily chosen maximum passphrase length */
+    public static final int MAX_PASSPHRASE_LENGTH = 128;
+}
diff --git a/server/src/test/java/org/opensearch/cli/CommandTests.java b/libs/cli/src/test/java/org/opensearch/cli/CommandTests.java
similarity index 100%
rename from server/src/test/java/org/opensearch/cli/CommandTests.java
rename to libs/cli/src/test/java/org/opensearch/cli/CommandTests.java
diff --git a/libs/cli/src/test/java/org/opensearch/cli/KeystoreConstantsTests.java b/libs/cli/src/test/java/org/opensearch/cli/KeystoreConstantsTests.java
new file mode 100644
index 0000000000000..d231a293c4b6d
--- /dev/null
+++ b/libs/cli/src/test/java/org/opensearch/cli/KeystoreConstantsTests.java
@@ -0,0 +1,19 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.cli;
+
+import org.opensearch.test.OpenSearchTestCase;
+
+public class KeystoreConstantsTests extends OpenSearchTestCase {
+
+    public void testMaxPassphraseLengthValue() {
+        // Verify the constant has the expected value
+        assertEquals(128, KeystoreConstants.MAX_PASSPHRASE_LENGTH);
+    }
+}
diff --git a/server/src/test/java/org/opensearch/cli/MultiCommandTests.java b/libs/cli/src/test/java/org/opensearch/cli/MultiCommandTests.java
similarity index 100%
rename from server/src/test/java/org/opensearch/cli/MultiCommandTests.java
rename to libs/cli/src/test/java/org/opensearch/cli/MultiCommandTests.java
diff --git a/server/src/test/java/org/opensearch/cli/TerminalTests.java b/libs/cli/src/test/java/org/opensearch/cli/TerminalTests.java
similarity index 100%
rename from server/src/test/java/org/opensearch/cli/TerminalTests.java
rename to libs/cli/src/test/java/org/opensearch/cli/TerminalTests.java
diff --git a/qa/evil-tests/src/test/java/org/opensearch/cli/EvilEnvironmentAwareCommandTests.java b/qa/evil-tests/src/test/java/org/opensearch/cli/EvilEnvironmentAwareCommandTests.java
index 2d232e9694de6..b4164d40081f2 100644
--- a/qa/evil-tests/src/test/java/org/opensearch/cli/EvilEnvironmentAwareCommandTests.java
+++ b/qa/evil-tests/src/test/java/org/opensearch/cli/EvilEnvironmentAwareCommandTests.java
@@ -35,6 +35,7 @@
 import joptsimple.OptionSet;
 import org.apache.lucene.tests.util.TestRuleRestoreSystemProperties;
 import org.opensearch.common.SuppressForbidden;
+import org.opensearch.common.cli.EnvironmentAwareCommand;
 import org.opensearch.env.Environment;
 import org.opensearch.test.OpenSearchTestCase;
 import org.junit.Rule;
diff --git a/server/src/main/java/org/opensearch/bootstrap/Bootstrap.java b/server/src/main/java/org/opensearch/bootstrap/Bootstrap.java
index 95498f2bcbcd1..d71b1ad3e1455 100644
--- a/server/src/main/java/org/opensearch/bootstrap/Bootstrap.java
+++ b/server/src/main/java/org/opensearch/bootstrap/Bootstrap.java
@@ -42,7 +42,7 @@
 import org.apache.lucene.util.StringHelper;
 import org.opensearch.OpenSearchException;
 import org.opensearch.Version;
-import org.opensearch.cli.KeyStoreAwareCommand;
+import org.opensearch.cli.KeystoreConstants;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
 import org.opensearch.common.PidFile;
@@ -263,7 +263,7 @@ static SecureSettings loadSecureSettings(Environment initialEnv) throws Bootstra
         SecureString password;
         try {
             if (keystore != null && keystore.hasPassword()) {
-                password = readPassphrase(System.in, KeyStoreAwareCommand.MAX_PASSPHRASE_LENGTH);
+                password = readPassphrase(System.in, KeystoreConstants.MAX_PASSPHRASE_LENGTH);
             } else {
                 password = new SecureString(new char[0]);
             }
diff --git a/server/src/main/java/org/opensearch/bootstrap/OpenSearch.java b/server/src/main/java/org/opensearch/bootstrap/OpenSearch.java
index 8eb4f841b9671..162b9be318cd5 100644
--- a/server/src/main/java/org/opensearch/bootstrap/OpenSearch.java
+++ b/server/src/main/java/org/opensearch/bootstrap/OpenSearch.java
@@ -37,10 +37,10 @@
 import joptsimple.OptionSpecBuilder;
 import joptsimple.util.PathConverter;
 import org.opensearch.Build;
-import org.opensearch.cli.EnvironmentAwareCommand;
 import org.opensearch.cli.ExitCodes;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
+import org.opensearch.common.cli.EnvironmentAwareCommand;
 import org.opensearch.common.logging.LogConfigurator;
 import org.opensearch.env.Environment;
 import org.opensearch.monitor.jvm.JvmInfo;
diff --git a/server/src/main/java/org/opensearch/cli/LoggingAwareCommand.java b/server/src/main/java/org/opensearch/cli/LoggingAwareCommand.java
deleted file mode 100644
index 07a6b7d523a33..0000000000000
--- a/server/src/main/java/org/opensearch/cli/LoggingAwareCommand.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * SPDX-License-Identifier: Apache-2.0
- *
- * The OpenSearch Contributors require contributions made to
- * this file be licensed under the Apache-2.0 license or a
- * compatible open source license.
- */
-
-/*
- * Licensed to Elasticsearch under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/*
- * Modifications Copyright OpenSearch Contributors. See
- * GitHub history for details.
- */
-
-package org.opensearch.cli;
-
-/**
- * A command that is aware of logging. This class should be preferred over the base {@link Command} class for any CLI tools that depend on
- * core OpenSearch as they could directly or indirectly touch classes that touch logging and as such logging needs to be configured.
- *
- * @opensearch.internal
- */
-public abstract class LoggingAwareCommand extends Command {
-
-    /**
-     * Construct the command with the specified command description. This command will have logging configured without reading OpenSearch
-     * configuration files.
-     *
-     * @param description the command description
-     */
-    public LoggingAwareCommand(final String description) {
-        super(description, CommandLoggingConfigurator::configureLoggingWithoutConfig);
-    }
-
-}
diff --git a/server/src/main/java/org/opensearch/cluster/coordination/NodeToolCli.java b/server/src/main/java/org/opensearch/cluster/coordination/NodeToolCli.java
index 7d51002150fb9..f895bb07d5b87 100644
--- a/server/src/main/java/org/opensearch/cluster/coordination/NodeToolCli.java
+++ b/server/src/main/java/org/opensearch/cluster/coordination/NodeToolCli.java
@@ -31,9 +31,9 @@
 
 package org.opensearch.cluster.coordination;
 
-import org.opensearch.cli.CommandLoggingConfigurator;
 import org.opensearch.cli.MultiCommand;
 import org.opensearch.cli.Terminal;
+import org.opensearch.common.cli.CommandLoggingConfigurator;
 import org.opensearch.env.NodeRepurposeCommand;
 import org.opensearch.env.OverrideNodeVersionCommand;
 
diff --git a/server/src/main/java/org/opensearch/cluster/coordination/OpenSearchNodeCommand.java b/server/src/main/java/org/opensearch/cluster/coordination/OpenSearchNodeCommand.java
index 896fe6fc8024b..92b88cab2dd70 100644
--- a/server/src/main/java/org/opensearch/cluster/coordination/OpenSearchNodeCommand.java
+++ b/server/src/main/java/org/opensearch/cluster/coordination/OpenSearchNodeCommand.java
@@ -40,7 +40,6 @@
 import org.opensearch.OpenSearchException;
 import org.opensearch.Version;
 import org.opensearch.action.admin.indices.rollover.Condition;
-import org.opensearch.cli.EnvironmentAwareCommand;
 import org.opensearch.cli.Terminal;
 import org.opensearch.cli.UserException;
 import org.opensearch.cluster.ClusterModule;
@@ -50,6 +49,7 @@
 import org.opensearch.cluster.metadata.ComponentTemplateMetadata;
 import org.opensearch.cluster.metadata.DataStreamMetadata;
 import org.opensearch.cluster.metadata.Metadata;
+import org.opensearch.common.cli.EnvironmentAwareCommand;
 import org.opensearch.common.collect.Tuple;
 import org.opensearch.common.settings.ClusterSettings;
 import org.opensearch.common.settings.Settings;
diff --git a/server/src/main/java/org/opensearch/cli/CommandLoggingConfigurator.java b/server/src/main/java/org/opensearch/common/cli/CommandLoggingConfigurator.java
similarity index 98%
rename from server/src/main/java/org/opensearch/cli/CommandLoggingConfigurator.java
rename to server/src/main/java/org/opensearch/common/cli/CommandLoggingConfigurator.java
index 8918725472160..a25cfb7de3b66 100644
--- a/server/src/main/java/org/opensearch/cli/CommandLoggingConfigurator.java
+++ b/server/src/main/java/org/opensearch/common/cli/CommandLoggingConfigurator.java
@@ -30,7 +30,7 @@
  * GitHub history for details.
  */
 
-package org.opensearch.cli;
+package org.opensearch.common.cli;
 
 import org.apache.logging.log4j.Level;
 import org.opensearch.common.logging.LogConfigurator;
diff --git a/server/src/main/java/org/opensearch/cli/EnvironmentAwareCommand.java b/server/src/main/java/org/opensearch/common/cli/EnvironmentAwareCommand.java
similarity index 97%
rename from server/src/main/java/org/opensearch/cli/EnvironmentAwareCommand.java
rename to server/src/main/java/org/opensearch/common/cli/EnvironmentAwareCommand.java
index 10c59ef673050..f942d78a27fd7 100644
--- a/server/src/main/java/org/opensearch/cli/EnvironmentAwareCommand.java
+++ b/server/src/main/java/org/opensearch/common/cli/EnvironmentAwareCommand.java
@@ -30,11 +30,15 @@
  * GitHub history for details.
  */
 
-package org.opensearch.cli;
+package org.opensearch.common.cli;
 
 import joptsimple.OptionSet;
 import joptsimple.OptionSpec;
 import joptsimple.util.KeyValuePair;
+import org.opensearch.cli.Command;
+import org.opensearch.cli.ExitCodes;
+import org.opensearch.cli.Terminal;
+import org.opensearch.cli.UserException;
 import org.opensearch.common.SuppressForbidden;
 import org.opensearch.common.settings.Settings;
 import org.opensearch.env.Environment;
diff --git a/server/src/main/java/org/opensearch/cli/LoggingAwareMultiCommand.java b/server/src/main/java/org/opensearch/common/cli/LoggingAwareMultiCommand.java
similarity index 96%
rename from server/src/main/java/org/opensearch/cli/LoggingAwareMultiCommand.java
rename to server/src/main/java/org/opensearch/common/cli/LoggingAwareMultiCommand.java
index 8453ed05a12d3..ff46e44b6faa5 100644
--- a/server/src/main/java/org/opensearch/cli/LoggingAwareMultiCommand.java
+++ b/server/src/main/java/org/opensearch/common/cli/LoggingAwareMultiCommand.java
@@ -30,7 +30,9 @@
  * GitHub history for details.
  */
 
-package org.opensearch.cli;
+package org.opensearch.common.cli;
+
+import org.opensearch.cli.MultiCommand;
 
 /**
  * A multi-command that is aware of logging. This class should be preferred over the base {@link MultiCommand} class for any CLI tools that
diff --git a/server/src/main/java/org/opensearch/cli/package-info.java b/server/src/main/java/org/opensearch/common/cli/package-info.java
similarity index 87%
rename from server/src/main/java/org/opensearch/cli/package-info.java
rename to server/src/main/java/org/opensearch/common/cli/package-info.java
index 8e9f9f6360870..3150d87f323dc 100644
--- a/server/src/main/java/org/opensearch/cli/package-info.java
+++ b/server/src/main/java/org/opensearch/common/cli/package-info.java
@@ -9,4 +9,4 @@
 /**
  * The command line interface module.
  */
-package org.opensearch.cli;
+package org.opensearch.common.cli;
diff --git a/server/src/main/java/org/opensearch/common/settings/KeyStoreWrapper.java b/server/src/main/java/org/opensearch/common/settings/KeyStoreWrapper.java
index 1ad3b7ab8875a..ed58e6b21e165 100644
--- a/server/src/main/java/org/opensearch/common/settings/KeyStoreWrapper.java
+++ b/server/src/main/java/org/opensearch/common/settings/KeyStoreWrapper.java
@@ -134,7 +134,7 @@ private static class Entry {
     private static final String KEYSTORE_FILENAME = "opensearch.keystore";
 
     /** The version of the metadata written before the keystore data. */
-    static final int FORMAT_VERSION = 4;
+    public static final int FORMAT_VERSION = 4;
 
     /** The oldest metadata format version that can be read. */
     private static final int MIN_FORMAT_VERSION = 1;
@@ -631,7 +631,7 @@ public static void validateSettingName(String setting) {
     /**
      * Set a string setting.
      */
-    synchronized void setString(String setting, char[] value) {
+    public synchronized void setString(String setting, char[] value) {
         ensureOpen();
         validateSettingName(setting);
 
@@ -646,7 +646,7 @@ synchronized void setString(String setting, char[] value) {
     /**
      * Set a file setting.
      */
-    synchronized void setFile(String setting, byte[] bytes) {
+    public synchronized void setFile(String setting, byte[] bytes) {
         ensureOpen();
         validateSettingName(setting);
 
@@ -659,7 +659,7 @@ synchronized void setFile(String setting, byte[] bytes) {
     /**
      * Remove the given setting from the keystore.
      */
-    void remove(String setting) {
+    public void remove(String setting) {
         ensureOpen();
         Entry oldEntry = entries.get().remove(setting);
         if (oldEntry != null) {
diff --git a/server/src/main/java/org/opensearch/index/shard/ShardToolCli.java b/server/src/main/java/org/opensearch/index/shard/ShardToolCli.java
index 1b4eb5a3f8c39..04b26904565cc 100644
--- a/server/src/main/java/org/opensearch/index/shard/ShardToolCli.java
+++ b/server/src/main/java/org/opensearch/index/shard/ShardToolCli.java
@@ -31,8 +31,8 @@
 
 package org.opensearch.index.shard;
 
-import org.opensearch.cli.LoggingAwareMultiCommand;
 import org.opensearch.cli.Terminal;
+import org.opensearch.common.cli.LoggingAwareMultiCommand;
 
 /**
  * Class encapsulating and dispatching commands from the {@code opensearch-shard} command line tool