CLI command reference

Status: in design. Commands below map to real platform endpoints. The 🔒 markers note commands gated to the Enterprise / miqromanage plan or to operator/service credentials.

Every command supports --json (machine-readable output) and returns a non-zero exit code on API error, so it composes in shells and CI.

Identity & config

Command	What it does
`miqro login`	Sign in through the Miqro wall; store your token in `~/.miqro/config.toml`.
`miqro logout`	Delete the stored token.
`miqro whoami`	Show your user, role, tenant, and plan entitlement.
`miqro config get <key>` / `set <key> <val>`	Read/write local config (`api_base`, profile).

Profiles: ~/.miqro/config.toml holds [default] and [dev] blocks; select with MIQRO_PROFILE. Env vars MIQRO_TOKEN / MIQRO_API_BASE override the file.

Connectors

Command	What it does
`miqro connectors ls`	List every connectable system and its capabilities.
`miqro connectors show <provider>`	Full capability manifest for one provider (reads, actions, auth, risks).
`miqro connect <provider>`	Connect a provider with a pasted key (live-validated, then armed).
`miqro integrations ls`	List the integrations your tenant has connected.

The queue (the approval gate)

This is the control plane every agent action passes through — operating it from the CLI is identical to operating it from the dashboard.

Command	What it does
`miqro queue ls [--status <s>] [--tenant <t>]`	List queued/pending/executing actions.
`miqro queue show <id>`	Inspect one action: provider, action kind, payload, status.
`miqro queue approve <id>`	Approve a pending action so the executor runs it.
`miqro queue reject <id>`	Reject a pending action.
`miqro queue cancel <id>`	Cancel an action inside its cancel window.
`miqro kinds`	List action kinds with their risk tiers and cancel windows.

Agents

Command	What it does
`miqro runs [--agent <name>] [--hours N]`	Recent agent runs (status, duration, errors).
`miqro runs --live` / `miqro runs tail`	Live troubleshooting feed.
🔒 `miqro agent run <name> --task "…" [--context k=v]`	Invoke an agent now. Requires operator/service credentials (fail-closed).

MCP 🔒 (Enterprise / miqromanage)

The bridge between the CLI and the agent surface. See agentic control.

The bridge has two directions. mcp serve exposes Miqro's own command core as an MCP server (so an external AI client calls the same verbs the CLI does — built). mcp add/ls/rm register outbound MCP servers the agent fleet may reach out to (local-first today; the server-side SSRF-allowlisted registration lands with the agentic-control backend).

Command	What it does
`miqro mcp serve [--allow-writes]`	Serve the shared registry as an MCP server (stdio). Read-only by default; `--allow-writes` also exposes write verbs (which still hit the gated/fail-closed backend). Needs the MCP SDK: `pip install 'miqro[mcp]'`.
`miqro mcp tools [--include-writes]`	List the tools `mcp serve` exposes from the shared registry.
`miqro mcp add <name> --url <url>`	Register an outbound MCP server (SSRF-shaped URL check; `--allow-local` for dev).
`miqro mcp ls`	List registered outbound MCP servers.
`miqro mcp rm <name>`	Deregister a server.

Credentials & gating, in one place

Default (you): miqro login → user token → scoped to your role and tenant.
Service/CI: set an internal key → unlocks fail-closed commands like agent run. Opt-in, never the default, never distributed.
Enterprise/miqromanage: required for all miqro mcp … commands.