Lab CLI Help
August 3, 2026 · View on GitHub
Generated by labby docs generate from clap command definitions. Do not edit by hand.
labby
Rust MCP gateway with Code Mode, authentication, protected routes, setup, logs, CLI, HTTP API, and operator web UI.
Usage: labby [OPTIONS] <COMMAND>
Commands:
serve Start the MCP server (stdio or HTTP transport)
mcp Start the MCP server over stdio
doctor Audit configured services and report problems
docs Generate and verify code-owned documentation artifacts
health Quick reachability check for configured services
logs Tail the active Labby service journal
setup Bootstrap the supported Incus Labby gateway container
incus Manage the supported Incus Labby gateway container
update Update labby from the latest GitHub release
completions Generate shell completions
gateway Manage proxied upstream MCP gateways
snippets Manage executable Code Mode snippets
oauth Run local OAuth callback relay helpers
proxy Proxy a stdio MCP server to Streamable HTTP
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
-V, --version
Print version
labby serve
Start the MCP server (stdio or HTTP transport)
Usage: serve [OPTIONS] [COMMAND]
Commands:
mcp Run the MCP server over stdio instead of the default HTTP transport
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--services <SERVICES>
Comma- or space-separated list of services to enable. Empty = all
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--host <HOST>
Bind host for the HTTP transport
--port <PORT>
Bind port for the HTTP transport
--log-level <LOG_LEVEL>
Override the log filter level for this process. Sets `LABBY_LOG=labby=<level>,warn` before tracing init. Example: `--log-level debug`
-h, --help
Print help
labby serve mcp
Run the MCP server over stdio instead of the default HTTP transport
Usage: mcp [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--stdio
Confirm that MCP should run over stdio
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby serve help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby mcp
Start the MCP server over stdio
Usage: mcp [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--services <SERVICES>
Comma- or space-separated list of services to enable. Empty = all
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--log-level <LOG_LEVEL>
Override the log filter level for this process. Sets `LABBY_LOG=labby=<level>,warn` before tracing init. Example: `--log-level debug`
-h, --help
Print help
labby doctor
Audit configured services and report problems
Usage: doctor [OPTIONS] [COMMAND]
Commands:
auth Check auth/OAuth configuration (env vars, files, permissions)
oauth-relay Check public OAuth callback relay registry and optionally target sockets
proxy Check public Lab and protected MCP proxy endpoints from caller-visible URLs
system Run local system checks (env vars, Docker, disk, toolchain)
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby doctor auth
Check auth/OAuth configuration (env vars, files, permissions)
Usage: auth [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby doctor oauth-relay
Check public OAuth callback relay registry and optionally target sockets
Usage: oauth-relay [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--probe-targets
Probe registered target sockets in addition to registry readiness
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby doctor proxy
Check public Lab and protected MCP proxy endpoints from caller-visible URLs
Usage: proxy [OPTIONS]
Options:
--app-url <APP_URL>
Public Lab app URL, e.g. https://lab.example.com (default: LABBY_PUBLIC_URL)
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--mcp-url <MCP_URL>
Public MCP gateway URL, e.g. https://mcp.example.com (default: LABBY_MCP_GATEWAY_URL)
--route <ROUTE>
Protected MCP public route path, e.g. /telemetry
--backend-url <BACKEND_URL>
Optional private backend origin for backend-leak probe, e.g. http://mcp-backend:3100
-h, --help
Print help
labby doctor system
Run local system checks (env vars, Docker, disk, toolchain)
Usage: system [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby doctor help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby docs
Generate and verify code-owned documentation artifacts
Usage: docs [OPTIONS] <COMMAND>
Commands:
generate Regenerate every tracked generated-docs artifact
check Verify generated-docs artifacts are fresh
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby docs generate
Regenerate every tracked generated-docs artifact
Usage: generate [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby docs check
Verify generated-docs artifacts are fresh
Usage: check [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby docs help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby health
Quick reachability check for configured services
Usage: health [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby logs
Tail the active Labby service journal
Usage: logs [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
-n, --lines <LINES>
Number of historical log lines to print before following
[default: 200]
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--no-follow
Print the selected lines and exit instead of following the journal
--container <CONTAINER>
Explicit Incus container name. Auto-detects a running Labby container otherwise
-h, --help
Print help
labby setup
Bootstrap the supported Incus Labby gateway container
Usage: setup [OPTIONS] [COMMAND]
Commands:
wizard Open the web-based first-run wizard or settings flow
draft Manage the local setup draft
host-service Manage the systemd Labby gateway service
installed-plugins List installed Claude Code lab plugins
services-status Join service configuration, draft, and Claude plugin state
plugin-hook Run binary-owned local setup checks for Claude plugin hooks
plugin-sync Sync CLAUDE_PLUGIN_OPTION_* env vars into ~/.labby/.env as LABBY_* vars
plugin-export Read ~/.labby/.env and print current values keyed by userConfig field name
plugin-connectivity Validate connectivity to the lab MCP server
check Check local setup prerequisites without mutating the filesystem
repair Repair missing local setup prerequisites without contacting external services
proxy Configure defaults for the ephemeral stdio MCP proxy
incusbackup Validate or apply local Incus backup policy
incus-ssh Bootstrap container SSH trust from the host ~/.ssh/config
install Copy the labby binary into ~/.local/bin so it is callable in your own terminal
install-plugin Install the Claude Code plugin for a configured service
uninstall-plugin Uninstall the Claude Code plugin for a service
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--provision
Provision this Ubuntu 24.04/Incus box for the Labby gateway
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--dry-run
Print the default Incus/provisioning plan and do not mutate anything
-y, --yes
Confirm provisioning without prompting
--skip-deps
Skip runtime dependency installation and only converge user/service state
-h, --help
Print help
labby setup wizard
Open the web-based first-run wizard or settings flow
Usage: wizard [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--mode <MODE>
Setup UI mode. Standalone setup defaults to full; /setup-core passes plugin
[default: full]
[possible values: plugin, full]
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--no-setup
Skip the wizard and exit cleanly. Equivalent to LABBY_SKIP_SETUP=1
--no-browser
Do not attempt to open the browser
--smoke
Smoke-test mode: print the state machine snapshot as JSON and exit
-h, --help
Print help
labby setup draft
Manage the local setup draft
Usage: draft [OPTIONS] <COMMAND>
Commands:
discard Delete ~/.labby/.env.draft without modifying ~/.labby/.env
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup draft discard
Delete ~/.labby/.env.draft without modifying ~/.labby/.env
Usage: discard [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
-y, --yes
Confirm discard without prompting
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--dry-run
Print what would be dispatched without executing
-h, --help
Print help
labby setup draft help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby setup host-service
Manage the systemd Labby gateway service
Usage: host-service [OPTIONS] <COMMAND>
Commands:
unit Print the system unit that Labby would install
install Install and start labby.service as a system unit
status Read labby.service status
restart Restart labby.service
uninstall Stop, disable, and remove labby.service
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup host-service unit
Print the system unit that Labby would install
Usage: unit [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup host-service install
Install and start labby.service as a system unit
Usage: install [OPTIONS]
Options:
--install-self
Copy this labby binary into /usr/local/bin/labby before installing the service
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-y, --yes
Confirm installation and service start
-h, --help
Print help
labby setup host-service status
Read labby.service status
Usage: status [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup host-service restart
Restart labby.service
Usage: restart [OPTIONS]
Options:
--install-self
Copy this labby binary into /usr/local/bin/labby before restarting the service
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-y, --yes
Confirm service restart
-h, --help
Print help
labby setup host-service uninstall
Stop, disable, and remove labby.service
Usage: uninstall [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
-y, --yes
Confirm service removal
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup host-service help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby setup installed-plugins
List installed Claude Code lab plugins
Usage: installed-plugins [OPTIONS]
Options:
--force
Bypass the short in-process cache
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup services-status
Join service configuration, draft, and Claude plugin state
Usage: services-status [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup plugin-hook
Run binary-owned local setup checks for Claude plugin hooks
Usage: plugin-hook [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--no-repair
Check only; do not create missing local setup files
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup plugin-sync
Sync CLAUDE_PLUGIN_OPTION_* env vars into ~/.labby/.env as LABBY_* vars
Usage: plugin-sync [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
-y, --yes
Skip confirmation for this destructive action
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--dry-run
Print what would be dispatched without executing
-h, --help
Print help
labby setup plugin-export
Read ~/.labby/.env and print current values keyed by userConfig field name
Usage: plugin-export [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup plugin-connectivity
Validate connectivity to the lab MCP server
Usage: plugin-connectivity [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--server-url <SERVER_URL>
Server URL to probe; defaults to CLAUDE_PLUGIN_OPTION_SERVER_URL or http://localhost:8765
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup check
Check local setup prerequisites without mutating the filesystem
Usage: check [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup repair
Repair missing local setup prerequisites without contacting external services
Usage: repair [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup proxy
Configure defaults for the ephemeral stdio MCP proxy
Usage: proxy [OPTIONS]
Options:
--exposure <EXPOSURE>
Exposure mode to persist
[possible values: tailscale, local]
--json
Emit JSON instead of human-readable tables
--auth <AUTH>
Authentication mode to persist
[possible values: tailnet, bearer, oauth, none]
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--path <PATH>
MCP HTTP path to persist
--port <PORT>
External Tailscale port, or `random`
--port-range-start <PORT_RANGE_START>
First candidate in the random external-port range
--port-range-end <PORT_RANGE_END>
Last candidate in the random external-port range
--bearer-token-env <BEARER_TOKEN_ENV>
Environment key used for the proxy bearer secret
--oauth-scope <OAUTH_SCOPES>
OAuth scope to require; repeatable and replaces the configured list
--inherit-env <INHERIT_ENV>
Ambient environment variable inherited by child servers; repeatable
--shutdown-grace-ms <SHUTDOWN_GRACE_MS>
Grace period before forced child shutdown
--bearer-token-stdin
Read a bearer secret from stdin without echoing or persisting it in TOML
-y, --yes
Accept existing values and built-in defaults without prompting
--dry-run
Preview exact file changes without mutating config or secret files
-h, --help
Print help
labby setup incusbackup
Validate or apply local Incus backup policy
Usage: incusbackup [OPTIONS] <COMMAND>
Commands:
validate Validate a backup policy YAML without mutating Incus
apply Apply a backup policy YAML to an Incus instance
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup incusbackup validate
Validate a backup policy YAML without mutating Incus
Usage: validate [OPTIONS]
Options:
--config <CONFIG>
Backup policy YAML to validate
[default: config/incus/labby-backup.yaml]
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup incusbackup apply
Apply a backup policy YAML to an Incus instance
Usage: apply [OPTIONS] --name <NAME>
Options:
--json
Emit JSON instead of human-readable tables
--name <NAME>
Incus container name
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--config <CONFIG>
Backup policy YAML to apply
[default: config/incus/labby-backup.yaml]
--dry-run
Print the changes without mutating Incus
-y, --yes
Confirm applying the backup policy without prompting
-h, --help
Print help
labby setup incusbackup help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby setup incus-ssh
Bootstrap container SSH trust from the host ~/.ssh/config
Usage: incus-ssh [OPTIONS] <COMMAND>
Commands:
bootstrap Generate an id_ed25519 key in the container and authorize it on configured hosts
verify Verify container-side SSH access to configured hosts
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup incus-ssh bootstrap
Generate an id_ed25519 key in the container and authorize it on configured hosts
Usage: bootstrap [OPTIONS]
Options:
--container <CONTAINER>
Incus container name
[default: labby]
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--user <USER>
User inside the Incus container
[default: labby]
--ssh-config <SSH_CONFIG>
Host SSH config to read
--key-path <KEY_PATH>
Private key path inside the container
--dry-run
Print the plan without mutating the container or remote hosts
--include <INCLUDE>
Only process hosts whose alias or HostName matches this filter. Repeatable
--exclude <EXCLUDE>
Skip hosts whose alias or HostName matches this filter. Repeatable
--fail-fast
Abort on the first failed host instead of continuing and reporting failures
--continue-on-error
Continue past failed hosts and report them at the end (default)
--install-config
Install a sanitized SSH config into the container. Default for unfiltered runs
--no-install-config
Do not install a sanitized SSH config into the container. Default for filtered runs
--timeout-seconds <TIMEOUT_SECONDS>
SSH connection timeout in seconds
[default: 10]
-y, --yes
Confirm remote authorized_keys updates
-h, --help
Print help
labby setup incus-ssh verify
Verify container-side SSH access to configured hosts
Usage: verify [OPTIONS]
Options:
--container <CONTAINER>
Incus container name
[default: labby]
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--user <USER>
User inside the Incus container
[default: labby]
--ssh-config <SSH_CONFIG>
Host SSH config to read
--key-path <KEY_PATH>
Private key path inside the container
--include <INCLUDE>
Only process hosts whose alias or HostName matches this filter. Repeatable
--exclude <EXCLUDE>
Skip hosts whose alias or HostName matches this filter. Repeatable
--fail-fast
Abort on the first failed host instead of continuing and reporting failures
--continue-on-error
Continue past failed hosts and report them at the end (default)
--install-config
Refresh the sanitized SSH config before verifying. Default for unfiltered runs
--no-install-config
Do not refresh the sanitized SSH config before verifying. Default for filtered runs
--timeout-seconds <TIMEOUT_SECONDS>
SSH connection timeout in seconds
[default: 10]
-h, --help
Print help
labby setup incus-ssh help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby setup install
Copy the labby binary into ~/.local/bin so it is callable in your own terminal
Usage: install [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby setup install-plugin
Install the Claude Code plugin for a configured service
Usage: install-plugin [OPTIONS] <SERVICE>
Arguments:
<SERVICE>
Service name, for example `unifi` or `apprise`
Options:
--json
Emit JSON instead of human-readable tables
-y, --yes
Skip confirmation for destructive actions
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--dry-run
Print what would be dispatched without executing
-h, --help
Print help
labby setup uninstall-plugin
Uninstall the Claude Code plugin for a service
Usage: uninstall-plugin [OPTIONS] <SERVICE>
Arguments:
<SERVICE>
Service name, for example `unifi` or `apprise`
Options:
--json
Emit JSON instead of human-readable tables
-y, --yes
Skip confirmation for destructive actions
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--dry-run
Print what would be dispatched without executing
-h, --help
Print help
labby setup help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby incus
Manage the supported Incus Labby gateway container
Usage: incus [OPTIONS] <COMMAND>
Commands:
setup Bootstrap or converge the supported Incus Labby gateway container
sync Sync a local labby binary into the Labby Incus container
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby incus setup
Bootstrap or converge the supported Incus Labby gateway container
Usage: setup [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--name <NAME>
Container name (default: labby)
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--image <IMAGE>
Incus image alias (default: images:ubuntu/24.04)
--profile-name <PROFILE_NAME>
Incus profile name (default: labby-gateway)
--backup-config <BACKUP_CONFIG>
Incus snapshot policy YAML path; defaults to the embedded policy
--no-backup-config
Do not apply an Incus snapshot policy
--runtime-profile-name <RUNTIME_PROFILE_NAME>
Rootless profile for existing containers with a different root pool
--storage-driver <STORAGE_DRIVER>
Incus storage driver: zfs, btrfs, or dir
--storage-pool <STORAGE_POOL>
Incus storage pool used by the profile root disk
--storage-source <STORAGE_SOURCE>
Incus storage source path/dataset for the pool
--version <VERSION>
Labby release tag to install. Defaults to latest
[default: latest]
--local-binary <LOCAL_BINARY>
Push a locally built labby binary instead of downloading a release
--skip-install
Use the labby binary already baked into the selected image
--dry-run
Print bootstrap commands only
--tailscale-ssh
Run tailscale up with --ssh when TS_AUTHKEY is set
--tailscale-hostname <TAILSCALE_HOSTNAME>
Hostname to register with Tailscale; defaults to the Incus container name
--allow-source-fallback
Allow install.sh cargo fallback if the release asset is unavailable
-y, --yes
Confirm bootstrap without prompting
-h, --help
Print help
labby incus sync
Sync a local labby binary into the Labby Incus container
Usage: sync [OPTIONS]
Options:
--container <CONTAINER>
Incus container name. Defaults to LABBY_INCUS_CONTAINER, then labby, then a single running labby-* container
--json
Emit JSON instead of human-readable tables
--binary <BINARY>
Local labby binary to install. Defaults to LABBY_INCUS_BINARY, target/debug/labby, then the current executable
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--web-assets-dir <WEB_ASSETS_DIR>
Local static web export to sync. Defaults to LABBY_INCUS_WEB_ASSETS_DIR, then apps/gateway-admin/out
--no-web-assets
Skip syncing static web assets into the container web asset directory
--check-url <CHECK_URL>
Optional public or host-bound URL to verify after the service is ready
--force-fallback
Fall back to `incus stop --force && incus start` if the service restart path fails
--no-force-fallback
Disable the default Incus force-restart fallback
--dry-run
Print the resolved operation without mutating the container
-h, --help
Print help
labby incus help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby update
Update labby from the latest GitHub release
Usage: update [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--version <VERSION>
Release tag to install. Defaults to the latest GitHub release with a Labby binary asset
[default: latest]
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--install-dir <INSTALL_DIR>
Install directory for the host binary
--no-incus-sync
Do not sync the updated binary into an Incus container
--no-web-assets
Do not update or clear the Incus filesystem web asset directory
--container <CONTAINER>
Incus container name for the post-update sync
--check-url <CHECK_URL>
Optional public or host-bound URL to verify after the Incus sync
--force-fallback
Fall back to `incus stop --force && incus start` if the service restart path fails
--no-force-fallback
Disable the default Incus force-restart fallback after installing the release
--dry-run
Print what would happen without installing or syncing
-h, --help
Print help
labby completions
Generate shell completions
Usage: completions [OPTIONS] <SHELL>
Arguments:
<SHELL>
Target shell
[possible values: bash, elvish, fish, powershell, zsh]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway
Manage proxied upstream MCP gateways
Usage: gateway [OPTIONS] <COMMAND>
Commands:
list List configured gateways and their runtime status
get Get one configured gateway
test Test a configured or proposed gateway without saving it
add Add a gateway and reconcile runtime state
update Update a gateway and reconcile runtime state
remove Remove a gateway and reconcile runtime state
quarantine Manage Lab-backed virtual servers quarantined during config migration
protected-route Manage public MCP routes protected by Lab OAuth
reload Reload gateways from config and reconcile runtime state
mcp Manage upstream MCP server lifecycle and OAuth
clients Inspect inbound MCP clients/sessions connected to this gateway
discover Scan the machine for MCP server configs from known editors and tools (read-only)
import Import discovered MCP servers into the gateway (disabled by default)
pending Manage pending discovered servers waiting for approval
public-urls Show resolved public URL configuration (app and MCP gateway)
code Search, inspect, and execute Code Mode snippets through dispatch
enrich Generate and approve Code Mode upstream hint proposals
usage Query gateway upstream call-usage telemetry
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway list
List configured gateways and their runtime status
Usage: list [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway get
Get one configured gateway
Usage: get [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway test
Test a configured or proposed gateway without saving it
Usage: test [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--name <NAME>
Name of a configured gateway to test (omit to test with inline --url/--command)
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway add
Add a gateway and reconcile runtime state
Usage: add [OPTIONS] --name <NAME>
Options:
--json
Emit JSON instead of human-readable tables
--name <NAME>
Unique name for the gateway upstream
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--url <URL>
HTTP(S) URL for a remote MCP server (mutually exclusive with --command)
--command <COMMAND>
Stdio command to launch for a local MCP server (mutually exclusive with --url)
--arg <ARGS>
Additional arguments passed to the stdio command (repeat for multiple)
--bearer-token-env <BEARER_TOKEN_ENV>
Environment variable name whose value is used as the upstream bearer token
--proxy-resources <PROXY_RESOURCES>
[default: true]
[possible values: true, false]
-h, --help
Print help
labby gateway update
Update a gateway and reconcile runtime state
Usage: update [OPTIONS] <NAME>
Arguments:
<NAME>
Name of the gateway upstream to update
Options:
--json
Emit JSON instead of human-readable tables
--new-name <NEW_NAME>
Rename the gateway upstream to this new name
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--url <URL>
New HTTP(S) URL for a remote MCP server
--clear-url
Clear the HTTP(S) URL from this gateway
--command <COMMAND>
New stdio command for a local MCP server
--clear-command
Clear the stdio command from this gateway
--arg <ARGS>
Replace all command arguments with these values (repeat for multiple)
--bearer-token-env <BEARER_TOKEN_ENV>
Environment variable name whose value is used as the upstream bearer token
--clear-bearer-token-env
Clear the upstream bearer token environment variable name
--proxy-resources <PROXY_RESOURCES>
[possible values: true, false]
-h, --help
Print help
labby gateway remove
Remove a gateway and reconcile runtime state
Usage: remove [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway quarantine
Manage Lab-backed virtual servers quarantined during config migration
Usage: quarantine [OPTIONS] <COMMAND>
Commands:
list List Lab-backed virtual servers quarantined during config migration
restore Restore a quarantined Lab-backed virtual server into the active gateway list
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway quarantine list
List Lab-backed virtual servers quarantined during config migration
Usage: list [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway quarantine restore
Restore a quarantined Lab-backed virtual server into the active gateway list
Usage: restore [OPTIONS] <ID>
Arguments:
<ID>
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway quarantine help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby gateway protected-route
Manage public MCP routes protected by Lab OAuth
Usage: protected-route [OPTIONS] <COMMAND>
Commands:
list List Gateway-managed public MCP routes protected by Lab OAuth
get Get one Gateway-managed protected MCP route
add Add a Gateway-managed protected MCP route
update Replace a Gateway-managed protected MCP route
remove Remove a Gateway-managed protected MCP route
test Validate a proposed protected MCP route without saving it
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway protected-route list
List Gateway-managed public MCP routes protected by Lab OAuth
Usage: list [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway protected-route get
Get one Gateway-managed protected MCP route
Usage: get [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway protected-route add
Add a Gateway-managed protected MCP route
Usage: add [OPTIONS] --name <NAME> --public-host <PUBLIC_HOST> --public-path <PUBLIC_PATH>
Options:
--json
Emit JSON instead of human-readable tables
--name <NAME>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--enabled
--public-host <PUBLIC_HOST>
--public-path <PUBLIC_PATH>
--upstream <UPSTREAM>
--backend-url <BACKEND_URL>
--scope <SCOPES>
--health-path <HEALTH_PATH>
--gateway-subset
Expose a scoped Lab gateway MCP surface instead of proxying one backend
--target-upstream <TARGET_UPSTREAM>
Upstream names to expose for --gateway-subset. Repeat or comma-separate
--target-service <TARGET_SERVICE>
Built-in Lab service names to expose for --gateway-subset. Repeat or comma-separate
--expose-code-mode
Expose codemode on this gateway subset
-h, --help
Print help
labby gateway protected-route update
Replace a Gateway-managed protected MCP route
Usage: update [OPTIONS] --public-host <PUBLIC_HOST> --public-path <PUBLIC_PATH> <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--new-name <NEW_NAME>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--enabled <ENABLED>
[possible values: true, false]
--public-host <PUBLIC_HOST>
--public-path <PUBLIC_PATH>
--upstream <UPSTREAM>
--backend-url <BACKEND_URL>
--scope <SCOPES>
--health-path <HEALTH_PATH>
--gateway-subset
Expose a scoped Lab gateway MCP surface instead of proxying one backend
--target-upstream <TARGET_UPSTREAM>
Upstream names to expose for --gateway-subset. Repeat or comma-separate
--target-service <TARGET_SERVICE>
Built-in Lab service names to expose for --gateway-subset. Repeat or comma-separate
--expose-code-mode
Expose codemode on this gateway subset
-h, --help
Print help
labby gateway protected-route remove
Remove a Gateway-managed protected MCP route
Usage: remove [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway protected-route test
Validate a proposed protected MCP route without saving it
Usage: test [OPTIONS] --name <NAME> --public-host <PUBLIC_HOST> --public-path <PUBLIC_PATH>
Options:
--json
Emit JSON instead of human-readable tables
--name <NAME>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--enabled
--public-host <PUBLIC_HOST>
--public-path <PUBLIC_PATH>
--upstream <UPSTREAM>
--backend-url <BACKEND_URL>
--scope <SCOPES>
--health-path <HEALTH_PATH>
--gateway-subset
Expose a scoped Lab gateway MCP surface instead of proxying one backend
--target-upstream <TARGET_UPSTREAM>
Upstream names to expose for --gateway-subset. Repeat or comma-separate
--target-service <TARGET_SERVICE>
Built-in Lab service names to expose for --gateway-subset. Repeat or comma-separate
--expose-code-mode
Expose codemode on this gateway subset
-h, --help
Print help
labby gateway protected-route help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby gateway reload
Reload gateways from config and reconcile runtime state
Usage: reload [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway mcp
Manage upstream MCP server lifecycle and OAuth
Usage: mcp [OPTIONS] <COMMAND>
Commands:
auth Manage upstream MCP server OAuth credentials
list List upstream MCP runtime state, discovery counts, and likely stale process counts
enable Enable an upstream MCP server so new sessions discover and proxy it again
disable Disable an upstream MCP server and optionally clean up running processes
cleanup Kill or preview running processes associated with one upstream MCP server
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway mcp auth
Manage upstream MCP server OAuth credentials
Usage: auth [OPTIONS] <COMMAND>
Commands:
start Start the upstream OAuth flow and print the browser authorization URL
open Start the upstream OAuth flow and open the authorization URL in a browser
status Read upstream OAuth status for the shared gateway credential
clear Clear stored upstream OAuth credentials for the shared gateway credential
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway mcp auth start
Start the upstream OAuth flow and print the browser authorization URL
Usage: start [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--subject <SUBJECT>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--open
--wait
--wait-timeout-secs <WAIT_TIMEOUT_SECS>
[default: 120]
-h, --help
Print help
labby gateway mcp auth open
Start the upstream OAuth flow and open the authorization URL in a browser
Usage: open [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--subject <SUBJECT>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--open
--wait
--wait-timeout-secs <WAIT_TIMEOUT_SECS>
[default: 120]
-h, --help
Print help
labby gateway mcp auth status
Read upstream OAuth status for the shared gateway credential
Usage: status [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--subject <SUBJECT>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--open
--wait
--wait-timeout-secs <WAIT_TIMEOUT_SECS>
[default: 120]
-h, --help
Print help
labby gateway mcp auth clear
Clear stored upstream OAuth credentials for the shared gateway credential
Usage: clear [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--subject <SUBJECT>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--open
--wait
--wait-timeout-secs <WAIT_TIMEOUT_SECS>
[default: 120]
-h, --help
Print help
labby gateway mcp auth help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby gateway mcp list
List upstream MCP runtime state, discovery counts, and likely stale process counts
Usage: list [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway mcp enable
Enable an upstream MCP server so new sessions discover and proxy it again
Usage: enable [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--cleanup
--json
Emit JSON instead of human-readable tables
--aggressive
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway mcp disable
Disable an upstream MCP server and optionally clean up running processes
Usage: disable [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--cleanup
--json
Emit JSON instead of human-readable tables
--aggressive
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway mcp cleanup
Kill or preview running processes associated with one upstream MCP server
Usage: cleanup [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--aggressive
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--dry-run
-h, --help
Print help
labby gateway mcp help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby gateway clients
Inspect inbound MCP clients/sessions connected to this gateway
Usage: clients [OPTIONS] <COMMAND>
Commands:
list List inbound MCP clients/sessions currently connected to this gateway. Best-effort — reflects the most recently observed connect events, not a strict live liveness view
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway clients list
List inbound MCP clients/sessions currently connected to this gateway. Best-effort — reflects the most recently observed connect events, not a strict live liveness view
Usage: list [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway clients help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby gateway discover
Scan the machine for MCP server configs from known editors and tools (read-only)
Usage: discover [OPTIONS]
Options:
--clients <CLIENTS>
Limit scan to specific client kinds (comma-separated: cursor,claude-code,vscode,...)
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--include-existing
Also show servers already present in the gateway config
-h, --help
Print help
labby gateway import
Import discovered MCP servers into the gateway (disabled by default)
Usage: import [OPTIONS]
Options:
--all
Import every discovered server not already in the gateway config
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--name <NAMES>
Specific server names to import (space-separated)
--clients <CLIENTS>
Limit discovery to specific client kinds (comma-separated)
-y, --yes
Skip confirmation for the destructive config import
-h, --help
Print help
labby gateway pending
Manage pending discovered servers waiting for approval
Usage: pending [OPTIONS] <COMMAND>
Commands:
list List discovered servers waiting for approval
approve Approve a pending server and add it to the gateway (disabled by default)
reject Reject a pending server and tombstone it so it never re-appears
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway pending list
List discovered servers waiting for approval
Usage: list [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway pending approve
Approve a pending server and add it to the gateway (disabled by default)
Usage: approve [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
-y, --yes
Skip the destructive-action confirmation prompt
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--dry-run
Print what would be done without executing
-h, --help
Print help
labby gateway pending reject
Reject a pending server and tombstone it so it never re-appears
Usage: reject [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
-y, --yes
Skip the destructive-action confirmation prompt
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--dry-run
Print what would be done without executing
-h, --help
Print help
labby gateway pending help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby gateway public-urls
Show resolved public URL configuration (app and MCP gateway)
Usage: public-urls [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway code
Search, inspect, and execute Code Mode snippets through dispatch
Usage: code [OPTIONS] <COMMAND>
Commands:
status Read gateway-wide Code Mode settings
enable Enable the gateway codemode MCP surface
disable Disable the gateway codemode MCP surface
ui Manage the explicit Code Mode MCP App UI while keeping text execution available
exec Execute a sandboxed JavaScript snippet that calls the typed `codemode.<upstream>.<tool>` helpers (or `callTool` directly)
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway code status
Read gateway-wide Code Mode settings
Usage: status [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway code enable
Enable the gateway codemode MCP surface
Usage: enable [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway code disable
Disable the gateway codemode MCP surface
Usage: disable [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway code ui
Manage the explicit Code Mode MCP App UI while keeping text execution available
Usage: ui [OPTIONS] <COMMAND>
Commands:
status Read whether the explicit Code Mode MCP App UI is enabled
enable Enable the explicit Code Mode MCP App UI
disable Disable the explicit Code Mode MCP App UI without disabling Code Mode
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway code ui status
Read whether the explicit Code Mode MCP App UI is enabled
Usage: status [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway code ui enable
Enable the explicit Code Mode MCP App UI
Usage: enable [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway code ui disable
Disable the explicit Code Mode MCP App UI without disabling Code Mode
Usage: disable [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway code ui help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby gateway code exec
Execute a sandboxed JavaScript snippet that calls the typed `codemode.<upstream>.<tool>` helpers (or `callTool` directly)
Usage: exec [OPTIONS]
Options:
--code <CODE>
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--file <FILE>
-h, --help
Print help
labby gateway code help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby gateway enrich
Generate and approve Code Mode upstream hint proposals
Usage: enrich [OPTIONS] [COMMAND]
Commands:
apply
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--upstream <UPSTREAMS>
--all
--provider <PROVIDER>
[default: deterministic]
[possible values: deterministic, claude, codex]
--max-upstreams <MAX_UPSTREAMS>
--timeout-ms <TIMEOUT_MS>
-y, --yes
Skip confirmation for provider-backed preview runs
-h, --help
Print help
labby gateway enrich apply
Usage: apply [OPTIONS] --upstream <UPSTREAM> --hint <HINT> --metadata-hash <METADATA_HASH>
Options:
--json
Emit JSON instead of human-readable tables
--upstream <UPSTREAM>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--hint <HINT>
--metadata-hash <METADATA_HASH>
-y, --yes
-h, --help
Print help
labby gateway enrich help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby gateway usage
Query gateway upstream call-usage telemetry
Usage: usage [OPTIONS] <COMMAND>
Commands:
metrics Aggregated totals, error rate, top tools, top actors
calls Raw call records, newest first
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby gateway usage metrics
Aggregated totals, error rate, top tools, top actors
Usage: metrics [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--since-unix <SINCE_UNIX>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--until-unix <UNTIL_UNIX>
--upstream <UPSTREAM>
-h, --help
Print help
labby gateway usage calls
Raw call records, newest first
Usage: calls [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--since-unix <SINCE_UNIX>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--until-unix <UNTIL_UNIX>
--upstream <UPSTREAM>
--limit <LIMIT>
--cursor <CURSOR>
Continue from the opaque cursor returned by the previous page
--include-total
Include the exact number of rows matching the filters
--offset <OFFSET>
Deprecated deep-offset pagination; use `--cursor` instead
-h, --help
Print help
labby gateway usage help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby gateway help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby snippets
Manage executable Code Mode snippets
Usage: snippets [OPTIONS] <COMMAND>
Commands:
list List built-in and user snippets
get Show one snippet body and metadata
exec Execute a snippet through gateway Code Mode
create Create or update a user snippet
validate Validate a snippet without saving or executing it
remove Remove a user snippet
test Execute a snippet and report pass/fail
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby snippets list
List built-in and user snippets
Usage: list [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby snippets get
Show one snippet body and metadata
Usage: get [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby snippets exec
Execute a snippet through gateway Code Mode
Usage: exec [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
--param <KEY=VALUE>
Input values passed to the snippet as key=value pairs
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby snippets create
Create or update a user snippet
Usage: create [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--file <FILE>
Read snippet body from a file
--json
Emit JSON instead of human-readable tables
--code <CODE>
Inline snippet body
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--description <DESCRIPTION>
Human-readable snippet description for generated frontmatter
-f, --force
Overwrite an existing user snippet
-h, --help
Print help
labby snippets validate
Validate a snippet without saving or executing it
Usage: validate [OPTIONS] <NAME>
Arguments:
<NAME>
Existing snippet name or filename stem for --file/--code validation
Options:
--file <FILE>
Validate snippet body from a file instead of an existing snippet
--json
Emit JSON instead of human-readable tables
--code <CODE>
Validate inline snippet body instead of an existing snippet
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby snippets remove
Remove a user snippet
Usage: remove [OPTIONS] <NAME>
Arguments:
<NAME>
Options:
--json
Emit JSON instead of human-readable tables
-y, --yes
Confirm removal without prompting
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--no-confirm
Alias for --yes
--dry-run
Show what would be removed without deleting it
-h, --help
Print help
labby snippets test
Execute a snippet and report pass/fail
Usage: test [OPTIONS] [NAME]
Arguments:
[NAME]
Options:
--all
Run every listed snippet with default params
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--param <KEY=VALUE>
Input values passed to the snippet as key=value pairs
-h, --help
Print help
labby snippets help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby oauth
Run local OAuth callback relay helpers
Usage: oauth [OPTIONS] <COMMAND>
Commands:
relay-local Run a local OAuth callback relay that forwards to a machine or explicit target
relay-registry Manage the public OAuth callback relay sidecar registry
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby oauth relay-local
Run a local OAuth callback relay that forwards to a machine or explicit target
Usage: relay-local [OPTIONS] --port <PORT> <--machine <MACHINE>|--forward-base <FORWARD_BASE>>
Options:
--json
Emit JSON instead of human-readable tables
--machine <MACHINE>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--forward-base <FORWARD_BASE>
--port <PORT>
-h, --help
Print help
labby oauth relay-registry
Manage the public OAuth callback relay sidecar registry
Usage: relay-registry [OPTIONS] <COMMAND>
Commands:
list List registered public callback relay machines
import Import a standalone callback-relay registry JSON file
register Register or update a public callback relay machine
remove Remove a public callback relay machine
disable Disable a public callback relay machine without removing it
enable Enable a public callback relay machine
help Print this message or the help of the given subcommand(s)
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby oauth relay-registry list
List registered public callback relay machines
Usage: list [OPTIONS]
Options:
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby oauth relay-registry import
Import a standalone callback-relay registry JSON file.
Destructive: replaces the entire sidecar registry. Requires `-y` / `--yes` when stdin is not a TTY; otherwise prompts for confirmation.
Usage: import [OPTIONS] --file <FILE>
Options:
--file <FILE>
--json
Emit JSON instead of human-readable tables
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-y, --yes
Skip confirmation for this destructive action
-h, --help
Print help (see a summary with '-h')
labby oauth relay-registry register
Register or update a public callback relay machine
Usage: register [OPTIONS] --machine <MACHINE> --target-url <TARGET_URL>
Options:
--json
Emit JSON instead of human-readable tables
--machine <MACHINE>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--target-url <TARGET_URL>
--description <DESCRIPTION>
--disabled
-h, --help
Print help
labby oauth relay-registry remove
Remove a public callback relay machine.
Destructive: deletes the entry. Requires `-y` / `--yes` when stdin is not a TTY; otherwise prompts for confirmation.
Usage: remove [OPTIONS] --machine <MACHINE>
Options:
--json
Emit JSON instead of human-readable tables
--machine <MACHINE>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-y, --yes
Skip confirmation for this destructive action
-h, --help
Print help (see a summary with '-h')
labby oauth relay-registry disable
Disable a public callback relay machine without removing it
Usage: disable [OPTIONS] --machine <MACHINE>
Options:
--json
Emit JSON instead of human-readable tables
--machine <MACHINE>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby oauth relay-registry enable
Enable a public callback relay machine
Usage: enable [OPTIONS] --machine <MACHINE>
Options:
--json
Emit JSON instead of human-readable tables
--machine <MACHINE>
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
-h, --help
Print help
labby oauth relay-registry help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby oauth help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)
labby proxy
Proxy a stdio MCP server to Streamable HTTP
Usage: proxy [OPTIONS] <COMMAND>...
Arguments:
<COMMAND>...
Child program or script followed by its arguments
Options:
--json
Emit JSON instead of human-readable tables
--port <PORT>
Override the external port for this invocation
--auth <AUTH>
Override the configured auth policy
[possible values: tailnet, bearer, oauth, none]
--color <COLOR>
Control human-readable CLI styling
[default: auto]
[possible values: auto, plain, color]
--bearer-token <BEARER_TOKEN>
One-run static bearer token; implies bearer auth
[env: LABBY_PROXY_BEARER_TOKEN]
--bearer-token-stdin
Read a one-run static bearer token from stdin; implies bearer auth
--local
Override exposure to a local loopback URL
--cwd <CWD>
Child working directory
--env <NAME=VALUE>
Explicit child environment entry; repeatable
--inherit-env <NAME>
Inherit one ambient environment variable; repeatable
-h, --help
Print help
labby help
Print this message or the help of the given subcommand(s)
Usage: help [COMMAND]...
Arguments:
[COMMAND]...
Print help for the subcommand(s)