cli-help.md

# Labby CLI Help

Generated by `labby docs generate` from the executable Clap command tree. Do not edit by hand.

## `labby`

```text
Rust MCP gateway with Code Mode, authentication, protected routes, setup, logs, CLI, HTTP API, and operator web UI.

Usage: labby [OPTIONS] <COMMAND>

Commands:
  help         Discover commands, expand an entire subtree, or search offline help
  context      Save and select non-secret destinations in the existing host configuration
  auth         Authenticate to Labby and manage credential bootstrap or OAuth relays
  gateway      Inspect the selected Labby gateway, its sessions, URLs, and usage
  server       Manage upstream MCP servers: configuration, testing, lifecycle, and authentication
  route        Manage public protected MCP routes. Use replace for full configuration replacement
  loadout      Manage reusable capability loadouts. set patches supplied fields only
  code         Execute Code Mode and manage its settings, UI, and upstream hints
  snippet      Manage saved executable snippets in the local installation
  skill        Read locally visible skills and manage daemon-backed upstream skill policy
  doctor       Audit configuration and dependencies without automatically repairing them
  logs         Query bounded local process logs, or explicitly select the deployment journal
  setup        Guide onboarding, check prerequisites, or explicitly repair local setup
  tailcat      Pair an approved browser with local hardware sandbox tools
  host         Install, update, or operate the host service and its Incus deployment
  config       Inspect setup state and manage drafts or proxy defaults
  state        Migrate, export, verify, or restore durable installation state offline
  serve        Run the Labby HTTP runtime in the foreground
  mcp          Run the Labby stdio MCP transport. stdout contains protocol bytes only
  proxy        Proxy a stdio upstream to Streamable HTTP
  completions  Generate shell completions offline from the same command tree

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help

  -V, --version
          Print version

Examples:
  labby help --all
  labby help --search oauth
  labby host service status

Help is offline and never starts services. Use labby help <resource> --all for a complete subtree.
```

## `labby help`

```text
Discover commands, expand an entire subtree, or search offline help

Usage: labby help [OPTIONS] [PATH]...

Arguments:
  [PATH]...
          Command path to explain, for example: server auth

Options:
      --all
          List every public command in this subtree without truncation

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --search <QUERY>
          Find commands by name, description, or option help. Does not execute anything

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby context`

```text
Save and select non-secret destinations in the existing host configuration

Usage: labby context [OPTIONS] <COMMAND>

Commands:
  list    List saved destinations without connecting to them
  get     Read one context, or the selected context when NAME is omitted
  add     Save a non-secret destination. Requires --server URL. Does not authenticate
  set     Patch the supplied --server or --team-id; leave omitted fields unchanged
  use     Select an existing context for subsequent daemon-backed commands
  remove  Remove an inactive context, without revoking any credentials
  clear   Clear the convenience selection without deleting saved contexts

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby context list`

```text
List saved destinations without connecting to them

Usage: labby context list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby context get`

```text
Read one context, or the selected context when NAME is omitted

Usage: labby context get [OPTIONS] [NAME]

Arguments:
  [NAME]


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby context add`

```text
Save a non-secret destination. Requires --server URL. Does not authenticate

Usage: labby context add [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --use


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby context set`

```text
Patch the supplied --server or --team-id; leave omitted fields unchanged

Usage: labby context set [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --clear-team


      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby context use`

```text
Select an existing context for subsequent daemon-backed commands

Usage: labby context use [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby context remove`

```text
Remove an inactive context, without revoking any credentials

Usage: labby context remove [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby context clear`

```text
Clear the convenience selection without deleting saved contexts

Usage: labby context clear [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth`

```text
Authenticate to Labby and manage credential bootstrap or OAuth relays

Usage: labby auth [OPTIONS] <COMMAND>

Commands:
  login      Sign in to an explicitly selected Labby server
  status     Inspect the saved OAuth session without refreshing credentials or contacting the server
  logout     Remove only the local OAuth session for the selected destination
  bootstrap  Prepare, consume, or recover the existing credential bootstrap workflow
  owner      Approve an existing owner identity link while the gateway is stopped
  relay      Operate OAuth callback relays and their registry
  provider   Manage credentials shared across upstreams and dependent grants

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth login`

```text
Sign in to an explicitly selected Labby server

Usage: labby auth login [OPTIONS]

Options:
      --client-metadata-url <CLIENT_METADATA_URL>
          Public HTTPS client metadata document for servers that require CIMD

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --client-id <CLIENT_ID>
          Client identifier registered with the server in advance

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --client-secret-env <CLIENT_SECRET_ENV>
          Environment variable containing the preregistered client secret

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --dynamic-registration
          Use server-advertised dynamic registration instead of a saved selection

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth status`

```text
Inspect the saved OAuth session without refreshing credentials or contacting the server

Usage: labby auth status [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth logout`

```text
Remove only the local OAuth session for the selected destination

Usage: labby auth logout [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth bootstrap`

```text
Prepare, consume, or recover the existing credential bootstrap workflow

Usage: labby auth bootstrap [OPTIONS] <COMMAND>

Commands:
  prepare  Securely create a one-time proof bundle and client credential
  consume  Submit the prepared request to the running daemon without local mutation
  status   Ask the running daemon for authoritative prepare status
  recover  Verify a prepare and report its current recovery state
  cleanup  Offline cleanup; requires the daemon to be stopped and durable tombstones

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth bootstrap prepare`

```text
Securely create a one-time proof bundle and client credential

Usage: labby auth bootstrap prepare [OPTIONS] --proof-file <PROOF_FILE> --credential-file <CREDENTIAL_FILE> --organization-name <ORGANIZATION_NAME> --project-name <PROJECT_NAME> --subject <SUBJECT> --loadout-id <LOADOUT_ID> --route-id <ROUTE_ID> --resource <RESOURCE> --scope <SCOPE>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --proof-file <PROOF_FILE>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --credential-file <CREDENTIAL_FILE>


      --organization-name <ORGANIZATION_NAME>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --project-name <PROJECT_NAME>


  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --subject <SUBJECT>


      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --loadout-id <LOADOUT_ID>


      --route-id <ROUTE_ID>


      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --resource <RESOURCE>


      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --scope <SCOPE>


      --ttl <TTL>
          [default: 600]

  -h, --help
          Print help
```

## `labby auth bootstrap consume`

```text
Submit the prepared request to the running daemon without local mutation

Usage: labby auth bootstrap consume [OPTIONS] --prepare-id <PREPARE_ID>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --prepare-id <PREPARE_ID>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth bootstrap status`

```text
Ask the running daemon for authoritative prepare status

Usage: labby auth bootstrap status [OPTIONS] --prepare-id <PREPARE_ID>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --prepare-id <PREPARE_ID>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth bootstrap recover`

```text
Verify a prepare and report its current recovery state

Usage: labby auth bootstrap recover [OPTIONS] --prepare-id <PREPARE_ID>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --prepare-id <PREPARE_ID>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --complete


      --revoke


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth bootstrap cleanup`

```text
Offline cleanup; requires the daemon to be stopped and durable tombstones

Usage: labby auth bootstrap cleanup [OPTIONS] --prepare-id <PREPARE_ID>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --prepare-id <PREPARE_ID>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth owner`

```text
Approve an existing owner identity link while the gateway is stopped

Usage: labby auth owner [OPTIONS] <COMMAND>

Commands:
  link  Approve the protected identity-link manifest. Does not perform a login

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth owner link`

```text
Approve the protected identity-link manifest. Does not perform a login

Usage: labby auth owner link [OPTIONS] --approval-file <APPROVAL_FILE>

Options:
      --approval-file <APPROVAL_FILE>
          Protected JSON approval manifest binding the verified identity and existing project

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth relay`

```text
Operate OAuth callback relays and their registry

Usage: labby auth relay [OPTIONS] <COMMAND>

Commands:
  local     Run a local OAuth callback relay that forwards to a machine or explicit target
  registry  Manage the public OAuth callback relay sidecar registry

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth relay local`

```text
Run a local OAuth callback relay that forwards to a machine or explicit target

Usage: labby auth relay local [OPTIONS] --port <PORT> <--machine <MACHINE>|--forward-base <FORWARD_BASE>>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --machine <MACHINE>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --forward-base <FORWARD_BASE>


      --port <PORT>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth relay registry`

```text
Manage the public OAuth callback relay sidecar registry

Usage: labby auth relay registry [OPTIONS] <COMMAND>

Commands:
  list      List registered public callback relay machines
  import    Import a standalone callback-relay registry JSON file
  register  Register or update a public callback relay machine
  remove    Remove a public callback relay machine
  disable   Disable a public callback relay machine without removing it
  enable    Enable a public callback relay machine

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth relay registry list`

```text
List registered public callback relay machines

Usage: labby auth relay registry list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth relay registry import`

```text
Import a standalone callback-relay registry JSON file.

Destructive: replaces the entire sidecar registry. Requires `-y` / `--yes` when stdin is not a TTY; otherwise prompts for confirmation.

Usage: labby auth relay registry import [OPTIONS] --file <FILE>

Options:
      --file <FILE>


      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -y, --yes
          Skip confirmation for this destructive action

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help (see a summary with '-h')
```

## `labby auth relay registry register`

```text
Register or update a public callback relay machine

Usage: labby auth relay registry register [OPTIONS] --machine <MACHINE> --target-url <TARGET_URL>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --machine <MACHINE>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --target-url <TARGET_URL>


      --description <DESCRIPTION>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --disabled


  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth relay registry remove`

```text
Remove a public callback relay machine.

Destructive: deletes the entry. Requires `-y` / `--yes` when stdin is not a TTY; otherwise prompts for confirmation.

Usage: labby auth relay registry remove [OPTIONS] --machine <MACHINE>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --machine <MACHINE>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -y, --yes
          Skip confirmation for this destructive action

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help (see a summary with '-h')
```

## `labby auth relay registry disable`

```text
Disable a public callback relay machine without removing it

Usage: labby auth relay registry disable [OPTIONS] --machine <MACHINE>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --machine <MACHINE>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth relay registry enable`

```text
Enable a public callback relay machine

Usage: labby auth relay registry enable [OPTIONS] --machine <MACHINE>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --machine <MACHINE>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth provider`

```text
Manage credentials shared across upstreams and dependent grants

Usage: labby auth provider [OPTIONS] <COMMAND>

Commands:
  google  Manage the central Google provider credential

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth provider google`

```text
Manage the central Google provider credential

Usage: labby auth provider google [OPTIONS] <COMMAND>

Commands:
  revoke  Revoke the central credential AND every dependent Labby grant. Requires --confirm

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby auth provider google revoke`

```text
Revoke the central credential AND every dependent Labby grant. Requires --confirm

Usage: labby auth provider google revoke [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --confirm
          Confirm revocation of a credential shared by Google MCP servers and inbound grants

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby gateway`

```text
Inspect the selected Labby gateway, its sessions, URLs, and usage

Usage: labby gateway [OPTIONS] <COMMAND>

Commands:
  reload    Reload gateways from config and reconcile runtime state
  status    Report authoritative daemon reachability and upstream runtime state
  sessions  Inspect inbound MCP clients/sessions connected to this gateway
  urls      Show resolved public URL configuration (app and MCP gateway)
  usage     Query gateway upstream call-usage telemetry

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby gateway reload`

```text
Reload gateways from config and reconcile runtime state

Usage: labby gateway reload [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby gateway status`

```text
Report authoritative daemon reachability and upstream runtime state

Usage: labby gateway status [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby gateway sessions`

```text
Inspect inbound MCP clients/sessions connected to this gateway

Usage: labby gateway sessions [OPTIONS] <COMMAND>

Commands:
  list  List inbound MCP clients/sessions currently connected to this gateway. Best-effort — reflects the most recently observed connect events, not a strict live liveness view

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby gateway sessions list`

```text
List inbound MCP clients/sessions currently connected to this gateway. Best-effort — reflects the most recently observed connect events, not a strict live liveness view

Usage: labby gateway sessions list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby gateway urls`

```text
Show resolved public URL configuration (app and MCP gateway)

Usage: labby gateway urls [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby gateway usage`

```text
Query gateway upstream call-usage telemetry

Usage: labby gateway usage [OPTIONS] <COMMAND>

Commands:
  metrics  Aggregated totals, error rate, top tools, top actors
  calls    Raw call records, newest first

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby gateway usage metrics`

```text
Aggregated totals, error rate, top tools, top actors

Usage: labby gateway usage metrics [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --since-unix <SINCE_UNIX>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --until-unix <UNTIL_UNIX>


      --upstream <UPSTREAM>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --tool <TOOL>
          Restrict to one qualified upstream::tool target

      --capability <CAPABILITY>
          Restrict to one capability family

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --operation <OPERATION>
          Restrict to one operation name

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --subject-scoped <SUBJECT_SCOPED>
          Restrict by OAuth subject scoping (`true` or `false`)

          [possible values: true, false]

      --actor <ACTOR>
          Restrict to one actor subject

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --outcome <OUTCOME>
          Restrict to one outcome; failed matches every non-ok outcome

      --search <SEARCH>
          Case-insensitive search across target, operation, actor, and outcome

      --bucket-count <BUCKET_COUNT>
          Return this many complete-window time buckets (max 168)

      --timezone <TIMEZONE>
          IANA zone name for DST-correct local-hour aggregation

      --timezone-offset-minutes <TIMEZONE_OFFSET_MINUTES>
          Minutes east of UTC fallback when --timezone is omitted (-1440 to 1440)

      --include-facets
          Include stable facets; errors if any facet exceeds 1000 values

  -h, --help
          Print help
```

## `labby gateway usage calls`

```text
Raw call records, newest first

Usage: labby gateway usage calls [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --since-unix <SINCE_UNIX>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --until-unix <UNTIL_UNIX>


      --upstream <UPSTREAM>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --tool <TOOL>
          Restrict to one qualified upstream::tool target

      --capability <CAPABILITY>
          Restrict to one capability family

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --operation <OPERATION>
          Restrict to one operation name

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --subject-scoped <SUBJECT_SCOPED>
          Restrict by OAuth subject scoping (`true` or `false`)

          [possible values: true, false]

      --actor <ACTOR>
          Restrict to one actor subject

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --outcome <OUTCOME>
          Restrict to one outcome; failed matches every non-ok outcome

      --search <SEARCH>
          Case-insensitive search across target, operation, actor, and outcome

      --limit <LIMIT>


      --cursor <CURSOR>
          Continue from the opaque cursor returned by the previous page

      --include-total
          Include the exact number of rows matching the filters

      --offset <OFFSET>
          Deprecated deep-offset pagination; use `--cursor` instead

  -h, --help
          Print help
```

## `labby server`

```text
Manage upstream MCP servers: configuration, testing, lifecycle, and authentication

Usage: labby server [OPTIONS] <COMMAND>

Commands:
  list        List configured upstream servers and their reported state
  get         Get one configured upstream server
  add         Add an upstream server and reconcile runtime state
  set         Patch only the supplied fields of an existing upstream server
  remove      Remove an upstream server and reconcile runtime state
  test        Actively test a configured upstream without saving changes
  status      Report all upstream runtime states, discovery counts, and stale processes
  enable      Enable an upstream for new sessions
  disable     Disable an upstream, optionally cleaning up its processes
  restart     Reconnect an enabled upstream and clean up its old runtime
  cleanup     Preview or clean up processes associated with one upstream
  auth        Authenticate one upstream, not the operator's Labby account
  discover    Discover MCP configurations from installed editors without importing them
  import      Import discovered upstreams, disabled by default
  pending     Approve or reject discovered servers
  quarantine  Inspect or restore quarantined virtual servers

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server list`

```text
List configured upstream servers and their reported state

Usage: labby server list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server get`

```text
Get one configured upstream server

Usage: labby server get [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server add`

```text
Add an upstream server and reconcile runtime state

Usage: labby server add [OPTIONS] [NAME]

Arguments:
  [NAME]
          Unique upstream name. Missing values can be filled interactively

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --url <URL>
          HTTP(S) URL for a remote MCP server (mutually exclusive with --command)

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --command <COMMAND>
          Stdio command to launch for a local MCP server (mutually exclusive with --url)

      --arg <ARGS>
          Additional arguments passed to the stdio command (repeat for multiple)

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --bearer-token-env <BEARER_TOKEN_ENV>
          Environment variable name whose value is used as the upstream bearer token

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --proxy-resources <PROXY_RESOURCES>
          [default: true]
          [possible values: true, false]

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --proxy-skills <PROXY_SKILLS>
          Aggregate this upstream's Agent Skills (SEP-2640) through the gateway.

          Defaults to false, unlike the other proxy flags: an upstream's skills carry instructions an agent will act on, so aggregating them is a deliberate trust decision. Without this flag there is no way to turn it on from the CLI at all.

          [default: false]
          [possible values: true, false]

      --expose-skill <EXPOSE_SKILLS>
          Initial skill-name exposure allowlist. Repeat for multiple patterns

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --dry-run
          Preview the proposed configuration without contacting or changing a gateway

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help (see a summary with '-h')
```

## `labby server set`

```text
Patch only the supplied fields of an existing upstream server

Usage: labby server set [OPTIONS] <NAME>

Arguments:
  <NAME>
          Name of the gateway upstream to update

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --new-name <NEW_NAME>
          Rename the gateway upstream to this new name

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --url <URL>
          New HTTP(S) URL for a remote MCP server

      --clear-url
          Clear the HTTP(S) URL from this gateway

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --command <COMMAND>
          New stdio command for a local MCP server

  -q, --quiet
          Suppress console logs, but always report command errors

      --clear-command
          Clear the stdio command from this gateway

      --no-input
          Never prompt for missing input or confirmation

      --arg <ARGS>
          Replace all command arguments with these values (repeat for multiple)

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --bearer-token-env <BEARER_TOKEN_ENV>
          Environment variable name whose value is used as the upstream bearer token

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --clear-bearer-token-env
          Clear the upstream bearer token environment variable name

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --proxy-resources <PROXY_RESOURCES>
          [possible values: true, false]

      --proxy-skills <PROXY_SKILLS>
          Turn Agent Skills aggregation on or off for this upstream

          [possible values: true, false]

      --expose-skill <EXPOSE_SKILLS>
          Replace the skill-name exposure allowlist. Repeat for multiple patterns

      --clear-expose-skills
          Clear the skill-name allowlist and expose all validated Skills

  -h, --help
          Print help
```

## `labby server remove`

```text
Remove an upstream server and reconcile runtime state

Usage: labby server remove [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server test`

```text
Actively test a configured upstream without saving changes

Usage: labby server test [OPTIONS] <NAME>

Arguments:
  <NAME>
          Name of the configured upstream to test

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server status`

```text
Report all upstream runtime states, discovery counts, and stale processes

Usage: labby server status [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server enable`

```text
Enable an upstream for new sessions

Usage: labby server enable [OPTIONS] [NAMES]...

Arguments:
  [NAMES]...
          Explicit upstream names. Omitting names never means all servers

Options:
      --all
          Select all visible servers; restart selects enabled servers only

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --dry-run
          Inspect targets and show the proposed operation without changing them

      --cleanup
          Clean up old processes when disabling. Not valid when enabling

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --aggressive
          Use broader process cleanup matching; requires --cleanup

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server disable`

```text
Disable an upstream, optionally cleaning up its processes

Usage: labby server disable [OPTIONS] [NAMES]...

Arguments:
  [NAMES]...
          Explicit upstream names. Omitting names never means all servers

Options:
      --all
          Select all visible servers; restart selects enabled servers only

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --dry-run
          Inspect targets and show the proposed operation without changing them

      --cleanup
          Clean up old processes when disabling. Not valid when enabling

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --aggressive
          Use broader process cleanup matching; requires --cleanup

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server restart`

```text
Reconnect an enabled upstream and clean up its old runtime

Usage: labby server restart [OPTIONS] [NAMES]...

Arguments:
  [NAMES]...
          Explicit upstream names. Omitting names never means all servers

Options:
      --all
          Select all visible servers; restart selects enabled servers only

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --dry-run
          Inspect targets and show the proposed operation without changing them

      --timeout <TIMEOUT>
          Bound completion per server (1ms to 5m), for example 30s

          [default: 30s]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --no-wait
          Return an accepted result without waiting for restart completion

  -q, --quiet
          Suppress console logs, but always report command errors

      --aggressive
          Use broader host-wide matching when cleaning up the old runtime

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server cleanup`

```text
Preview or clean up processes associated with one upstream

Usage: labby server cleanup [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --aggressive


      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --dry-run


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server auth`

```text
Authenticate one upstream, not the operator's Labby account

Usage: labby server auth [OPTIONS] <COMMAND>

Commands:
  login   Begin upstream OAuth and open the authorization URL unless --no-browser is set
  status  Read the shared gateway credential status for one upstream
  logout  Clear one dedicated upstream credential. Shared provider revocation is under auth provider

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server auth login`

```text
Begin upstream OAuth and open the authorization URL unless --no-browser is set

Usage: labby server auth login [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --no-browser
          Print the authorization URL instead of launching a browser

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --wait
          Wait for OAuth completion

      --timeout <WAIT_TIMEOUT_SECS>
          Bound OAuth completion with explicit units, such as 120s or 2m

          [default: 120s]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server auth status`

```text
Read the shared gateway credential status for one upstream

Usage: labby server auth status [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server auth logout`

```text
Clear one dedicated upstream credential. Shared provider revocation is under auth provider

Usage: labby server auth logout [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server discover`

```text
Discover MCP configurations from installed editors without importing them

Usage: labby server discover [OPTIONS]

Options:
      --clients <CLIENTS>
          Limit scan to specific client kinds (comma-separated: cursor,claude-code,vscode,...)

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --include-existing
          Also show servers already present in the gateway config

      --explain
          Explain which clients and matching config paths produced the result

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server import`

```text
Import discovered upstreams, disabled by default

Usage: labby server import [OPTIONS]

Options:
      --all
          Import every discovered server not already in the gateway config

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --name <NAMES>
          Specific server names to import (space-separated)

      --clients <CLIENTS>
          Limit discovery to specific client kinds (comma-separated)

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

  -y, --yes
          Skip confirmation for the destructive config import

      --dry-run
          Preview the import plan without changing gateway configuration

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server pending`

```text
Approve or reject discovered servers

Usage: labby server pending [OPTIONS] <COMMAND>

Commands:
  list     List discovered servers waiting for approval
  approve  Approve a pending server and add it to the gateway (disabled by default)
  reject   Reject a pending server and tombstone it so it never re-appears

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server pending list`

```text
List discovered servers waiting for approval

Usage: labby server pending list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server pending approve`

```text
Approve a pending server and add it to the gateway (disabled by default)

Usage: labby server pending approve [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

  -y, --yes
          Skip the destructive-action confirmation prompt

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --dry-run
          Print what would be done without executing

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server pending reject`

```text
Reject a pending server and tombstone it so it never re-appears

Usage: labby server pending reject [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

  -y, --yes
          Skip the destructive-action confirmation prompt

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --dry-run
          Print what would be done without executing

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server quarantine`

```text
Inspect or restore quarantined virtual servers

Usage: labby server quarantine [OPTIONS] <COMMAND>

Commands:
  list     List Labby-backed virtual servers quarantined during config migration
  restore  Restore a quarantined Labby-backed virtual server into the active gateway list

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server quarantine list`

```text
List Labby-backed virtual servers quarantined during config migration

Usage: labby server quarantine list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby server quarantine restore`

```text
Restore a quarantined Labby-backed virtual server into the active gateway list

Usage: labby server quarantine restore [OPTIONS] <ID>

Arguments:
  <ID>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby route`

```text
Manage public protected MCP routes. Use replace for full configuration replacement

Usage: labby route [OPTIONS] <COMMAND>

Commands:
  list     List Gateway-managed public MCP routes protected by Labby OAuth
  get      Get one Gateway-managed protected MCP route
  add      Add a Gateway-managed protected MCP route
  replace  Replace a Gateway-managed protected MCP route
  remove   Remove a Gateway-managed protected MCP route
  test     Validate a proposed protected MCP route without saving it

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby route list`

```text
List Gateway-managed public MCP routes protected by Labby OAuth

Usage: labby route list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby route get`

```text
Get one Gateway-managed protected MCP route

Usage: labby route get [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby route add`

```text
Add a Gateway-managed protected MCP route

Usage: labby route add [OPTIONS] --public-host <PUBLIC_HOST> --public-path <PUBLIC_PATH> <NAME>

Arguments:
  <NAME>
          Unique route name

Options:
      --enabled


      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --public-host <PUBLIC_HOST>


      --public-path <PUBLIC_PATH>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --upstream <UPSTREAM>


      --backend-url <BACKEND_URL>


      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --scope <SCOPES>


      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --health-path <HEALTH_PATH>


      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --gateway-subset
          Expose a scoped Labby gateway MCP surface instead of proxying one backend

      --project-id <PROJECT_ID>
          Bind this gateway subset to an access-control project

      --loadout <LOADOUT>
          Reuse a named Loadout for this gateway subset. Cannot be combined with inline target fields

      --target-upstream <TARGET_UPSTREAM>
          Upstream names to expose for --gateway-subset. Repeat or comma-separate

      --target-service <TARGET_SERVICE>
          Built-in Labby service names to expose for --gateway-subset. Repeat or comma-separate

      --expose-code-mode
          Expose codemode on this gateway subset

      --stage-for-restart
          Persist this route for the next Labby restart instead of attempting a hot route mount

  -h, --help
          Print help
```

## `labby route replace`

```text
Replace a Gateway-managed protected MCP route

Usage: labby route replace [OPTIONS] --public-host <PUBLIC_HOST> --public-path <PUBLIC_PATH> <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --new-name <NEW_NAME>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --enabled <ENABLED>
          [possible values: true, false]

      --public-host <PUBLIC_HOST>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --public-path <PUBLIC_PATH>


  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --upstream <UPSTREAM>


      --backend-url <BACKEND_URL>


      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --scope <SCOPES>


      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --health-path <HEALTH_PATH>


      --gateway-subset
          Expose a scoped Labby gateway MCP surface instead of proxying one backend

      --project-id <PROJECT_ID>
          Bind this gateway subset to an access-control project

      --clear-project-id
          Explicitly remove the existing access-control project binding

      --loadout <LOADOUT>
          Reuse a named Loadout for this gateway subset. Cannot be combined with inline target fields

      --target-upstream <TARGET_UPSTREAM>
          Upstream names to expose for --gateway-subset. Repeat or comma-separate

      --target-service <TARGET_SERVICE>
          Built-in Labby service names to expose for --gateway-subset. Repeat or comma-separate

      --expose-code-mode
          Expose codemode on this gateway subset

      --stage-for-restart
          Persist this route change for the next Labby restart instead of attempting a hot route mutation

  -h, --help
          Print help
```

## `labby route remove`

```text
Remove a Gateway-managed protected MCP route

Usage: labby route remove [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --stage-for-restart
          Persist a gateway-subset removal for the next Labby restart

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby route test`

```text
Validate a proposed protected MCP route without saving it

Usage: labby route test [OPTIONS] --public-host <PUBLIC_HOST> --public-path <PUBLIC_PATH> <NAME>

Arguments:
  <NAME>
          Unique route name

Options:
      --enabled


      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --public-host <PUBLIC_HOST>


      --public-path <PUBLIC_PATH>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --upstream <UPSTREAM>


      --backend-url <BACKEND_URL>


      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --scope <SCOPES>


      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --health-path <HEALTH_PATH>


      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --gateway-subset
          Expose a scoped Labby gateway MCP surface instead of proxying one backend

      --project-id <PROJECT_ID>
          Bind this gateway subset to an access-control project

      --loadout <LOADOUT>
          Reuse a named Loadout for this gateway subset. Cannot be combined with inline target fields

      --target-upstream <TARGET_UPSTREAM>
          Upstream names to expose for --gateway-subset. Repeat or comma-separate

      --target-service <TARGET_SERVICE>
          Built-in Labby service names to expose for --gateway-subset. Repeat or comma-separate

      --expose-code-mode
          Expose codemode on this gateway subset

      --stage-for-restart
          Persist this route for the next Labby restart instead of attempting a hot route mount

  -h, --help
          Print help
```

## `labby loadout`

```text
Manage reusable capability loadouts. set patches supplied fields only

Usage: labby loadout [OPTIONS] <COMMAND>

Commands:
  list    List configured Loadouts
  get     Get one Loadout
  add     Add a reusable Loadout
  set     Patch selected Loadout fields without resetting unspecified fields
  remove  Remove an unreferenced Loadout

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby loadout list`

```text
List configured Loadouts

Usage: labby loadout list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby loadout get`

```text
Get one Loadout

Usage: labby loadout get [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby loadout add`

```text
Add a reusable Loadout

Usage: labby loadout add [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --description <DESCRIPTION>


      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --upstream <UPSTREAMS>
          Upstream names selected by this Loadout. Repeat or comma-separate

      --service <SERVICES>
          Built-in Labby services selected by this Loadout. Repeat or comma-separate

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --no-tools
          Hide direct MCP Tools on this Loadout

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --no-resources
          Hide MCP Resources on this Loadout. Skills require Resources

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --no-prompts
          Hide MCP Prompts on this Loadout

      --no-skills
          Hide Agent Skills on this Loadout

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --code-mode
          Expose Code Mode on this Loadout

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby loadout set`

```text
Patch selected Loadout fields without resetting unspecified fields

Usage: labby loadout set [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --new-name <NEW_NAME>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --description <DESCRIPTION>


      --clear-description


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --upstream <UPSTREAMS>
          Replace upstream selection. Repeat or comma-separate

      --clear-upstreams
          Clear all selected upstreams

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --service <SERVICES>
          Replace service selection. Repeat or comma-separate

      --clear-services
          Clear all selected built-in services

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --expose-tools <EXPOSE_TOOLS>
          [possible values: true, false]

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --expose-resources <EXPOSE_RESOURCES>
          [possible values: true, false]

      --expose-prompts <EXPOSE_PROMPTS>
          [possible values: true, false]

      --expose-skills <EXPOSE_SKILLS>
          [possible values: true, false]

      --expose-code-mode <EXPOSE_CODE_MODE>
          [possible values: true, false]

      --stage-for-restart
          Stage this Loadout patch for the next Labby restart. Required when the Loadout is mounted by an enabled protected route

  -h, --help
          Print help
```

## `labby loadout remove`

```text
Remove an unreferenced Loadout

Usage: labby loadout remove [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --stage-for-restart
          Stage removal for restart after protected-route references have been staged away

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code`

```text
Execute Code Mode and manage its settings, UI, and upstream hints

Usage: labby code [OPTIONS] <COMMAND>

Commands:
  search    Search the Code Mode catalog without constructing a JavaScript payload
  describe  Inspect a catalog entry's schema before using it
  status    Read gateway-wide Code Mode settings
  catalog   Configure the sources and artifact families included by Code Mode search
  enable    Enable the gateway codemode MCP surface
  disable   Disable the gateway codemode MCP surface
  ui        Manage the explicit Code Mode MCP App UI while keeping text execution available
  run       Execute a sandboxed JavaScript snippet that calls the typed `codemode.<upstream>.<tool>` helpers (or `callTool` directly)
  hints     Preview and approve upstream metadata hints

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code search`

```text
Search the Code Mode catalog without constructing a JavaScript payload

Usage: labby code search [OPTIONS] <QUERY>

Arguments:
  <QUERY>
          Metadata search query

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --limit <LIMIT>
          Maximum number of results, from 1 through 50

          [default: 10]

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code describe`

```text
Inspect a catalog entry's schema before using it

Usage: labby code describe [OPTIONS] <PATH>

Arguments:
  <PATH>
          Qualified catalog path returned by code search

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code status`

```text
Read gateway-wide Code Mode settings

Usage: labby code status [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code catalog`

```text
Configure the sources and artifact families included by Code Mode search

Usage: labby code catalog [OPTIONS] <COMMAND>

Commands:
  status  Read the effective Code Mode search policy
  set     Patch the effective Code Mode search policy without restarting the server

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code catalog status`

```text
Read the effective Code Mode search policy

Usage: labby code catalog status [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code catalog set`

```text
Patch the effective Code Mode search policy without restarting the server

Usage: labby code catalog set [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --source <SOURCES>
          Include a search source. Repeat or pass a comma-separated list

          [possible values: personal_labby, team_depot, public_depot]

      --clear-sources
          Disable every search source

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --kind <KINDS>
          Include an artifact family. Repeat or pass a comma-separated list

          [possible values: tool, skill, command, prompt, subagent, snippet]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --clear-kinds
          Disable every artifact family

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code enable`

```text
Enable the gateway codemode MCP surface

Usage: labby code enable [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code disable`

```text
Disable the gateway codemode MCP surface

Usage: labby code disable [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code ui`

```text
Manage the explicit Code Mode MCP App UI while keeping text execution available

Usage: labby code ui [OPTIONS] <COMMAND>

Commands:
  status   Read whether the explicit Code Mode MCP App UI is enabled
  enable   Enable the explicit Code Mode MCP App UI
  disable  Disable the explicit Code Mode MCP App UI without disabling Code Mode

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code ui status`

```text
Read whether the explicit Code Mode MCP App UI is enabled

Usage: labby code ui status [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code ui enable`

```text
Enable the explicit Code Mode MCP App UI

Usage: labby code ui enable [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code ui disable`

```text
Disable the explicit Code Mode MCP App UI without disabling Code Mode

Usage: labby code ui disable [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code run`

```text
Execute a sandboxed JavaScript snippet that calls the typed `codemode.<upstream>.<tool>` helpers (or `callTool` directly)

Usage: labby code run [OPTIONS]

Options:
      --code <CODE>


      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --file <FILE>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code hints`

```text
Preview and approve upstream metadata hints

Usage: labby code hints [OPTIONS] <COMMAND>

Commands:
  preview  Generate and preview metadata suggestions before applying them
  apply    Apply an explicitly approved, hash-bound metadata suggestion

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code hints preview`

```text
Generate and preview metadata suggestions before applying them

Usage: labby code hints preview [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --upstream <UPSTREAMS>


      --all


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --provider <PROVIDER>
          [default: deterministic]
          [possible values: deterministic, claude, codex]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --max-upstreams <MAX_UPSTREAMS>


  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --timeout <TIMEOUT_MS>
          Maximum duration, with a unit such as 30s or 2m

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

  -y, --yes
          Skip confirmation for provider-backed preview runs

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby code hints apply`

```text
Apply an explicitly approved, hash-bound metadata suggestion

Usage: labby code hints apply [OPTIONS] --upstream <UPSTREAM> --hint <HINT> --metadata-hash <METADATA_HASH>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --upstream <UPSTREAM>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --hint <HINT>


      --metadata-hash <METADATA_HASH>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

  -y, --yes


      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby snippet`

```text
Manage saved executable snippets in the local installation

Usage: labby snippet [OPTIONS] <COMMAND>

Commands:
  list      List built-in and user snippets
  get       Show one snippet body and metadata
  run       Execute a snippet through gateway Code Mode
  add       Add a user snippet. Existing snippets require explicit --force replacement
  validate  Validate a snippet without saving or executing it
  remove    Remove a user snippet
  test      Test with deterministic fixtures; use --live to contact upstreams
  fixture   Generate an editable fixture from tool schemas without executing tools

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby snippet list`

```text
List built-in and user snippets

Usage: labby snippet list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby snippet get`

```text
Show one snippet body and metadata

Usage: labby snippet get [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby snippet run`

```text
Execute a snippet through gateway Code Mode

Usage: labby snippet run [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --param <KEY=VALUE>
          Input values passed to the snippet as key=value pairs

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby snippet add`

```text
Add a user snippet. Existing snippets require explicit --force replacement

Usage: labby snippet add [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --file <FILE>
          Read snippet body from a file

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --code <CODE>
          Inline snippet body

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --description <DESCRIPTION>
          Human-readable snippet description for generated frontmatter

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -f, --force
          Overwrite an existing user snippet

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby snippet validate`

```text
Validate a snippet without saving or executing it

Usage: labby snippet validate [OPTIONS] <NAME>

Arguments:
  <NAME>
          Existing snippet name or filename stem for --file/--code validation

Options:
      --file <FILE>
          Validate snippet body from a file instead of an existing snippet

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --code <CODE>
          Validate inline snippet body instead of an existing snippet

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby snippet remove`

```text
Remove a user snippet

Usage: labby snippet remove [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

  -y, --yes
          Confirm removal without prompting

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --no-confirm
          Alias for --yes

      --dry-run
          Show what would be removed without deleting it

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby snippet test`

```text
Test with deterministic fixtures; use --live to contact upstreams

Usage: labby snippet test [OPTIONS] [NAME]

Arguments:
  [NAME]


Options:
      --all
          Test every listed snippet using its sibling .test.json fixture

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --live
          Contact real upstreams instead of using fixtures

      --fixture <FIXTURE>
          Read a deterministic JSON fixture instead of the sibling .test.json file

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --param <KEY=VALUE>
          Input values passed to the snippet as key=value pairs

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby snippet fixture`

```text
Generate an editable fixture from tool schemas without executing tools

Usage: labby snippet fixture [OPTIONS] <NAME>

Arguments:
  <NAME>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --tool <TOOLS>
          Exact tool IDs for legacy snippets without declarations

      --check <CHECK>
          Compare current contracts with a saved fixture; never execute tools

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --schemas <SCHEMAS>
          Saved schema map keyed by upstream::tool; uses no gateway when supplied

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --results <RESULTS>
          Synthetic result overrides keyed by upstream::tool

      --no-input
          Never prompt for missing input or confirmation

      --variant <VARIANT>
          Populate optional fields and one array item, or generate minimal values

          [default: populated]
          [possible values: populated, minimal]

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --output <OUTPUT>
          Save the generated fixture to a new file; existing files are never overwritten

      --param <KEY=VALUE>


      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill`

```text
Read locally visible skills and manage daemon-backed upstream skill policy. Local reads do not grant access to shared or private artifact-backed skills; use an authenticated HTTP or MCP client for those.

Usage: labby skill [OPTIONS] <COMMAND>

Commands:
  list    List caller-visible Agent Skills without loading their bodies
  search  Search Agent Skills by name, description, and metadata
  get     Show one skill entry by published URI
  read    Read one manifest-bound skill file by published URI
  source  Manage daemon-backed upstream skill trust and exposure

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help (see a summary with '-h')
```

## `labby skill list`

```text
List caller-visible Agent Skills without loading their bodies

Usage: labby skill list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --origin <ORIGIN>
          Restrict results to one visible origin label

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --limit <LIMIT>
          Maximum number of entries to return

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill search`

```text
Search Agent Skills by name, description, and metadata

Usage: labby skill search [OPTIONS] <QUERY>

Arguments:
  <QUERY>
          Metadata search query

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --origin <ORIGIN>
          Restrict results to one visible origin label

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --limit <LIMIT>
          Maximum number of matches to return

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill get`

```text
Show one skill entry by published URI

Usage: labby skill get [OPTIONS] <URI>

Arguments:
  <URI>
          Published skill or skill-file URI

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill read`

```text
Read one manifest-bound skill file by published URI

Usage: labby skill read [OPTIONS] <URI>

Arguments:
  <URI>
          Published skill or skill-file URI

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill source`

```text
Manage daemon-backed upstream skill trust and exposure

Usage: labby skill source [OPTIONS] <COMMAND>

Commands:
  list      Report upstream skill support, trust, validation, and exposure
  trust     Trust an upstream's skill instructions and allow enumeration
  untrust   Stop trusting an upstream's skill instructions
  exposure  Manage a trusted upstream's skill exposure allowlist

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill source list`

```text
Report upstream skill support, trust, validation, and exposure

Usage: labby skill source list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --upstream <UPSTREAM>
          Limit the operator view to one upstream

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill source trust`

```text
Trust an upstream's skill instructions and allow enumeration

Usage: labby skill source trust [OPTIONS] <UPSTREAM>

Arguments:
  <UPSTREAM>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

  -y, --yes
          Skip the trust confirmation prompt

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill source untrust`

```text
Stop trusting an upstream's skill instructions

Usage: labby skill source untrust [OPTIONS] <UPSTREAM>

Arguments:
  <UPSTREAM>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill source exposure`

```text
Manage a trusted upstream's skill exposure allowlist

Usage: labby skill source exposure [OPTIONS] <COMMAND>

Commands:
  set    Replace the skill-name allowlist with explicit patterns
  clear  Clear the allowlist, exposing all validated skills from the trusted upstream

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill source exposure set`

```text
Replace the skill-name allowlist with explicit patterns

Usage: labby skill source exposure set [OPTIONS] --pattern <PATTERNS> <UPSTREAM>

Arguments:
  <UPSTREAM>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --pattern <PATTERNS>
          Exact skill name or wildcard pattern. Repeat to build the allowlist

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby skill source exposure clear`

```text
Clear the allowlist, exposing all validated skills from the trusted upstream

Usage: labby skill source exposure clear [OPTIONS] <UPSTREAM>

Arguments:
  <UPSTREAM>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby doctor`

```text
Audit configuration and dependencies without automatically repairing them

Usage: labby doctor [OPTIONS] [COMMAND]

Commands:
  auth    Check auth/OAuth configuration (env vars, files, permissions)
  relay   Check public OAuth callback relay registry and optionally target sockets
  proxy   Check public Lab and protected MCP proxy endpoints from caller-visible URLs
  system  Run local system checks (env vars, disk, toolchain)

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby doctor auth`

```text
Check auth/OAuth configuration (env vars, files, permissions)

Usage: labby doctor auth [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --live
          Explicitly probe the configured provider's discovery and JWKS endpoints

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby doctor relay`

```text
Check public OAuth callback relay registry and optionally target sockets

Usage: labby doctor relay [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --probe-targets
          Probe registered target sockets in addition to registry readiness

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby doctor proxy`

```text
Check public Lab and protected MCP proxy endpoints from caller-visible URLs

Usage: labby doctor proxy [OPTIONS]

Options:
      --app-url <APP_URL>
          Public Lab app URL, e.g. <https://lab.example.com> (default: LABBY_PUBLIC_URL)

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --mcp-url <MCP_URL>
          Public MCP gateway URL, e.g. <https://mcp.example.com> (default: LABBY_MCP_GATEWAY_URL)

      --route <ROUTE>
          Protected MCP public route path, e.g. /telemetry

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --backend-url <BACKEND_URL>
          Optional private backend origin for backend-leak probe, e.g. `http://mcp-backend:3100`

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby doctor system`

```text
Run local system checks (env vars, disk, toolchain)

Usage: labby doctor system [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby logs`

```text
Query bounded local process logs, or explicitly select the deployment journal

Usage: labby logs [OPTIONS]
       labby logs <COMMAND>

Commands:
  journal  Read the systemd deployment journal. Select --follow to stream; no rolling-file fallback

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

  -n, --lines <LINES>
          Maximum local log entries to return, from 1 through 1000

          [default: 200]

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --level <LEVEL>
          Filter by severity

          [possible values: error, warn, info, debug, trace]

      --service <SERVICE>
          Filter structured service names

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --action <ACTION>
          Filter structured action names

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --query <QUERY>
          Match text or a request ID across redacted fields

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --file <FILE>
          Restrict results to a matching rolling-log filename

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby logs journal`

```text
Read the systemd deployment journal. Select --follow to stream; no rolling-file fallback

Usage: labby logs journal [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

  -n, --lines <LINES>
          Maximum historical journal lines to print

          [default: 200]

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -f, --follow
          Stream new journal entries until interrupted. The default is a finite result

      --container <CONTAINER>
          Select an Incus deployment explicitly; otherwise use existing deployment detection

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby setup`

```text
Guide onboarding, check prerequisites, or explicitly repair local setup

Usage: labby setup [OPTIONS] [COMMAND]

Commands:
  clients  Detect or safely register selected external MCP clients on this computer
  state    Show the redacted setup and draft snapshot without changing configuration
  check    Check local setup prerequisites without mutating the filesystem
  repair   Repair missing local setup prerequisites without contacting external services

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --provision
          Provision this Ubuntu 26.04/Incus box for the Labby gateway

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --dry-run
          Print the default Incus/provisioning plan and do not mutate anything

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -y, --yes
          Confirm provisioning without prompting

  -q, --quiet
          Suppress console logs, but always report command errors

      --skip-deps
          Skip dependency installation offers for ChatGPT setup, or runtime installation when provisioning

      --no-input
          Never prompt for missing input or confirmation

      --role <ROLE>
          Configure server authentication or a client; server service installation requires --deployment

          [possible values: server, client]

      --chatgpt
          Connect ChatGPT to local Microsandbox sandboxes through Google OAuth and Tailscale Funnel

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --tailcat
          Prepare native dashboard access through Tailcat without installing a daemon

      --advanced
          Ask about deployment, listen address, port, and authentication instead of using local defaults

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --config-only
          Prepare server authentication in LABBY_HOME without installing or starting a service

      --deployment <DEPLOYMENT>
          Install a managed server explicitly: native service or isolated Incus container

          [possible values: native, incus]

      --host <HOST>
          Server listen address. Defaults to 127.0.0.1

      --port <PORT>
          Server listen or published port. Fresh local setup uses 8765 when available, otherwise an available port

      --server-url <SERVER_URL>
          Explicit Labby server URL for client mode

      --public-url <PUBLIC_URL>
          Public browser/OAuth URL for the server

      --auth <AUTH>
          Server authentication topology. Existing server invocations that pass --oauth google|authelia without --auth keep their historical OAuth + bearer break-glass behavior

          [possible values: bearer, oauth, both]

      --oauth <OAUTH>
          OAuth identity provider to configure during setup. Selects exactly one inbound provider

          [possible values: none, google, authelia]

      --clients <CLIENTS>
          Register selected installed MCP clients through Labby's protected local bridge

          [possible values: codex, claude-code]

      --desktop
          Install the Labby desktop app when a published package is available for this platform

      --no-desktop
          Do not install the Labby desktop app

  -h, --help
          Print help
```

## `labby setup clients`

```text
Detect or safely register selected external MCP clients on this computer

Usage: labby setup clients [OPTIONS] <COMMAND>

Commands:
  bridge    Serve stdio MCP using the protected saved connection for exactly this gateway
  connect   Verify the selected connection and register selected local clients with backups
  list      Detect supported client executables and configuration files on this computer
  plan      Review registration using protected saved CLI credentials or client-owned OAuth
  register  Register Labby using the exact reviewed config version. Client use remains unverified

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby setup clients bridge`

```text
Serve stdio MCP using the protected saved connection for exactly this gateway

Usage: labby setup clients bridge [OPTIONS] --gateway-url <GATEWAY_URL> --state-root <STATE_ROOT>

Options:
      --gateway-url <GATEWAY_URL>


      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --state-root <STATE_ROOT>


      --client <CLIENT>
          [possible values: codex, claude-code]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby setup clients connect`

```text
Verify the selected connection and register selected local clients with backups

Usage: labby setup clients connect [OPTIONS] --clients <CLIENTS>

Options:
      --clients <CLIENTS>
          [possible values: codex, claude-code]

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --gateway-url <GATEWAY_URL>


      --connection <CONNECTION>
          [default: saved-cli]
          [possible values: saved-cli, oauth]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --state-root <STATE_ROOT>


      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby setup clients list`

```text
Detect supported client executables and configuration files on this computer

Usage: labby setup clients list [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby setup clients plan`

```text
Review registration using protected saved CLI credentials or client-owned OAuth

Usage: labby setup clients plan [OPTIONS] --client <CLIENT> --gateway-url <GATEWAY_URL>

Options:
      --client <CLIENT>
          [possible values: codex, claude-code]

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --gateway-url <GATEWAY_URL>


      --connection <CONNECTION>
          [default: saved-cli]
          [possible values: saved-cli, oauth]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --state-root <STATE_ROOT>


      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby setup clients register`

```text
Register Labby using the exact reviewed config version. Client use remains unverified

Usage: labby setup clients register [OPTIONS] --client <CLIENT> --gateway-url <GATEWAY_URL> --expected-version <EXPECTED_VERSION>

Options:
      --client <CLIENT>
          [possible values: codex, claude-code]

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --gateway-url <GATEWAY_URL>


      --expected-version <EXPECTED_VERSION>


  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --connection <CONNECTION>
          [default: saved-cli]
          [possible values: saved-cli, oauth]

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --state-root <STATE_ROOT>


      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby setup state`

```text
Show the redacted setup and draft snapshot without changing configuration

Usage: labby setup state [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby setup check`

```text
Check local setup prerequisites without mutating the filesystem

Usage: labby setup check [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby setup repair`

```text
Repair missing local setup prerequisites without contacting external services

Usage: labby setup repair [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby tailcat`

```text
Pair an approved browser with local hardware sandbox tools

Usage: labby tailcat [OPTIONS] <COMMAND>

Commands:
  pair    Approve a browser key for the selected sandbox upstream
  status  Show local native session states without credentials or addresses
  stop    Stop one local session and retire its credential

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --socket <SOCKET>
          Explicit same-host control socket; no remote HTTP fallback

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby tailcat pair`

```text
Approve a browser key for the selected sandbox upstream

Usage: labby tailcat pair [OPTIONS] --credential-file <PATH>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --request <PATH>
          Browser-exported request JSON containing its public key and HTTPS origin

      --socket <SOCKET>
          Explicit same-host control socket; no remote HTTP fallback

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --rendezvous <RENDEZVOUS>
          HTTPS dashboard origin; the exchange code is requested privately

      --pairing-id <PAIRING_ID>
          Public dashboard pairing identifier

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --pair-code-stdin
          Read the private exchange code from stdin for noninteractive approval

  -q, --quiet
          Suppress console logs, but always report command errors

      --credential-file <PATH>
          Private project credential file, owned by the current user

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --output <PATH>
          New private delivery file to import into the requesting browser

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

  -y, --yes
          Explicitly approve the reviewed origin, peer key and sandbox upstream

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby tailcat status`

```text
Show local native session states without credentials or addresses

Usage: labby tailcat status [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --socket <SOCKET>
          Explicit same-host control socket; no remote HTTP fallback

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby tailcat stop`

```text
Stop one local session and retire its credential

Usage: labby tailcat stop [OPTIONS] <ID>

Arguments:
  <ID>


Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --socket <SOCKET>
          Explicit same-host control socket; no remote HTTP fallback

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host`

```text
Install, update, or operate the host service and its Incus deployment

Usage: labby host [OPTIONS] <COMMAND>

Commands:
  install  Install this binary into the current user's executable directory
  update   Update the host binary and, unless disabled, synchronize its Incus deployment
  service  Manage the host system service
  incus    Manage the Incus installation, binary synchronization, backups, and SSH trust

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host install`

```text
Install this binary into the current user's executable directory

Usage: labby host install [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host update`

```text
Update the host binary and, unless disabled, synchronize its Incus deployment

Usage: labby host update [OPTIONS]
       labby host update <COMMAND>

Commands:
  auto  Manage the daily native macOS update schedule

Options:
      --automatic
          Install a newer stable release on this host only (macOS Apple Silicon)

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --auto-update <AUTO_UPDATE>
          Enable, disable, or inspect daily native macOS updates

          [possible values: enable, disable, status]

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --version <VERSION>
          Release tag to install. Defaults to the latest GitHub release with a Labby binary asset

          [default: latest]

      --install-dir <INSTALL_DIR>
          Install directory for the host binary

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-incus-sync
          Do not sync the updated binary into an Incus container

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --no-web-assets
          Do not update or clear the Incus filesystem web asset directory

      --container <CONTAINER>
          Incus container name for the post-update sync

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --check-url <CHECK_URL>
          Optional public or host-bound URL to verify after the Incus sync

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --force-fallback
          Fall back to `incus stop --force && incus start` if the service restart path fails

      --no-force-fallback
          Disable the default Incus force-restart fallback after installing the release

      --dry-run
          Print what would happen without installing or syncing

  -h, --help
          Print help
```

## `labby host update auto`

```text
Manage the daily native macOS update schedule

Usage: labby host update auto [OPTIONS] <COMMAND>

Commands:
  enable   Enable daily native updates
  disable  Disable daily native updates
  status   Report the native update schedule

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --dry-run
          Preview the schedule change without installing or changing it

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host update auto enable`

```text
Enable daily native updates

Usage: labby host update auto enable [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host update auto disable`

```text
Disable daily native updates

Usage: labby host update auto disable [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host update auto status`

```text
Report the native update schedule

Usage: labby host update auto status [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host service`

```text
Manage the host system service

Usage: labby host service [OPTIONS] <COMMAND>

Commands:
  unit       Print the system unit that Labby would install
  install    Install and start labby.service as a system unit
  status     Read labby.service status
  restart    Restart labby.service
  rollback   Restore the verified release retained by the last --install-self upgrade
  uninstall  Stop, disable, and remove labby.service

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host service unit`

```text
Print the system unit that Labby would install

Usage: labby host service unit [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host service install`

```text
Install and start labby.service as a system unit

Usage: labby host service install [OPTIONS]

Options:
      --install-self
          Copy this labby binary into /usr/local/bin/labby before installing the service

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -y, --yes
          Confirm installation and service start

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host service status`

```text
Read labby.service status

Usage: labby host service status [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host service restart`

```text
Restart labby.service

Usage: labby host service restart [OPTIONS]

Options:
      --install-self
          Copy this labby binary into /usr/local/bin/labby before restarting the service

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -y, --yes
          Confirm service restart

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host service rollback`

```text
Restore the verified release retained by the last --install-self upgrade

Usage: labby host service rollback [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

  -y, --yes
          Confirm release rollback

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host service uninstall`

```text
Stop, disable, and remove labby.service

Usage: labby host service uninstall [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

  -y, --yes
          Confirm service removal

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host incus`

```text
Manage the Incus installation, binary synchronization, backups, and SSH trust

Usage: labby host incus [OPTIONS] <COMMAND>

Commands:
  setup   Bootstrap or converge the supported container
  sync    Synchronize a binary and optional assets, then verify the runtime
  backup  Validate or apply the container backup policy
  ssh     Bootstrap or verify container SSH trust

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host incus setup`

```text
Bootstrap or converge the supported container

Usage: labby host incus setup [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --name <NAME>
          Container name (default: labby)

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --image <IMAGE>
          Incus image alias (default: images:ubuntu/26.04)

      --profile-name <PROFILE_NAME>
          Incus profile name (default: labby-gateway)

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --backup-config <BACKUP_CONFIG>
          Incus snapshot policy YAML path; defaults to the embedded policy

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-backup-config
          Do not apply an Incus snapshot policy

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --runtime-profile-name <RUNTIME_PROFILE_NAME>
          Rootless profile for existing containers with a different root pool

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --storage-driver <STORAGE_DRIVER>
          Incus storage driver: zfs, btrfs, or dir

      --storage-pool <STORAGE_POOL>
          Incus storage pool used by the profile root disk

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --storage-source <STORAGE_SOURCE>
          Incus storage source path/dataset for the pool

      --version <VERSION>
          Labby release tag to install. Defaults to latest

          [default: latest]

      --local-binary <LOCAL_BINARY>
          Push a locally built labby binary instead of downloading a release

      --skip-install
          Use the labby binary already baked into the selected image

      --dry-run
          Print bootstrap commands only

      --tailscale-ssh
          Run tailscale up with --ssh when TS_AUTHKEY is set

      --tailscale-hostname <TAILSCALE_HOSTNAME>
          Hostname to register with Tailscale; defaults to the Incus container name

      --allow-source-fallback
          Allow install.sh cargo fallback if the release asset is unavailable

  -y, --yes
          Confirm bootstrap without prompting

  -h, --help
          Print help
```

## `labby host incus sync`

```text
Synchronize a binary and optional assets, then verify the runtime

Usage: labby host incus sync [OPTIONS]

Options:
      --container <CONTAINER>
          Incus container name. Defaults to LABBY_INCUS_CONTAINER, then labby, then a single running labby-* container

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --binary <BINARY>
          Local labby binary to install. Defaults to LABBY_INCUS_BINARY, target/debug/labby, then the current executable

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --web-assets-dir <WEB_ASSETS_DIR>
          Local static web export to sync. Defaults to LABBY_INCUS_WEB_ASSETS_DIR, then apps/web/out

      --no-web-assets
          Skip syncing static web assets into the container web asset directory

  -q, --quiet
          Suppress console logs, but always report command errors

      --check-url <CHECK_URL>
          Optional public or host-bound URL to verify after the service is ready

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --force-fallback
          Fall back to `incus stop --force && incus start` if the service restart path fails

      --no-force-fallback
          Disable the default Incus force-restart fallback

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --dry-run
          Print the resolved operation without mutating the container

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --rollback
          Restore the retained release that preceded the last successful sync

  -h, --help
          Print help
```

## `labby host incus backup`

```text
Validate or apply the container backup policy

Usage: labby host incus backup [OPTIONS] <COMMAND>

Commands:
  validate  Validate a backup policy YAML without mutating Incus
  apply     Apply a backup policy YAML to an Incus instance

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host incus backup validate`

```text
Validate a backup policy YAML without mutating Incus

Usage: labby host incus backup validate [OPTIONS]

Options:
      --config <CONFIG>
          Backup policy YAML to validate

          [default: .config/incus/labby-backup.yaml]

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host incus backup apply`

```text
Apply a backup policy YAML to an Incus instance

Usage: labby host incus backup apply [OPTIONS] --name <NAME>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --name <NAME>
          Incus container name

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --config <CONFIG>
          Backup policy YAML to apply

          [default: .config/incus/labby-backup.yaml]

      --dry-run
          Print the changes without mutating Incus

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

  -y, --yes
          Confirm applying the backup policy without prompting

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host incus ssh`

```text
Bootstrap or verify container SSH trust

Usage: labby host incus ssh [OPTIONS] <COMMAND>

Commands:
  bootstrap  Generate an id_ed25519 key in the container and authorize it on configured hosts
  verify     Verify container-side SSH access to configured hosts

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby host incus ssh bootstrap`

```text
Generate an id_ed25519 key in the container and authorize it on configured hosts

Usage: labby host incus ssh bootstrap [OPTIONS]

Options:
      --container <CONTAINER>
          Incus container name

          [default: labby]

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --user <USER>
          User inside the Incus container

          [default: labby]

      --ssh-config <SSH_CONFIG>
          Host SSH config to read

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --key-path <KEY_PATH>
          Private key path inside the container

  -q, --quiet
          Suppress console logs, but always report command errors

      --dry-run
          Print the plan without mutating the container or remote hosts

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --include <INCLUDE>
          Only process hosts whose alias or HostName matches this filter. Repeatable

      --exclude <EXCLUDE>
          Skip hosts whose alias or HostName matches this filter. Repeatable

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --fail-fast
          Abort on the first failed host instead of continuing and reporting failures

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --continue-on-error
          Continue past failed hosts and report them at the end (default)

      --install-config
          Install a sanitized SSH config into the container. Default for unfiltered runs

      --no-install-config
          Do not install a sanitized SSH config into the container. Default for filtered runs

      --timeout-seconds <TIMEOUT_SECONDS>
          SSH connection timeout in seconds

          [default: 10]

  -y, --yes
          Confirm remote authorized_keys updates

  -h, --help
          Print help
```

## `labby host incus ssh verify`

```text
Verify container-side SSH access to configured hosts

Usage: labby host incus ssh verify [OPTIONS]

Options:
      --container <CONTAINER>
          Incus container name

          [default: labby]

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --user <USER>
          User inside the Incus container

          [default: labby]

      --ssh-config <SSH_CONFIG>
          Host SSH config to read

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --key-path <KEY_PATH>
          Private key path inside the container

  -q, --quiet
          Suppress console logs, but always report command errors

      --include <INCLUDE>
          Only process hosts whose alias or HostName matches this filter. Repeatable

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --exclude <EXCLUDE>
          Skip hosts whose alias or HostName matches this filter. Repeatable

      --fail-fast
          Abort on the first failed host instead of continuing and reporting failures

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --continue-on-error
          Continue past failed hosts and report them at the end (default)

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --install-config
          Refresh the sanitized SSH config before verifying. Default for unfiltered runs

      --no-install-config
          Do not refresh the sanitized SSH config before verifying. Default for filtered runs

      --timeout-seconds <TIMEOUT_SECONDS>
          SSH connection timeout in seconds

          [default: 10]

  -h, --help
          Print help
```

## `labby config`

```text
Inspect setup state and manage drafts or proxy defaults

Usage: labby config [OPTIONS] <COMMAND>

Commands:
  show   Show the redacted host configuration snapshot without applying environment overrides
  check  Validate the host configuration without changing files or starting services
  draft  Manage the local setup draft
  proxy  Configure defaults for the ephemeral MCP proxy

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby config show`

```text
Show the redacted host configuration snapshot without applying environment overrides

Usage: labby config show [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby config check`

```text
Validate the host configuration without changing files or starting services

Usage: labby config check [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby config draft`

```text
Manage the local setup draft

Usage: labby config draft [OPTIONS] <COMMAND>

Commands:
  discard  Delete ~/.labby/.env.draft without modifying ~/.labby/.env

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby config draft discard`

```text
Delete ~/.labby/.env.draft without modifying ~/.labby/.env

Usage: labby config draft discard [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

  -y, --yes
          Confirm discard without prompting

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --dry-run
          Print what would be dispatched without executing

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby config proxy`

```text
Configure defaults for the ephemeral MCP proxy

Usage: labby config proxy [OPTIONS] <COMMAND>

Commands:
  set  Set proxy defaults; --dry-run previews the changes

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby config proxy set`

```text
Set proxy defaults; --dry-run previews the changes

Usage: labby config proxy set [OPTIONS]

Options:
      --exposure <EXPOSURE>
          Exposure mode to persist

          [possible values: tailscale, funnel, local]

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --auth <AUTH>
          Authentication mode to persist

          [possible values: tailnet, bearer, oauth, none]

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --path <PATH>
          MCP HTTP path to persist

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --port <PORT>
          External Tailscale port, or `random`

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --port-range-start <PORT_RANGE_START>
          First candidate in the random external-port range

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --port-range-end <PORT_RANGE_END>
          Last candidate in the random external-port range

      --bearer-token-env <BEARER_TOKEN_ENV>
          Environment key used for the proxy bearer secret

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --oauth-scope <OAUTH_SCOPES>
          OAuth scope to require; repeatable and replaces the configured list

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --inherit-env <INHERIT_ENV>
          Ambient environment variable inherited by child servers; repeatable

      --shutdown-grace <SHUTDOWN_GRACE_MS>
          Grace period before forced child shutdown, such as 500ms or 5s

      --bearer-token-stdin
          Read a bearer secret from stdin without echoing or persisting it in TOML

  -y, --yes
          Accept existing values and built-in defaults without prompting

      --dry-run
          Preview exact file changes without mutating config or secret files

  -h, --help
          Print help
```

## `labby state`

```text
Migrate, export, verify, or restore durable installation state offline

Usage: labby state [OPTIONS] <COMMAND>

Commands:
  access   Manage offline access-store migrations
  export   Export an authenticated disaster-recovery bundle using LABBY_RECOVERY_KEY_PATH
  verify   Verify a bundle's HMAC, schema, compatibility, paths, sizes, and digests
  restore  Restore an authenticated bundle offline using LABBY_RECOVERY_KEY_PATH

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby state access`

```text
Manage offline access-store migrations

Usage: labby state access [OPTIONS] <COMMAND>

Commands:
  migrate  Migrate the access store offline using verified migration evidence

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby state access migrate`

```text
Migrate the access store offline using verified migration evidence

Usage: labby state access migrate [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby state export`

```text
Export an authenticated disaster-recovery bundle using LABBY_RECOVERY_KEY_PATH

Usage: labby state export [OPTIONS] --output <OUTPUT>

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --output <OUTPUT>


      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby state verify`

```text
Verify a bundle's HMAC, schema, compatibility, paths, sizes, and digests

Usage: labby state verify [OPTIONS] --bundle <BUNDLE>

Options:
      --bundle <BUNDLE>


      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby state restore`

```text
Restore an authenticated bundle offline using LABBY_RECOVERY_KEY_PATH

Usage: labby state restore [OPTIONS] --bundle <BUNDLE>

Options:
      --bundle <BUNDLE>


      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby serve`

```text
Run the Labby HTTP runtime in the foreground

Usage: labby serve [OPTIONS] [COMMAND]

Commands:
  mcp  Run the MCP server over stdio instead of the default HTTP transport

Options:
      --auto-update
          Check daily for verified updates and exit after installation so a supervisor can restart Labby (macOS Apple Silicon)

      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --services <SERVICES>
          Comma- or space-separated list of services to enable. Empty = all

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --host <HOST>
          Bind host for the HTTP transport

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --port <PORT>
          Bind port for the HTTP transport

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --log-level <LOG_LEVEL>
          Override the log filter level for this process. Sets `LABBY_LOG=labby=<level>,warn` before tracing init. Example: `--log-level debug`

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby serve mcp`

```text
Run the MCP server over stdio instead of the default HTTP transport

Usage: labby serve mcp [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --stdio
          Confirm that MCP should run over stdio

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby mcp`

```text
Run the Labby stdio MCP transport. stdout contains protocol bytes only

Usage: labby mcp [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --services <SERVICES>
          Comma- or space-separated list of services to enable. Empty = all

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --log-level <LOG_LEVEL>
          Override the log filter level for this process. Sets `LABBY_LOG=labby=<level>,warn` before tracing init. Example: `--log-level debug`

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby proxy`

```text
Proxy a stdio upstream to Streamable HTTP

Usage: labby proxy [OPTIONS] [COMMAND]...

Arguments:
  [COMMAND]...
          Child program and arguments; otherwise discover .mcp.json in Labby home or beside the binary

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --port <PORT>
          Override the external port for this invocation

      --auth <AUTH>
          Override the configured auth policy

          [possible values: tailnet, bearer, oauth, none]

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

      --bearer-token <BEARER_TOKEN>
          One-run static bearer token; implies bearer auth

          [env: LABBY_PROXY_BEARER_TOKEN]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

      --bearer-token-stdin
          Read a one-run static bearer token from stdin; implies bearer auth

  -q, --quiet
          Suppress console logs, but always report command errors

      --local
          Override exposure to a local loopback URL

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --funnel
          Select OAuth and publish with Tailscale Funnel; preview callback if unconfigured

      --print-google-callback
          Print the Funnel MCP URL and Google callback without starting a proxy

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --mcp-json <PATH>
          Load local or remote servers from a .mcp.json mcpServers object

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

      --cwd <CWD>
          Child working directory

      --env <NAME=VALUE>
          Explicit child environment entry; repeatable

      --inherit-env <NAME>
          Inherit one ambient environment variable; repeatable

  -h, --help
          Print help
```

## `labby completions`

```text
Generate shell completions offline from the same command tree

Usage: labby completions [OPTIONS] [SHELL]
       labby completions <COMMAND>

Commands:
  query    Suggest from the command graph and a valid local cache; never contacts a gateway
  refresh  Explicitly refresh resource names for the selected gateway and authority
  clear    Remove only the selected authority's local resource-name cache

Arguments:
  [SHELL]
          Generate a script for this shell

          [possible values: bash, elvish, fish, powershell, zsh]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --resources
          Include offline, authority-scoped cached resource-name suggestions

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby completions query`

```text
Suggest from the command graph and a valid local cache; never contacts a gateway

Usage: labby completions query [OPTIONS] [-- <WORDS>...]

Arguments:
  [WORDS]...
          Words after labby, ending with the current partial word (which may be empty)

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby completions refresh`

```text
Explicitly refresh resource names for the selected gateway and authority

Usage: labby completions refresh [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```

## `labby completions clear`

```text
Remove only the selected authority's local resource-name cache

Usage: labby completions clear [OPTIONS]

Options:
      --json
          Emit machine-readable JSON. Diagnostics never enter stdout

      --color <COLOR>
          Control human-readable CLI styling

          [default: auto]
          [possible values: auto, plain, color]

  -v, --verbose...
          Include diagnostic events on stderr. Repeat for trace-level detail

  -q, --quiet
          Suppress console logs, but always report command errors

      --no-input
          Never prompt for missing input or confirmation

      --context <CONTEXT>
          Select a saved destination for a daemon-backed command. Never falls back locally

      --server <SERVER>
          Explicit Labby server URL; uses credentials bound to that destination

      --team-id <TEAM_ID>
          Select the Team authority context for team-scoped actions (sent as the x-labby-team-id header to the Labby daemon)

  -h, --help
          Print help
```