CLI reference

--json                         Print results as JSON (errors too, on stderr)
--yes                          Skip confirmations (required without a terminal)
MYBASE_API_URL, MYBASE_TOKEN   Override the saved server and token
Exit codes: 0 ok, 1 failure, 2 usage, 3 not signed in / bad token, 4 not found

login [--url <url>]            Sign in (saves an API token to ~/.config/mybase/config.json)
logout                         Revoke the saved token and forget it
whoami                         Show which server and account the CLI uses
version                        Show the CLI and server versions

server setup [--dir <dir>]     Install mybase on this machine: checks Docker, generates keys, sets up
                               LAN/Tailscale access, a Cloudflare Tunnel, start on boot, and the admin
  [--yes] [--public-host <h>] [--tunnel-token <t> --domain <d>] [--port <n>] [--no-autostart]
  [--admin-user <u> --admin-password-stdin]   Without a terminal: defaults plus these flags
  [--sandboxes]                Also install/configure gVisor and the sandbox worker automatically
server sandbox [--dir <dir>] [--yes] [--project <project>]
                               Set up sandbox host support; optionally enable it for a project
  [--deny-hosts <host,ip,…>] [--image <guest>] [--worker-image <worker>]
                               Public IP/hostnames, keys and release images are detected automatically
server registry [--dir <dir>] [--off]   Run the container registry here (docker push/pull per project)
server registry gc [--dir <dir>] [--untagged]   Free the disk space of deleted images (--untagged:
                               also untagged manifests; refused while hosting is on)
server hosting [--dir <dir>] [--domain <example.com>] [--cf-token <t>] [--dns-token <t>] | --off
                               Run sites here: registry, Caddy, and the hosting worker; with a tunnel,
                               routes *.<domain> and any other hostname to them (the Cloudflare token
                               isn't saved). --dns-token saves a DNS-only token (MYBASE_DNS_TOKEN) so
                               `mybase hosting domain add` can add custom domains' records
server status [--dir <dir>]    Containers, health, and whether mybase starts on boot
server update [--dir <dir>]    Download new images and restart (also refreshes compose.yml)
server restart [--dir <dir>]   Restart every container (API, Postgres, storage, cache, search, tunnel)
server logs [<service>…] [--dir <dir>]   Live logs (all services, or api|postgres|storage|cache|search|tunnel)
  [-f | --no-follow] [--tail <n>|all] [--since <10m|timestamp>] [--level warn] [--raw]
                               Follows in a terminal; without one prints the tail and exits
server tunnel [--dir <dir>]    Add or replace the Cloudflare Tunnel [--tunnel-token <t> --domain <d>] | --off
server database-public [--dir <dir>]   A normal postgres:// URL from anywhere: router port forward +
                               Let's Encrypt TLS + DNS kept on your IP (Cloudflare)
  [--host <db.domain> --dns-token <t> [--email <e>] [--staging]] | --off
server autostart on|off        Start mybase when this machine boots (and restart it after crashes)
server backup [--dir <dir>] [--out <file>]   Copy every project and its data into one file (.mbk)
  [--encrypt | --passphrase-stdin] [--no-cache]
                               The API stops while it's read. Without a passphrase the file holds
                               MYBASE_SECRETS_KEY and every database in the clear: keep it safe
server restore <file|-> [--dir <dir>] [--public-host <h>] [--passphrase-stdin] [--force] [--yes]
                               Rebuild an instance from a backup on a machine without one
                               (--force first deletes any mybase install and data already here)
server migrate receive [--dir <dir>] [--port 4100] [--public-host <h>] [--force] [--yes]
                               On the new machine: wait for an instance sent over the network
server migrate send <host[:port]> --code <code> [--dir <dir>] [--no-cache] [--yes]
                               On the old machine: send this instance (encrypted with the code),
                               then stop it here. Works between CPU types (Pi ↔ x86)
Default dir: the last one setup used, else ~/mybase

update [--version <v>] [--cli] [--yes]
                               Update this CLI to the latest release (or <v>), then the server on this
                               machine, if there is one. --cli: only the CLI

token list                     List API keys and what they may do
token create <name> (--perm <p,…> [--project <name,…>] [--env <env,…>] | --admin)
                               Make a key and print it once. <p>: <resource>:read|write,
                               resources: projects, database, storage, cron, analytics, cache, ratelimit, queue, search, secrets, vector, users, captcha, realtime, sandbox, registry, hosting, audit
                               --env limits secrets to those environments
token update <id> [--name <n>] [--perm <p,…>] [--project <name,…>|--all-projects]
       [--env <env,…>|--all-envs] [--admin]
token delete <id>              Revoke a key (it stops working now)

project create <name>          Create a new project (database + storage bucket)
project list                   List projects
project delete <name> [--yes]  Delete a project, its database, and all its files

context <project>              Services, connection details, tables, jobs, queues, env vars (no secrets)

doctor [<project>]             Security checks: the whole instance (admin key), or one project. Exits 1 on critical findings

audit [--project p] [--action auth|auth.login] [--outcome ok|denied|failed] [--since 24h|7d|<ISO date>] [--limit n] [--follow]
                               Recent audit log entries, newest first (--follow: keep printing new ones)
audit retention [<days>]       Show (or set, 7–365, admin key) how long entries are kept

alerts                         Alert channels and rules (admin key)
alerts add webhook|ntfy <url> [--name n] [--token t]  Send alerts to a webhook (signed) or an ntfy topic URL
alerts test <channel-id>       Send a test alert and wait for the result
alerts remove <channel-id> [--yes]  Stop sending alerts there
alerts rotate <channel-id>     New webhook signing secret
alerts rule <rule> on|off      Turn one rule on or off (rule ids: see `mybase alerts`)

docs                           List docs pages
docs <slug>                    Print a page as markdown (e.g. quickstart, queues, sdk/queues)
docs --search "<words>" [--limit 5]  Best matching sections, with links

mcp [--key-env MYBASE_API_KEY] Print MCP setup for Claude Code, Cursor, VS Code, and others

agent init [--project <name>] [--dir .] [--key] [--no-agents-md] [--no-skill] [--no-mcp]
                               Teach coding agents about mybase in an app repo: AGENTS.md notes,
                               a Claude skill, and .mcp.json. --key also makes a project-limited
                               API key and puts it in .env.local (only if git ignores it)

cron enable <project>          Turn on cron for a project and print its signing secret
cron disable <project> [--yes] Turn it off, deleting every job and its history
cron list <project>            List jobs
cron create <project> <name> --schedule "<cron>" --url <url>
       [--tz <zone>] [--retries <n>] [--timeout <ms>] [--payload '<json>'] [--paused]
cron delete <project> <name>   Delete a job
cron run <project> <name>      Run a job now
cron runs <project> <name>     Show a job's recent runs
cron tasks <project> [--status <status>]  List one-off tasks (newest first)
cron schedule <project> <job> --url <url> [--in 15m | --at <iso date>]
       [--key <key>] [--payload '<json>'] [--retries <n>] [--timeout <ms>]
                               Call <job> once (apps do this with createCronClient)
cron cancel <project> <task id | --key <key>>  Cancel a pending task
cron secret <project> [--rotate]  Show (or replace) the signing secret
cron sync [--config <file>] [--dry-run]  Make code-defined jobs match mybase.config.ts

analytics enable <project>     Turn on analytics and print the write key and snippets
analytics disable <project> [--yes]  Turn it off, deleting every recorded event
analytics key <project> [--rotate]   Show (or replace) the public write key
analytics stats <project> [--range 24h|7d|30d|90d]  Totals and top routes, events, errors

cache enable <project>         Turn on the cache and print its password and connection strings
cache disable <project> [--yes]  Turn it off, deleting every key
cache info <project>           Connection details, key count, and memory use
cache password <project> --rotate  Replace the password (the old one stops working now)

ratelimit enable <project>     Turn on rate limits
ratelimit disable <project> [--yes]  Turn them off, deleting every rule and counter
ratelimit rules <project>      List rules
ratelimit create <project> <name> --limit <n> --window <10s|1m|1h|…>
       [--algorithm sliding|fixed|token] [--burst <n>]
ratelimit delete <project> <name>  Delete a rule
ratelimit stats <project> [--range 24h|7d]  Allowed and blocked requests per rule
ratelimit sync [--config <file>] [--dry-run]  Make code-defined rules match mybase.config.ts

queue enable <project>         Turn on queues
queue disable <project> [--yes]  Turn them off, deleting every queue and message
queue list <project>           List queues with message counts
queue create <project> <name> [--fifo] [--visibility 30s] [--delay 0s] [--retention 4d]
       [--wait 0s] [--max-bytes <n>] [--content-dedup] [--dlq <queue> --max-receives <n>]
queue delete <project> <name> [--yes]  Delete a queue and its messages
queue purge <project> <name> [--yes]   Delete every message in a queue
queue send <project> <name> <body> [--group <id>] [--dedup <id>] [--delay 30s]
queue peek <project> <name> [--limit 20]  Show messages without receiving them
queue receive <project> <name> [--max 1] [--wait 0s] [--delete]  Receive (and optionally delete)
queue redrive <project> <dlq> [--to <queue>]  Move dead letters back to their queues
queue stats <project> [--range 24h|7d]  Sent, received, deleted, dead-lettered per queue
queue sync [--config <file>] [--dry-run] [--yes]  Make code-defined queues match mybase.config.ts

search enable <project>        Turn on web search (SearXNG) for apps and agents
search disable <project> [--yes]  Turn it off, clearing cached searches and pages

sandbox enable <project> [--setup-worker] [--dir <dir>] [--yes]
                               Enable isolated compute; --setup-worker configures the local host first
sandbox disable <project> [--yes]  Stop sandboxes and delete their artifacts
sandbox create <project> --key <key> [--ttl <seconds>] [--idle <seconds>]
sandbox list|get|usage <project> [<id>]
sandbox terminate <project> <id> [--yes]
sandbox exec <project> <id> --key <key> [--code file.js | --command '["node","script.js"]'] [--timeout <ms>]
sandbox runs|artifacts|browser <project> <id>
sandbox run <project> <id> <execution>
sandbox cancel <project> <id> <execution> [--yes]
sandbox upload|download <project> <id> <workspace-path> <local-file>
sandbox export <project> <id> <workspace-path> [--type image/png]
sandbox artifact <project> <id> <artifact-id> <local-file>
Creation/execution return promptly. Poll get/run. Cancelling execution terminates sandbox.
No default lifetime, idle expiry, or execution timeout. Set optional deadlines as needed.
Browser credentials expire after 30s; authenticated CDP connections have no fixed lifetime.

secrets enable <project>       Turn on secrets (dev, staging, prod to start)
secrets disable <project> [--yes]  Turn them off, deleting every env, value, and revision
secrets setup -p <project> -e <env>  Use this project + env in this directory (and below)
secrets envs                   List environments
secrets env create <name> [--from <root env>]  Create an env (a branch env with --from)
secrets env rename <name> <new name>
secrets env delete <name> [--yes]  Delete an env, its branch envs, and their history
secrets list [--values]        List keys (values hidden unless --values)
secrets get <KEY>              Print one value
secrets set <KEY=value>… [--message <m>]  Set keys (KEY=- reads the value from stdin)
secrets unset <KEY>… [--message <m>]
secrets upload <.env file> [--message <m>]  Set every key in a .env file
secrets history [--limit 20]   Revisions, newest first
secrets restore <revision> [--yes]  Put values back as they were after <revision>
secrets link --database|--cache|--storage|--api [--as <KEY>] [--yes]
                               Link keys to this project's own services: stored as references and
                               resolved for whoever reads the env (hosted sites: postgres:5432;
                               `mybase run`: the best address it reaches, else `db proxy`).
                               --database → DATABASE_URL, --cache → REDIS_URL, --storage → S3_*,
                               --api → MYBASE_URL + MYBASE_API_KEY
  [--route auto|internal|localhost|lan|tailscale|public|proxy]  Pin a route (default auto)
  [--sslmode disable|require|verify-full] [--param name=value]…  Database URL options
  [--rotate]                   New credentials even if mybase holds them
secrets link --env <env,…> [--yes]  (no service flags) Rotate the project's DB/S3/cache credentials
                               and store them as literal values in these envs, with every
                               service's keys (MYBASE_API_KEY, MYBASE_CRON_SECRET, …)
secrets unlink <KEY>…          Remove linked keys (nothing is rotated)
secrets unlink [--yes]         (no keys) Remove the `link --env` credentials from the env
secrets doctor [-e <env>] [--yes]  Find literal values that are this project's own credentials
                               (pasted connection strings) and offer to link them instead
                               `<service> enable` asks to add that service's keys to linked
                               envs (--link / --no-link to skip the question)
                               Project/env: -p/--project, -e/--env, else MYBASE_PROJECT/MYBASE_ENV,
                               else `secrets setup` for this directory

database access <project>      How the database is reached: hosting network, server, LAN, Tailscale,
                               public, WebSocket proxy (hosts and ports; no secrets)
  [--public on|off] [--yes]    Turn internet access on/off (runs `server database-public`, so on the
                               server; on also takes its --host/--dns-token/--email/--staging/--dir)

db proxy [-p <project>] [--port 5432]  Postgres on 127.0.0.1:<port>, tunnelled over the API's
                               WebSocket (wss://<api>/db): works with the Postgres port closed.
                               Connect with ?sslmode=disable. `mybase run` starts one by itself

vector enable <project>        Turn on vector + full-text search
vector disable <project> [--yes]  Turn it off, deleting every index and document
vector settings <project>      Show the embedding provider
vector embedding <project> --url <url> --model <m> --dims <n> [--key]  Set it (--key prompts for an API key)
vector embedding <project> --off  Remove it
vector list <project>          List indexes with document counts
vector create <project> <index> [--dims <n>] [--metric cosine|l2|ip] [--lang english] [--embed]
vector delete <project> <index> [--yes]  Delete an index and its documents
vector upsert <project> <index> <file.jsonl>  Upsert documents, one JSON object per line
vector documents <project> <index> [--limit 20] [--after <id>]  List documents in id order
vector query <project> <index> [<text>] [--mode text|vector|hybrid] [--top 10] [--filter <json>]
vector sync [--config <file>] [--dry-run] [--yes]  Make code-defined indexes match mybase.config.ts

users enable <project>         Turn on users: an auth schema for Better Auth, plus setup steps
users init <project> [--env <secrets env>]  Print an auth.ts for Better Auth; --env stores a new BETTER_AUTH_SECRET there
users list <project> [--search <text>]  The app's users, newest first
users show <project> <user-id>  One user: sign-in methods and active sessions
users revoke <project> <user-id> [<session-id>]  Sign a user out (one session, or everywhere)
users delete <project> <user-id> [--yes]  Delete a user and their sessions
users disable <project> [--yes]  Turn it off, deleting every user account

captcha enable <project>       Turn on the captcha and print the script tag and secret
captcha key <project> [--rotate]  Show (or replace) the secret your server checks tokens with
captcha difficulty <project> <n>  Numbers a browser may try per challenge (1000–1000000; default 50000)
captcha disable <project> [--yes]  Turn it off (forms that need it stop accepting submissions)

realtime enable <project>      Turn on realtime and print the socket URL and secret
realtime info <project>        Settings, connections, and messages in the last 24 hours
realtime key <project> [--rotate]  Show (or replace) the secret that signs browser tokens and webhooks
                               (rotating closes every open connection)
realtime settings <project> [--origins a,b|none] [--public on|off] [--webhook <url>|none]
                               [--events message,presence,channel] [--max-connections n]
                               [--max-channels n] [--max-message-bytes n] [--max-rate n]
realtime channels <project> [--prefix p]   Channels with subscribers right now
realtime publish <project> <channel> <event> [json]   Send a message to everyone subscribed
realtime disable <project> [--yes]  Turn it off (closes every connection)

registry enable <project>      Turn on the container registry (needs `mybase server registry` once)
registry info <project>        docker login instructions and the image prefix (<host>/<project>/<name>)
registry list <project>        Repositories and their tag counts
registry tags <project> <repo>  Tags of one repository: digest, size, platforms
registry delete <project> <repo> <digest> [--yes]  Delete an image (every tag pointing at it)
registry disable <project> [--yes]  Turn it off: every image in the project is deleted

hosting enable <project>       Turn on hosting (sites at <site>.<domain>; needs `mybase server hosting` once)
hosting sites <project>        List sites, their URLs, and the latest deploy
hosting create <project> <site> [--port 3000] [--health /]  Add a site (names are unique across projects)
hosting set <project> <site> [--port n] [--health /path] [--secrets-env <env> | --no-secrets-env]
  [--strict-env-check on|off]  Fail deploys whose env URLs (DATABASE_URL, …) the site can't reach (off: warn)
hosting env list|set|unset <project> <site> [KEY=VALUE… | KEY…]  The site's own env vars (applied on the next deploy)
hosting deploys <project> <site>  Deploy history
hosting redeploy <project> <site>  Restart the live image (picks up env changes)
hosting rollback <project> <site> [<deploy id>]  Go back to the previous (or a given) deploy
hosting logs <project> <site> [--deploy <id>] [--tail 200] [--no-follow]  Container output (after the
                               deploy's env warnings, if any)
hosting domains <project> <site>  The site's custom domains and their DNS status
hosting domain add <project> <site> <hostname> [--primary] [--replace]  Route another hostname (shop.com) to
                               the site; adds its proxied CNAME when the server has MYBASE_DNS_TOKEN.
                               --replace swaps an existing A/AAAA/CNAME record for it
hosting domain remove <project> <site> <hostname> [--yes]  Stop routing it (deletes the CNAME mybase made)
hosting domain primary <project> <site> <hostname> | --none  The site's URL and MYBASE_SITE_URL (redeploy after)
hosting domain verify <project> <site> <hostname> [--replace]  Try the DNS step again
hosting delete <project> <site> [--yes]  Remove a site, its containers, and its images
hosting init [--template nextjs|static|node] [--project p] [--site s]  Write a Dockerfile, .dockerignore, and mybase.config.ts
hosting disable <project> [--yes]  Turn hosting off: every site goes down
deploy [--project p] [--site s] [--config mybase.config.ts] [--no-wait]  Build here, push, and go live

run [-p <project>] [-e <env>] [--preserve-env] -- <command> [args…]
                               Start <command> with the env's secrets as env vars
                               (--preserve-env: vars already set win over secrets)