net-mesh-cli

net-mesh — the unified command-line interface for the NET mesh.

The non-interactive counterpart to net-deck: a one-shot tool for operator scripts, CI pipelines, daemon authoring, and ad-hoc cluster inspection. Same SDK underneath, same signed admin chain, no TUI.

net-mesh

Install

# pip
pip install net-mesh-cli

# uv
uv tool install net-mesh-cli

The wheel bundles the Rust net-mesh binary directly (built with maturin's bindings = "bin" mode) — pip install / uv tool install puts it on your $PATH with no compilation step and no Python shim layer.

Wheels are published for linux (glibc + musl, x86_64 + aarch64), macOS (x86_64 + aarch64), and Windows (x86_64 + aarch64). A source distribution is also published for any platform pip can't find a wheel for — that path needs a Rust toolchain.

Run

net-mesh --help

Subcommand surface

Subcommand	What it does
`version`	SDK version + build metadata.
`identity`	Generate / inspect / fingerprint operator identity files.
`up` / `down`	Start one long-lived node for the profile (foreground); drain and stop it.
`invite`	Create / inspect / list / revoke / approve / deny join links on `up --enroll`.
`join` / `leave`	Join a mesh from a link and run as it; leave it (local, durable).
`enrollment`	Enrollment ledger setup for `up --enroll`.
`relay`	Run a blind UDP relay (`serve`), the fallback path for unreachable devices.
`admin`	Offline previews or signed commits against a temporary supervisor.
`ice`	Simulate/commit break-glass operations against a temporary supervisor.
`snapshot`	One-shot substrate reads, both requiring `--local`: `get` prints the `MeshOsSnapshot`; `status` prints the typed `StatusSummary`.
`audit`	Read/stream the temporary supervisor's audit ring.
`log tail`	Substrate log stream (`--follow`, `--daemon`, `--min-level`).
`failures tail`	Substrate failure stream — same shape as `log tail`.
`cap`	Temporary snapshot reads; `announce` authors a signed artifact offline, not a broadcast.
`peer`	`ls` reads the temporary snapshot; no NAT-management verbs.
`daemon`	Per-daemon listing from the local snapshot.
`netdb`	NetDB local KV adapter — Cortex-backed tasks + memories.
`org`	Offline org root tools; org links (`invite` / `approve` / `join`), `remove`, `leave`, `members`.
`node`	`status` of this profile's node; ownership provisioning (`adopt`).
`subnet`	Offline authority issuance; subnet links (`invite` / `join`), `remove`, `leave`, `members`; temporary topology reads.
`gateway`	Temporary-context reads; `export` validates its arguments, then refuses: not supported yet.
`channel`	Offline `issue-grant`; standalone links (`invite` / `join`); `serve`, `status`, `publish`, `leave` on the running node; registry reads (`visibility`, `ls`).
`aggregator`	Temporary inspect/list with `--local`; remote query/spawn/scale and list selected by flags or profile. Remote verbs and `ls` support `--inspect-target`.
`transfer`	Receive/admin via mesh; send computes references or stages local content, not hosting or publication.
`wrap`	Wrap a local stdio MCP server as owner-only mesh capabilities (`--joined` runs as an enrolled device).
`mcp`	MCP bridge — expose mesh capabilities to a local MCP host (`serve`, `--joined`).
`forwarding`	Caller-side credential/header forwarding policy + audit (deny-by-default).
`typegen`	Generate typed language bindings from discovered tool descriptors.
`completion`	Emit a shell-completion script (`bash` / `zsh` / `fish` / `powershell`).
`man`	Emit the troff(1) man page on stdout.

Global flags

Applied to every subcommand; environment-variable fallbacks in brackets:

--config <path> [NET_MESH_CONFIG] — profile file (default $XDG_CONFIG_HOME/net-mesh/config.toml).
--profile <name> [NET_MESH_PROFILE] — named profile within the config file.
--insecure-config-permissions [NET_MESH_INSECURE_CONFIG_PERMISSIONS] — read the profile even when it is group/world-accessible or owned by another user.
--output (json|yaml|ndjson|table|text) — auto-detects table/text on TTY and json/ndjson off-TTY.
--quiet / -q — suppress stderr diagnostics.
--verbose / -v — -v info, -vv debug, -vvv trace. NET_MESH_LOG= env-filter overrides.
--no-color [NO_COLOR] — disable ANSI in table / text output.
--timeout <dur> — global per-call timeout (e.g. 500ms, 1h30m). Default 30s.

Config + identity

The profile file is optional — every flag has a sensible default. When present, it lives at $XDG_CONFIG_HOME/net-mesh/config.toml (or the platform equivalent) and looks like:

[default]
identity        = "~/.config/net-mesh/identity.toml"
endpoint        = "in-process"
default_timeout_ms = 30000

[profiles.prod]
identity   = "~/.config/net-mesh/ops-identity.toml"
node_addr  = "10.0.0.4:7700"
node_pubkey = "abcd…"      # 64 hex
psk_hex     = "1234…"      # 64 hex

Operator identity files are authored by net-mesh identity generate — ed25519 seed + public key + SHA-256 fingerprint, the same format the deck loads from the maintenance node. Every signed admin / ice command picks the identity up from the active profile (or --identity).

Exit codes

Typed via ExitCodeKind. Scripts can match on the discriminator:

0 — success
1 — generic error
2 — invalid arguments / parse error
3 — SDK error
4 — ICE simulation blocked
5 — operator-policy reject
6 — connection failure
7 — timeout
8 — confirmation refused
10 — daemon: factory id not registered
11 — db: query JSON failed to parse
12 — db: predicate DSL (--where / --filter) failed to parse
13 — ice: a supplied operator signature failed verification
14 — typegen diff --exit-code: a breaking schema change was detected

License

MIT OR Apache-2.0. See LICENSE-MIT and LICENSE-APACHE.

Metadata

Release files for net-mesh-cli 0.42.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for net-mesh-cli 0.42.0
File	Size	Uploaded
net_mesh_cli-0.42.0.tar.gz	10.5 MB	Oct 8, 2026	Details

Built distributions (wheels)

Table of built distributions (wheels) for net-mesh-cli 0.42.0
File	Interpreter	ABI	Platform	Reset
net_mesh_cli-0.42.0-py3-none-win_arm64.whl 5.6 MB Oct 8, 2026	Python 3	none	Windows ARM64	Details
net_mesh_cli-0.42.0-py3-none-win_amd64.whl 6.0 MB Oct 8, 2026	Python 3	none	Windows x86-64	Details
net_mesh_cli-0.42.0-py3-none-musllinux_1_2_x86_64.whl 6.3 MB Oct 8, 2026	Python 3	none	Linux musl 1.2+ x86-64	Details
net_mesh_cli-0.42.0-py3-none-musllinux_1_2_aarch64.whl 5.9 MB Oct 8, 2026	Python 3	none	Linux musl 1.2+ ARM64	Details
net_mesh_cli-0.42.0-py3-none-manylinux_2_28_x86_64.whl 6.3 MB Oct 8, 2026	Python 3	none	Linux glibc 2.28+ x86-64	Details
net_mesh_cli-0.42.0-py3-none-manylinux_2_28_aarch64.whl 5.9 MB Oct 8, 2026	Python 3	none	Linux glibc 2.28+ ARM64	Details
net_mesh_cli-0.42.0-py3-none-macosx_11_0_arm64.whl 5.5 MB Oct 8, 2026	Python 3	none	macOS 11.0+ ARM64	Details
net_mesh_cli-0.42.0-py3-none-macosx_10_12_x86_64.whl 6.1 MB Oct 8, 2026	Python 3	none	macOS 10.12+ x86-64	Details

Total release size: 58.1 MB

Release files / net_mesh_cli-0.42.0.tar.gz

Download URL	net_mesh_cli-0.42.0.tar.gz
Size	10.5 MB
Tags	Source
SHA-256 checksum How to use checksums	`264670001173d23efd8da4fdd524acc9d77710c3b952442923235e35ad63655e`
BLAKE2b-256 checksum How to use checksums	`9c7a608bf4272e208790cfd42dd2bfafdd98bc794c4763f078626d39ad558516`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / net_mesh_cli-0.42.0-py3-none-win_arm64.whl

Download URL	net_mesh_cli-0.42.0-py3-none-win_arm64.whl
Size	5.6 MB
Tags	Python 3 Windows ARM64
SHA-256 checksum How to use checksums	`bf5b45b5b02f17ea4845fa1ad623547f73a27600e3cbfd1bd70028e265dedfba`
BLAKE2b-256 checksum How to use checksums	`75a544a601f78e76904dc3d9a137551be785665fecf2411ed227457b602c44ea`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / net_mesh_cli-0.42.0-py3-none-win_amd64.whl

Download URL	net_mesh_cli-0.42.0-py3-none-win_amd64.whl
Size	6.0 MB
Tags	Python 3 Windows x86-64
SHA-256 checksum How to use checksums	`e3b69971ab1431a41eb6d4c816a1c4d3d99ab62c9f9150a9a5a85cb3ed000991`
BLAKE2b-256 checksum How to use checksums	`c9ddfa4f0bb425a559656c73653b8b26f8a70aefb7d5059370a686fbb0f03ad2`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / net_mesh_cli-0.42.0-py3-none-musllinux_1_2_x86_64.whl

Download URL	net_mesh_cli-0.42.0-py3-none-musllinux_1_2_x86_64.whl
Size	6.3 MB
Tags	Linux musl 1.2+ x86-64 Python 3
SHA-256 checksum How to use checksums	`5e7b43008a26a85c290dac8832112a6874c8855014fb7a9726fd050ba8979475`
BLAKE2b-256 checksum How to use checksums	`2543e733082e9b05ddc5d5deb9f5c2249ccf0a655ab81bf923042c3d5f56c29b`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / net_mesh_cli-0.42.0-py3-none-musllinux_1_2_aarch64.whl

Download URL	net_mesh_cli-0.42.0-py3-none-musllinux_1_2_aarch64.whl
Size	5.9 MB
Tags	Linux musl 1.2+ ARM64 Python 3
SHA-256 checksum How to use checksums	`23cc45e91917ea0c556af137ed60506a18d45d06eedb7aafdcdac4de8edfb67c`
BLAKE2b-256 checksum How to use checksums	`2778fb29c0841135ee14a912feaf5c7ab403b6c8432d09cd53d4415fea1c7351`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / net_mesh_cli-0.42.0-py3-none-manylinux_2_28_x86_64.whl

Download URL	net_mesh_cli-0.42.0-py3-none-manylinux_2_28_x86_64.whl
Size	6.3 MB
Tags	Linux glibc 2.28+ x86-64 Python 3
SHA-256 checksum How to use checksums	`2bda96518b8ecaa3839d6fa513add8b256b55a2910b9bc1111682ea044e62dd5`
BLAKE2b-256 checksum How to use checksums	`f7c3f011ee669f08dd5e9c2f6555a2a5fffcb7b94062fa1b9a8d181789ae9ee1`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / net_mesh_cli-0.42.0-py3-none-manylinux_2_28_aarch64.whl

Download URL	net_mesh_cli-0.42.0-py3-none-manylinux_2_28_aarch64.whl
Size	5.9 MB
Tags	Linux glibc 2.28+ ARM64 Python 3
SHA-256 checksum How to use checksums	`b2d454171edbb9d49f6d5120162bb1d6d05e7267acfa235fde9f703d083c94ed`
BLAKE2b-256 checksum How to use checksums	`40b1db74fc8a6c5d98e0d8e51b5353ac825a7f5c5d13892578d140e5713f5d07`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / net_mesh_cli-0.42.0-py3-none-macosx_11_0_arm64.whl

Download URL	net_mesh_cli-0.42.0-py3-none-macosx_11_0_arm64.whl
Size	5.5 MB
Tags	Python 3 macOS 11.0+ ARM64
SHA-256 checksum How to use checksums	`d690416e5cbe07ed0c56e10997bc85e849fa5c78fbcf0757f6290f4ee2d756a9`
BLAKE2b-256 checksum How to use checksums	`38f3ac1bae89bdf31afda167cccfdd768a233a1f9a6fef1ae3062e1b8d615e95`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / net_mesh_cli-0.42.0-py3-none-macosx_10_12_x86_64.whl

Download URL	net_mesh_cli-0.42.0-py3-none-macosx_10_12_x86_64.whl
Size	6.1 MB
Tags	Python 3 macOS 10.12+ x86-64
SHA-256 checksum How to use checksums	`28d8dd02718d3e6f31b245c735f1c2e5c36c05c0dcde69caba94f68dce70e2d5`
BLAKE2b-256 checksum How to use checksums	`94be06c16fbca057a9af9f7d1492831d133782fff3893c73cea2892da063a79b`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`