net-mesh-cli
net-mesh — the unified command-line interface for the NET mesh.
The non-interactive counterpart to net-deck: a one-shot tool for operator scripts, CI pipelines, daemon authoring, and ad-hoc cluster inspection. Same SDK underneath, same signed admin chain, no TUI.
Install
# pip
pip install net-mesh-cli
# uv
uv tool install net-mesh-cli
The wheel bundles the Rust net-mesh binary directly (built with maturin's bindings = "bin" mode) — pip install / uv tool install puts it on your $PATH with no compilation step and no Python shim layer.
Wheels are published for linux (glibc + musl, x86_64 + aarch64), macOS (x86_64 + aarch64), and Windows (x86_64 + aarch64). A source distribution is also published for any platform pip can't find a wheel for — that path needs a Rust toolchain.
Run
net-mesh --help
Subcommand surface
| Subcommand | What it does |
|---|---|
version |
SDK version + build metadata. |
identity |
Generate / inspect / fingerprint operator identity files. |
up / down |
Start one long-lived node for the profile (foreground); drain and stop it. |
invite |
Create / inspect / list / revoke / approve / deny join links on up --enroll. |
join / leave |
Join a mesh from a link and run as it; leave it (local, durable). |
enrollment |
Enrollment ledger setup for up --enroll. |
relay |
Run a blind UDP relay (serve), the fallback path for unreachable devices. |
admin |
Offline previews or signed commits against a temporary supervisor. |
ice |
Simulate/commit break-glass operations against a temporary supervisor. |
snapshot |
One-shot substrate reads, both requiring --local: get prints the MeshOsSnapshot; status prints the typed StatusSummary. |
audit |
Read/stream the temporary supervisor's audit ring. |
log tail |
Substrate log stream (--follow, --daemon, --min-level). |
failures tail |
Substrate failure stream — same shape as log tail. |
cap |
Temporary snapshot reads; announce authors a signed artifact offline, not a broadcast. |
peer |
ls reads the temporary snapshot; no NAT-management verbs. |
daemon |
Per-daemon listing from the local snapshot. |
netdb |
NetDB local KV adapter — Cortex-backed tasks + memories. |
org |
Offline org root tools; org links (invite / approve / join), remove, leave, members. |
node |
status of this profile's node; ownership provisioning (adopt). |
subnet |
Offline authority issuance; subnet links (invite / join), remove, leave, members; temporary topology reads. |
gateway |
Temporary-context reads; export validates its arguments, then refuses: not supported yet. |
channel |
Offline issue-grant; standalone links (invite / join); serve, status, publish, leave on the running node; registry reads (visibility, ls). |
aggregator |
Temporary inspect/list with --local; remote query/spawn/scale and list selected by flags or profile. Remote verbs and ls support --inspect-target. |
transfer |
Receive/admin via mesh; send computes references or stages local content, not hosting or publication. |
wrap |
Wrap a local stdio MCP server as owner-only mesh capabilities (--joined runs as an enrolled device). |
mcp |
MCP bridge — expose mesh capabilities to a local MCP host (serve, --joined). |
forwarding |
Caller-side credential/header forwarding policy + audit (deny-by-default). |
typegen |
Generate typed language bindings from discovered tool descriptors. |
completion |
Emit a shell-completion script (bash / zsh / fish / powershell). |
man |
Emit the troff(1) man page on stdout. |
Global flags
Applied to every subcommand; environment-variable fallbacks in brackets:
--config <path>[NET_MESH_CONFIG]— profile file (default$XDG_CONFIG_HOME/net-mesh/config.toml).--profile <name>[NET_MESH_PROFILE]— named profile within the config file.--insecure-config-permissions[NET_MESH_INSECURE_CONFIG_PERMISSIONS]— read the profile even when it is group/world-accessible or owned by another user.--output (json|yaml|ndjson|table|text)— auto-detectstable/texton TTY andjson/ndjsonoff-TTY.--quiet/-q— suppress stderr diagnostics.--verbose/-v—-vinfo,-vvdebug,-vvvtrace.NET_MESH_LOG=env-filter overrides.--no-color[NO_COLOR]— disable ANSI in table / text output.--timeout <dur>— global per-call timeout (e.g.500ms,1h30m). Default30s.
Config + identity
The profile file is optional — every flag has a sensible default. When present, it lives at $XDG_CONFIG_HOME/net-mesh/config.toml (or the platform equivalent) and looks like:
[default]
identity = "~/.config/net-mesh/identity.toml"
endpoint = "in-process"
default_timeout_ms = 30000
[profiles.prod]
identity = "~/.config/net-mesh/ops-identity.toml"
node_addr = "10.0.0.4:7700"
node_pubkey = "abcd…" # 64 hex
psk_hex = "1234…" # 64 hex
Operator identity files are authored by net-mesh identity generate — ed25519 seed + public key + SHA-256 fingerprint, the same format the deck loads from the maintenance node. Every signed admin / ice command picks the identity up from the active profile (or --identity).
Exit codes
Typed via ExitCodeKind. Scripts can match on the discriminator:
0— success1— generic error2— invalid arguments / parse error3— SDK error4— ICE simulation blocked5— operator-policy reject6— connection failure7— timeout8— confirmation refused10—daemon: factory id not registered11—db: query JSON failed to parse12—db: predicate DSL (--where/--filter) failed to parse13—ice: a supplied operator signature failed verification14—typegen diff --exit-code: a breaking schema change was detected
License
MIT OR Apache-2.0. See LICENSE-MIT and LICENSE-APACHE.
1 maintainer
Metadata
1 maintainer
Release files for net-mesh-cli 0.40.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| net_mesh_cli-0.40.0.tar.gz | 10.4 MB | Details |
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| net_mesh_cli-0.40.0-py3-none-win_arm64.whl | Python 3 | none | Windows ARM64 | Details |
| net_mesh_cli-0.40.0-py3-none-win_amd64.whl | Python 3 | none | Windows x86-64 | Details |
| net_mesh_cli-0.40.0-py3-none-musllinux_1_2_x86_64.whl | Python 3 | none | Linux musl 1.2+ x86-64 | Details |
| net_mesh_cli-0.40.0-py3-none-musllinux_1_2_aarch64.whl | Python 3 | none | Linux musl 1.2+ ARM64 | Details |
| net_mesh_cli-0.40.0-py3-none-manylinux_2_28_x86_64.whl | Python 3 | none | Linux glibc 2.28+ x86-64 | Details |
| net_mesh_cli-0.40.0-py3-none-manylinux_2_28_aarch64.whl | Python 3 | none | Linux glibc 2.28+ ARM64 | Details |
| net_mesh_cli-0.40.0-py3-none-macosx_11_0_arm64.whl | Python 3 | none | macOS 11.0+ ARM64 | Details |
| net_mesh_cli-0.40.0-py3-none-macosx_10_12_x86_64.whl | Python 3 | none | macOS 10.12+ x86-64 | Details |
Total release size: 57.8 MB
Release files / net_mesh_cli-0.40.0.tar.gz
| Download URL | net_mesh_cli-0.40.0.tar.gz |
|---|---|
| Size | 10.4 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
61b54f93fff47f526a3bee4b69e8dffa183d575efd6bfcc0dc60ccf66e6eb8ef
|
|
BLAKE2b-256 checksum How to use checksums |
b5990c8ffbdd477c1ea4c096c8aa105a52579c90d79a3ad462dcfb6c2f72bd8f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.40.0-py3-none-win_arm64.whl
| Download URL | net_mesh_cli-0.40.0-py3-none-win_arm64.whl |
|---|---|
| Size | 5.6 MB |
| Tags | Python 3 Windows ARM64 |
|
SHA-256 checksum How to use checksums |
6f08740d04604c38edcee20089a36475a79b75c7623e926252bb747e97523cca
|
|
BLAKE2b-256 checksum How to use checksums |
70933d29b62964d55607eb801b235a13ef82bac75f2cc19f50b625234663ee07
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.40.0-py3-none-win_amd64.whl
| Download URL | net_mesh_cli-0.40.0-py3-none-win_amd64.whl |
|---|---|
| Size | 6.0 MB |
| Tags | Python 3 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
cf74188ed175ddc25858db88b3007d6f762d6722c78e139129e14aade47ef1ab
|
|
BLAKE2b-256 checksum How to use checksums |
4d38aba5ad729e37959a3d7eb903361a44c3390718cdd43c8d1c0ea6c5fa8ddb
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.40.0-py3-none-musllinux_1_2_x86_64.whl
| Download URL | net_mesh_cli-0.40.0-py3-none-musllinux_1_2_x86_64.whl |
|---|---|
| Size | 6.3 MB |
| Tags | Linux musl 1.2+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
a06a4ddc97b0c3646ea44146da786c267c094358ed1926e8d08a1435781d592a
|
|
BLAKE2b-256 checksum How to use checksums |
b78d0a36eea0a3e1dc76afd0c2b87e1451e59193a29c66e763244f16d2069c8e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.40.0-py3-none-musllinux_1_2_aarch64.whl
| Download URL | net_mesh_cli-0.40.0-py3-none-musllinux_1_2_aarch64.whl |
|---|---|
| Size | 5.9 MB |
| Tags | Linux musl 1.2+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
d5060ad8a0a2961abc03b838e62698fb715816a42b64f71f0d2ef7073833106e
|
|
BLAKE2b-256 checksum How to use checksums |
5bb26ca3951a545eadeada3a8db2da7e1a50b8909f6d913d2f7c411c19fb0424
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.40.0-py3-none-manylinux_2_28_x86_64.whl
| Download URL | net_mesh_cli-0.40.0-py3-none-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 6.2 MB |
| Tags | Linux glibc 2.28+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
ce8516da84db168ee32c5384073b2e1e46183267219d671dad1d363cab825e9e
|
|
BLAKE2b-256 checksum How to use checksums |
caf25c0bb486c7af4e11762ad20ff8d72058ad4d08d25a0631917eab8daf9631
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.40.0-py3-none-manylinux_2_28_aarch64.whl
| Download URL | net_mesh_cli-0.40.0-py3-none-manylinux_2_28_aarch64.whl |
|---|---|
| Size | 5.9 MB |
| Tags | Linux glibc 2.28+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
b07f7e4b20ef2d85dc5e26285dac0744b8b874e507cf7bb3375ba4fbaa23ffbe
|
|
BLAKE2b-256 checksum How to use checksums |
706c8a0d46279e7dbb9635ad64e6a313b687c8d6fe99a3e9a980124980bb46f1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.40.0-py3-none-macosx_11_0_arm64.whl
| Download URL | net_mesh_cli-0.40.0-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 5.5 MB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
32d850af6ba9968aef0446ee9083a8fa6ae654d5d34025a3ad5648f507a01591
|
|
BLAKE2b-256 checksum How to use checksums |
985f9d3a356cd671be0575b16a65cb48a28e961616d2ea8a3f529f7e553ac6c9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.40.0-py3-none-macosx_10_12_x86_64.whl
| Download URL | net_mesh_cli-0.40.0-py3-none-macosx_10_12_x86_64.whl |
|---|---|
| Size | 6.1 MB |
| Tags | Python 3 macOS 10.12+ x86-64 |
|
SHA-256 checksum How to use checksums |
1ff43e2975183e89bf1984095309864ed084fe84e0fc3cd25611dee455a2be4e
|
|
BLAKE2b-256 checksum How to use checksums |
ccf51a1a4f0c756d64b6191ea7651af20ee3b5fdbdcdbc4b41e1c4482d33d34a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
