net-mesh-cli
net-mesh — the unified command-line interface for the NET mesh.
The non-interactive counterpart to net-deck: a one-shot tool for operator scripts, CI pipelines, daemon authoring, and ad-hoc cluster inspection. Same SDK underneath, same signed admin chain, no TUI.
Install
# pip
pip install net-mesh-cli
# uv
uv tool install net-mesh-cli
The wheel bundles the Rust net-mesh binary directly (built with maturin's bindings = "bin" mode) — pip install / uv tool install puts it on your $PATH with no compilation step and no Python shim layer.
Wheels are published for linux (glibc + musl, x86_64 + aarch64), macOS (x86_64 + aarch64), and Windows (x86_64 + aarch64). A source distribution is also published for any platform pip can't find a wheel for — that path needs a Rust toolchain.
Run
net-mesh --help
Subcommand surface
| Subcommand | What it does |
|---|---|
version |
SDK version + build metadata. |
identity |
Generate / inspect / fingerprint operator identity files. |
up / down |
Start one long-lived node for the profile (foreground); drain and stop it. |
invite |
Create / inspect / list / revoke / approve / deny join links on up --enroll. |
join / leave |
Join a mesh from a link and run as it; leave it (local, durable). |
enrollment |
Enrollment ledger setup for up --enroll. |
relay |
Run a blind UDP relay (serve), the fallback path for unreachable devices. |
admin |
Offline previews or signed commits against a temporary supervisor. |
ice |
Simulate/commit break-glass operations against a temporary supervisor. |
snapshot |
One-shot substrate reads, both requiring --local: get prints the MeshOsSnapshot; status prints the typed StatusSummary. |
audit |
Read/stream the temporary supervisor's audit ring. |
log tail |
Substrate log stream (--follow, --daemon, --min-level). |
failures tail |
Substrate failure stream — same shape as log tail. |
cap |
Temporary snapshot reads; announce authors a signed artifact offline, not a broadcast. |
peer |
ls reads the temporary snapshot; no NAT-management verbs. |
daemon |
Per-daemon listing from the local snapshot. |
netdb |
NetDB local KV adapter — Cortex-backed tasks + memories. |
org |
Offline org root tools; org links (invite / approve / join), remove, leave, members. |
node |
status of this profile's node; ownership provisioning (adopt). |
subnet |
Offline authority issuance; subnet links (invite / join), remove, leave, members; temporary topology reads. |
gateway |
Temporary-context reads; export validates its arguments, then refuses: not supported yet. |
channel |
Offline issue-grant; standalone links (invite / join); serve, status, publish, leave on the running node; registry reads (visibility, ls). |
aggregator |
Temporary inspect/list with --local; remote query/spawn/scale and list selected by flags or profile. Remote verbs and ls support --inspect-target. |
transfer |
Receive/admin via mesh; send computes references or stages local content, not hosting or publication. |
wrap |
Wrap a local stdio MCP server as owner-only mesh capabilities (--joined runs as an enrolled device). |
mcp |
MCP bridge — expose mesh capabilities to a local MCP host (serve, --joined). |
forwarding |
Caller-side credential/header forwarding policy + audit (deny-by-default). |
typegen |
Generate typed language bindings from discovered tool descriptors. |
completion |
Emit a shell-completion script (bash / zsh / fish / powershell). |
man |
Emit the troff(1) man page on stdout. |
Global flags
Applied to every subcommand; environment-variable fallbacks in brackets:
--config <path>[NET_MESH_CONFIG]— profile file (default$XDG_CONFIG_HOME/net-mesh/config.toml).--profile <name>[NET_MESH_PROFILE]— named profile within the config file.--insecure-config-permissions[NET_MESH_INSECURE_CONFIG_PERMISSIONS]— read the profile even when it is group/world-accessible or owned by another user.--output (json|yaml|ndjson|table|text)— auto-detectstable/texton TTY andjson/ndjsonoff-TTY.--quiet/-q— suppress stderr diagnostics.--verbose/-v—-vinfo,-vvdebug,-vvvtrace.NET_MESH_LOG=env-filter overrides.--no-color[NO_COLOR]— disable ANSI in table / text output.--timeout <dur>— global per-call timeout (e.g.500ms,1h30m). Default30s.
Config + identity
The profile file is optional — every flag has a sensible default. When present, it lives at $XDG_CONFIG_HOME/net-mesh/config.toml (or the platform equivalent) and looks like:
[default]
identity = "~/.config/net-mesh/identity.toml"
endpoint = "in-process"
default_timeout_ms = 30000
[profiles.prod]
identity = "~/.config/net-mesh/ops-identity.toml"
node_addr = "10.0.0.4:7700"
node_pubkey = "abcd…" # 64 hex
psk_hex = "1234…" # 64 hex
Operator identity files are authored by net-mesh identity generate — ed25519 seed + public key + SHA-256 fingerprint, the same format the deck loads from the maintenance node. Every signed admin / ice command picks the identity up from the active profile (or --identity).
Exit codes
Typed via ExitCodeKind. Scripts can match on the discriminator:
0— success1— generic error2— invalid arguments / parse error3— SDK error4— ICE simulation blocked5— operator-policy reject6— connection failure7— timeout8— confirmation refused10—daemon: factory id not registered11—db: query JSON failed to parse12—db: predicate DSL (--where/--filter) failed to parse13—ice: a supplied operator signature failed verification14—typegen diff --exit-code: a breaking schema change was detected
License
MIT OR Apache-2.0. See LICENSE-MIT and LICENSE-APACHE.
1 maintainer
Metadata
1 maintainer
Release files for net-mesh-cli 0.44.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| net_mesh_cli-0.44.0.tar.gz | 10.7 MB | Details |
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| net_mesh_cli-0.44.0-py3-none-win_arm64.whl | Python 3 | none | Windows ARM64 | Details |
| net_mesh_cli-0.44.0-py3-none-win_amd64.whl | Python 3 | none | Windows x86-64 | Details |
| net_mesh_cli-0.44.0-py3-none-musllinux_1_2_x86_64.whl | Python 3 | none | Linux musl 1.2+ x86-64 | Details |
| net_mesh_cli-0.44.0-py3-none-musllinux_1_2_aarch64.whl | Python 3 | none | Linux musl 1.2+ ARM64 | Details |
| net_mesh_cli-0.44.0-py3-none-manylinux_2_28_x86_64.whl | Python 3 | none | Linux glibc 2.28+ x86-64 | Details |
| net_mesh_cli-0.44.0-py3-none-manylinux_2_28_aarch64.whl | Python 3 | none | Linux glibc 2.28+ ARM64 | Details |
| net_mesh_cli-0.44.0-py3-none-macosx_11_0_arm64.whl | Python 3 | none | macOS 11.0+ ARM64 | Details |
| net_mesh_cli-0.44.0-py3-none-macosx_10_12_x86_64.whl | Python 3 | none | macOS 10.12+ x86-64 | Details |
Total release size: 58.4 MB
Release files / net_mesh_cli-0.44.0.tar.gz
| Download URL | net_mesh_cli-0.44.0.tar.gz |
|---|---|
| Size | 10.7 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
03b3dfe98b82e34a2814c46d7ccb5f1d5f16f6a2adf6d17bb2916bc6b8a21437
|
|
BLAKE2b-256 checksum How to use checksums |
ef91669ba3db79ed2f9119f7d5a7761f90240a79934a7cb816e80466e04fbad5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.0-py3-none-win_arm64.whl
| Download URL | net_mesh_cli-0.44.0-py3-none-win_arm64.whl |
|---|---|
| Size | 5.6 MB |
| Tags | Python 3 Windows ARM64 |
|
SHA-256 checksum How to use checksums |
81f99c032742492b18eb180789de9260e152d172853035b3d590dd4cd5b4c80f
|
|
BLAKE2b-256 checksum How to use checksums |
1d63c263e0db884af38da2b74ba332b8bdf83f2cbc7f43cd0e578615463f2e12
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.0-py3-none-win_amd64.whl
| Download URL | net_mesh_cli-0.44.0-py3-none-win_amd64.whl |
|---|---|
| Size | 6.0 MB |
| Tags | Python 3 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
83dde3e19ffbdee55fd46d8a42a5613165cd6f0524ae1f6c2cf948bd5444cfc9
|
|
BLAKE2b-256 checksum How to use checksums |
a45a03c7d277359de0ff56ef9b7d675103c6c39fcdce9544695263a8b20e00d9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.0-py3-none-musllinux_1_2_x86_64.whl
| Download URL | net_mesh_cli-0.44.0-py3-none-musllinux_1_2_x86_64.whl |
|---|---|
| Size | 6.3 MB |
| Tags | Linux musl 1.2+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
9a0117f3a2e9545b7bbfb7899a8696bed92497bdc41c73abe9bbea4ce6e575d4
|
|
BLAKE2b-256 checksum How to use checksums |
152d89bdf24616d9cf797ee277a21430e5dd6b0c660dabdcf645d2bad4ce2157
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.0-py3-none-musllinux_1_2_aarch64.whl
| Download URL | net_mesh_cli-0.44.0-py3-none-musllinux_1_2_aarch64.whl |
|---|---|
| Size | 5.9 MB |
| Tags | Linux musl 1.2+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
0d7a2e374c0ec0273ed1793314b8531fdc526352c33ae3b70860da99d526c814
|
|
BLAKE2b-256 checksum How to use checksums |
e37f7e545fb7d9d649cbb64a9217dedca01a8d76fac11ae0cf12a2f53dec8498
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.0-py3-none-manylinux_2_28_x86_64.whl
| Download URL | net_mesh_cli-0.44.0-py3-none-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 6.3 MB |
| Tags | Linux glibc 2.28+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
eac13e43711e5cc6fdb790355e6ea61015aa3bf61cec0533b2a5775d7a712e74
|
|
BLAKE2b-256 checksum How to use checksums |
d5f041c401d4fa8e80c842ad502148387e0f67f1deb6c73b035e3d94cfaad27e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.0-py3-none-manylinux_2_28_aarch64.whl
| Download URL | net_mesh_cli-0.44.0-py3-none-manylinux_2_28_aarch64.whl |
|---|---|
| Size | 5.9 MB |
| Tags | Linux glibc 2.28+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
81e709e0dde1c5efa674c082170fc031e2b21116979a44ac5354cead89f93431
|
|
BLAKE2b-256 checksum How to use checksums |
bf8d0b2af5b2d2a3af7a822679e0278415d4a2fdb91f35862c0741ea74eb2a99
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.0-py3-none-macosx_11_0_arm64.whl
| Download URL | net_mesh_cli-0.44.0-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 5.5 MB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
8f69d436d7939b884eb620668f364644816f50bc54e55ebae1f4098b8ab884dd
|
|
BLAKE2b-256 checksum How to use checksums |
ab14a304e9c8916b8ba9f1502cc3854d29a296cf7c1eb2f87d10abba63eb3ac1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.0-py3-none-macosx_10_12_x86_64.whl
| Download URL | net_mesh_cli-0.44.0-py3-none-macosx_10_12_x86_64.whl |
|---|---|
| Size | 6.1 MB |
| Tags | Python 3 macOS 10.12+ x86-64 |
|
SHA-256 checksum How to use checksums |
e3f130bf8cf5e7f1cab9de0d9cfa1fabaef11cb8f19cf189fc698aeffb934e29
|
|
BLAKE2b-256 checksum How to use checksums |
d4435c186d691500cc0129f4822ac27dda9cb760f26877a18dee6d8ebb61d1da
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
