net-mesh-cli
net-mesh — the unified command-line interface for the NET mesh.
The non-interactive counterpart to net-deck: a one-shot tool for operator scripts, CI pipelines, daemon authoring, and ad-hoc cluster inspection. Same SDK underneath, same signed admin chain, no TUI.
Install
# pip
pip install net-mesh-cli
# uv
uv tool install net-mesh-cli
The wheel bundles the Rust net-mesh binary directly (built with maturin's bindings = "bin" mode) — pip install / uv tool install puts it on your $PATH with no compilation step and no Python shim layer.
Wheels are published for linux (glibc + musl, x86_64 + aarch64), macOS (x86_64 + aarch64), and Windows (x86_64 + aarch64). A source distribution is also published for any platform pip can't find a wheel for — that path needs a Rust toolchain.
Run
net-mesh --help
Subcommand surface
| Subcommand | What it does |
|---|---|
version |
SDK version + build metadata. |
identity |
Generate / inspect / fingerprint operator identity files. |
up / down |
Start one long-lived node for the profile (foreground); drain and stop it. |
invite |
Create / inspect / list / revoke / approve / deny join links on up --enroll. |
join / leave |
Join a mesh from a link and run as it; leave it (local, durable). |
enrollment |
Enrollment ledger setup for up --enroll. |
relay |
Run a blind UDP relay (serve), the fallback path for unreachable devices. |
admin |
Offline previews or signed commits against a temporary supervisor. |
ice |
Simulate/commit break-glass operations against a temporary supervisor. |
snapshot |
One-shot substrate reads, both requiring --local: get prints the MeshOsSnapshot; status prints the typed StatusSummary. |
audit |
Read/stream the temporary supervisor's audit ring. |
log tail |
Substrate log stream (--follow, --daemon, --min-level). |
failures tail |
Substrate failure stream — same shape as log tail. |
cap |
Temporary snapshot reads; announce authors a signed artifact offline, not a broadcast. |
peer |
ls reads the temporary snapshot; no NAT-management verbs. |
daemon |
Per-daemon listing from the local snapshot. |
netdb |
NetDB local KV adapter — Cortex-backed tasks + memories. |
org |
Offline org root tools; org links (invite / approve / join), remove, leave, members. |
node |
status of this profile's node; ownership provisioning (adopt). |
subnet |
Offline authority issuance; subnet links (invite / join), remove, leave, members; temporary topology reads. |
gateway |
Temporary-context reads; export validates its arguments, then refuses: not supported yet. |
channel |
Offline issue-grant; standalone links (invite / join); serve, status, publish, leave on the running node; registry reads (visibility, ls). |
aggregator |
Temporary inspect/list with --local; remote query/spawn/scale and list selected by flags or profile. Remote verbs and ls support --inspect-target. |
transfer |
Receive/admin via mesh; send computes references or stages local content, not hosting or publication. |
wrap |
Wrap a local stdio MCP server as owner-only mesh capabilities (--joined runs as an enrolled device). |
mcp |
MCP bridge — expose mesh capabilities to a local MCP host (serve, --joined). |
forwarding |
Caller-side credential/header forwarding policy + audit (deny-by-default). |
typegen |
Generate typed language bindings from discovered tool descriptors. |
completion |
Emit a shell-completion script (bash / zsh / fish / powershell). |
man |
Emit the troff(1) man page on stdout. |
Global flags
Applied to every subcommand; environment-variable fallbacks in brackets:
--config <path>[NET_MESH_CONFIG]— profile file (default$XDG_CONFIG_HOME/net-mesh/config.toml).--profile <name>[NET_MESH_PROFILE]— named profile within the config file.--insecure-config-permissions[NET_MESH_INSECURE_CONFIG_PERMISSIONS]— read the profile even when it is group/world-accessible or owned by another user.--output (json|yaml|ndjson|table|text)— auto-detectstable/texton TTY andjson/ndjsonoff-TTY.--quiet/-q— suppress stderr diagnostics.--verbose/-v—-vinfo,-vvdebug,-vvvtrace.NET_MESH_LOG=env-filter overrides.--no-color[NO_COLOR]— disable ANSI in table / text output.--timeout <dur>— global per-call timeout (e.g.500ms,1h30m). Default30s.
Config + identity
The profile file is optional — every flag has a sensible default. When present, it lives at $XDG_CONFIG_HOME/net-mesh/config.toml (or the platform equivalent) and looks like:
[default]
identity = "~/.config/net-mesh/identity.toml"
endpoint = "in-process"
default_timeout_ms = 30000
[profiles.prod]
identity = "~/.config/net-mesh/ops-identity.toml"
node_addr = "10.0.0.4:7700"
node_pubkey = "abcd…" # 64 hex
psk_hex = "1234…" # 64 hex
Operator identity files are authored by net-mesh identity generate — ed25519 seed + public key + SHA-256 fingerprint, the same format the deck loads from the maintenance node. Every signed admin / ice command picks the identity up from the active profile (or --identity).
Exit codes
Typed via ExitCodeKind. Scripts can match on the discriminator:
0— success1— generic error2— invalid arguments / parse error3— SDK error4— ICE simulation blocked5— operator-policy reject6— connection failure7— timeout8— confirmation refused10—daemon: factory id not registered11—db: query JSON failed to parse12—db: predicate DSL (--where/--filter) failed to parse13—ice: a supplied operator signature failed verification14—typegen diff --exit-code: a breaking schema change was detected
License
MIT OR Apache-2.0. See LICENSE-MIT and LICENSE-APACHE.
1 maintainer
Metadata
1 maintainer
Release files for net-mesh-cli 0.44.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| net_mesh_cli-0.44.1.tar.gz | 10.7 MB | Details |
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| net_mesh_cli-0.44.1-py3-none-win_arm64.whl | Python 3 | none | Windows ARM64 | Details |
| net_mesh_cli-0.44.1-py3-none-win_amd64.whl | Python 3 | none | Windows x86-64 | Details |
| net_mesh_cli-0.44.1-py3-none-musllinux_1_2_x86_64.whl | Python 3 | none | Linux musl 1.2+ x86-64 | Details |
| net_mesh_cli-0.44.1-py3-none-musllinux_1_2_aarch64.whl | Python 3 | none | Linux musl 1.2+ ARM64 | Details |
| net_mesh_cli-0.44.1-py3-none-manylinux_2_28_x86_64.whl | Python 3 | none | Linux glibc 2.28+ x86-64 | Details |
| net_mesh_cli-0.44.1-py3-none-manylinux_2_28_aarch64.whl | Python 3 | none | Linux glibc 2.28+ ARM64 | Details |
| net_mesh_cli-0.44.1-py3-none-macosx_11_0_arm64.whl | Python 3 | none | macOS 11.0+ ARM64 | Details |
| net_mesh_cli-0.44.1-py3-none-macosx_10_12_x86_64.whl | Python 3 | none | macOS 10.12+ x86-64 | Details |
Total release size: 58.4 MB
Release files / net_mesh_cli-0.44.1.tar.gz
| Download URL | net_mesh_cli-0.44.1.tar.gz |
|---|---|
| Size | 10.7 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
0172054fbe3dbc0da8c490e4012bdd77279db80a02f8bd914a6237c3e826cf1f
|
|
BLAKE2b-256 checksum How to use checksums |
0446249bb40594002b537aaacb1274bd303505b0b10cd2654a73761525db0f66
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.1-py3-none-win_arm64.whl
| Download URL | net_mesh_cli-0.44.1-py3-none-win_arm64.whl |
|---|---|
| Size | 5.6 MB |
| Tags | Python 3 Windows ARM64 |
|
SHA-256 checksum How to use checksums |
d72c806c925b0d418cd8d603592361cc8d0b590770b98a7d66256aa2adefadac
|
|
BLAKE2b-256 checksum How to use checksums |
be2deae3d1c733d9c87dab578bfc5c4d84d73a866c38ec9714f841f0236655d2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.1-py3-none-win_amd64.whl
| Download URL | net_mesh_cli-0.44.1-py3-none-win_amd64.whl |
|---|---|
| Size | 6.0 MB |
| Tags | Python 3 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
88c3c388b4634a42f715fbb77b2556cfb860ee183cb99d5025122e87374514cf
|
|
BLAKE2b-256 checksum How to use checksums |
68db7bf130eedce46680a6fde35248debf9e651cb8cf1183b176536cb4af8a95
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.1-py3-none-musllinux_1_2_x86_64.whl
| Download URL | net_mesh_cli-0.44.1-py3-none-musllinux_1_2_x86_64.whl |
|---|---|
| Size | 6.4 MB |
| Tags | Linux musl 1.2+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
e11322cff6bb1c34bcb803d3f535cb2aa2f1a9ce06a724b0be4dafe3cfa36d80
|
|
BLAKE2b-256 checksum How to use checksums |
ae420a5d8fac4eebd8eaf6c1e6553d24d33330465ad52028c3297c204b86fa07
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.1-py3-none-musllinux_1_2_aarch64.whl
| Download URL | net_mesh_cli-0.44.1-py3-none-musllinux_1_2_aarch64.whl |
|---|---|
| Size | 5.9 MB |
| Tags | Linux musl 1.2+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
c971602160ddb4dfd9626c9f996d43f20c4e2a8da5b36b34c281769157ee2d4e
|
|
BLAKE2b-256 checksum How to use checksums |
9df812491441b01c803dfe9e4026b08f257775790e48a078d990f57213f63c8f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.1-py3-none-manylinux_2_28_x86_64.whl
| Download URL | net_mesh_cli-0.44.1-py3-none-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 6.3 MB |
| Tags | Linux glibc 2.28+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
0ff2a223a4bb4b0b730fbcfb0b7cdc1e29b0aa7a1384a743abacb07cbf2281fb
|
|
BLAKE2b-256 checksum How to use checksums |
aaacaa884bf029718c941a88238edfce29920e529a8d677e2cf19c1850385b66
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.1-py3-none-manylinux_2_28_aarch64.whl
| Download URL | net_mesh_cli-0.44.1-py3-none-manylinux_2_28_aarch64.whl |
|---|---|
| Size | 5.9 MB |
| Tags | Linux glibc 2.28+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
027f452125cc281fffa36609391c416f154b0a13535bb88de28885699da55bc3
|
|
BLAKE2b-256 checksum How to use checksums |
df41f7dacbe0dff7848aaa0bacfc0ec67f6c2e9a05fab9ca8b3f26c6067588ef
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.1-py3-none-macosx_11_0_arm64.whl
| Download URL | net_mesh_cli-0.44.1-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 5.5 MB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
64772a1314d780093df88dcd9c16dced39829d28c997acc405fcdd26bebc7d0e
|
|
BLAKE2b-256 checksum How to use checksums |
60033380834f6772d886b45bff693489bd349d9a9ecc0643df124a30f8eaa146
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / net_mesh_cli-0.44.1-py3-none-macosx_10_12_x86_64.whl
| Download URL | net_mesh_cli-0.44.1-py3-none-macosx_10_12_x86_64.whl |
|---|---|
| Size | 6.1 MB |
| Tags | Python 3 macOS 10.12+ x86-64 |
|
SHA-256 checksum How to use checksums |
4bc230e6ee0eb212cc718f942bdcac8b2c9fa644669518a8a70392c7877a3331
|
|
BLAKE2b-256 checksum How to use checksums |
54b5427d6cfb8c8b77a56bf753507e1297fa10b25bc3ff4974107d34e0c8d0f5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
