CLI Reference

anvil-serving is the operator interface for all six product families. This landing page maps user goals to focused references; the executable source of truth is anvil-serving product, and the exhaustive command surface comes from the validated manifest.

The cross-family grammar, safety, output, and portability rules are recorded in ADR-0021. The modular registry and its compact manifest contract are recorded in ADR-0029.

Command areas

Product discovery is the CLI's cross-family entry point; the remaining rows map to the six product families.

Area	Top-level verbs	Reference
Product discovery	product	Product discovery
Model Serving	init, models, serves	Models & recipes · Model serves
Capability Gateway	router	Router
Evaluation & Evidence	eval	Evaluation & benchmarks
Anvil Voice	voice	Voice
Anvil Media	media	Media
Control Plane & Fleet	fleet, harness, mcp, controller, host, doctor, upgrade, topology, collectors, dashboard, edge, connect, workbench	Control Plane & Fleet · Fleet · Host & setup · Anvil Connect

The canonical promises, boundaries, and cross-family handoffs are in Product families and user journeys.

If you are looking for serve recipes, start with Models & recipes: Recipes. It covers listing, inspecting, creating, updating, deleting, and loading recipes.

Invocation and help

Run the installed entry point or the equivalent module form:

anvil-serving --help
anvil-serving product families
python -m anvil_serving.cli --help

Help is contextual. Add --help after any command path to see only its children, options, safety requirements, and documentation link:

anvil-serving models --help
anvil-serving models recipes --help
anvil-serving models recipes load --help

Each leaf's real parser is authoritative for operands, choices, defaults, and argument descriptions. The registry adds the canonical path, summary, global options, safety policy, and documentation link without copying parser prose.

Global options

Global options describe where a command runs and how its result is rendered. They may appear before or after the command path, but must precede a literal -- separator.

Option	Purpose
--topology PATH	Use a deployment topology document for target resolution (default after target resolution is requested: $ANVIL_SERVING_HOME/operator-topology.toml).
--topology-overlay PATH	Apply a deployment overlay to the topology.
--command-host host:ID	Declare the host issuing the command.
--command-runtime runtime:ID	Declare the runtime issuing the command.
--target host:ID\|host-role:ROLE	Select the resource owner explicitly.
--transport auto\|local\|controller\|ssh	Choose execution transport.
--allow-ssh-fallback	Permit verified SSH recovery after a proven pre-dispatch controller failure.
--experimental-model-workload	Allow a topology-permitted experimental model workload on a model-free host.
--json	Emit the machine-readable result envelope.
--quiet	Suppress nonessential human output.
--verbose	Include diagnostic human output.
-h, --help	Show focused help and exit.

Output and safety conventions

• Read commands are bounded by default. Long-running commands such as router run and mcp serve remain in the foreground until stopped.
• Mutating commands expose --dry-run where a preview is meaningful and use one consent spelling: --confirm.
• --json is the stable automation surface. Human-readable output may improve over time without changing the result envelope.
• Resource-owner commands resolve through the declared topology. SSH is a recovery transport, not an implicit first choice.
• Omitting --topology does not enable target resolution by itself. Once a target, command host/runtime, transport, or another resolution option opts into it, the dispatcher uses the operator config-home topology.
• Examples use 127.0.0.1, because loopback is host-relative.

Anvil Media

anvil-serving media is the first-class bounded path for the same named workflow, durable job, cancellation, qualification, and opaque artifact records exposed by gateway protocols. Callers select an exact workflow ID and version; the CLI never accepts raw ComfyUI graphs or private backend output paths.

anvil-serving media capabilities --json
anvil-serving media workflow show image.flux2-klein-4b-fp8-v1 --version v1 --json
anvil-serving media workflow validate image.flux2-klein-4b-fp8-v1 --version v1 \
  --backend-url http://127.0.0.1:8188 --target host-role:media-worker --json
anvil-serving media job status JOB_ID --principal CALLER_ID --json
anvil-serving media artifact inspect ARTIFACT_ID --principal CALLER_ID --json

Workflow runs and cancellation are guarded mutations. Target selection resolves one declared media-worker or media-gateway resource owner; lifecycle changes remain behind the managed serve preview and confirmation contract.

Continue with the dedicated Anvil Media command reference for bundle preparation, qualification, job reconciliation, artifact delivery, and the caller/operator authority boundary.

Complete command index

This generated index is the exhaustive public surface. The family pages above are organized for reading; this table is optimized for lookup and is checked against the canonical command registry in CI. Its option column records dispatcher policy; focused --help remains authoritative for each leaf's complete workload flags, required operands, choices, and defaults.

Command path	Purpose	Class / output	Declared command options
product	Discover product families, boundaries, and ordered user journeys.	read / bounded	-
product families	List the six product families and their boundaries.	read / bounded	-
product journey	Show the ordered journey for one product family.	read / bounded	-
init	Scaffold the operational config home (or a single-model bring-up with --single-model).	mutate / bounded	-
models	Manage model catalog, artifacts, and recipes.	read / bounded	-
models sync	Sync the model catalog.	mutate / bounded	--dry-run --confirm
models pull	Pull a model artifact.	mutate / bounded	--dry-run --confirm
models score	Rank models from benchmark evidence.	read / bounded	-
models recipes	Manage recorded serve recipes.	read / bounded	-
models recipes list	List recorded serve recipes.	read / bounded	-
models recipes show	Show one recorded serve recipe.	read / bounded	-
models recipes running	Discover Anvil recipe-loaded containers.	read / bounded	-
models recipes create	Create one recipe in an operator registry.	mutate / bounded	--dry-run --confirm
models recipes update	Update one selected recipe.	mutate / bounded	--dry-run --confirm
models recipes delete	Delete one selected recipe.	mutate / bounded	--dry-run --confirm
models recipes load	Load one recipe into a named local container.	mutate / bounded	--dry-run --confirm
models recipes status	Inspect one recipe-loaded candidate container.	read / bounded	-
models recipes logs	Read bounded logs from one recipe-loaded candidate container.	read / bounded	--tail --since --contains
models recipes unload	Remove one exact recipe-loaded candidate container.	mutate / bounded	--dry-run --confirm
models cache	Manage model cache storage.	read / bounded	-
models cache inventory	Inspect Docker or native Hugging Face model-cache storage.	read / bounded	-
models cache prune	Plan or prune the model cache.	mutate / bounded	--dry-run --confirm --execute
models cache remove	Remove one Docker revision or preview native-cache removal.	mutate / bounded	--dry-run --confirm
serves	Manage local model serve lifecycle.	read / bounded	-
serves render	Render a model serve definition.	mutate / bounded	-
serves up	Start manifest-owned model serves.	mutate / bounded	--dry-run --confirm
serves up-for	Resolve a chat alias to its backing serve and start it.	mutate / bounded	--dry-run --confirm --config
serves down	Stop and remove manifest-owned model serves.	mutate / bounded	--dry-run --confirm --keep-container
serves rm	Remove a model serve.	mutate / bounded	--dry-run --confirm
serves adopt	Adopt an existing model serve.	mutate / bounded	--dry-run --confirm
serves switch	Switch a deployment role to an activation-ready recipe.	mutate / bounded	--dry-run --confirm --manifest --registry --recipe
serves promote	Promote a staged model recipe with preflight and full rollback.	mutate / bounded	--dry-run --confirm --skip-preflight-checks --derive --router-config --rollback-router-config --out
serves mode	Preview or transact split and exclusive TP=2 operating modes.	read / bounded	-
serves mode status	Show the active split or exclusive TP=2 mode.	read / bounded	-
serves mode preview	Preview exclusive entry without mutating GPU workloads.	read / bounded	--config --restore-group
serves mode enter	Enter exclusive TP=2 mode transactionally.	mutate / bounded	--dry-run --confirm --config --restore-group --drain-timeout --router-url --skip-preflight-checks
serves mode leave	Leave exclusive TP=2 mode transactionally.	mutate / bounded	--dry-run --confirm --config --restore-group --drain-timeout --router-url
serves profile	List, preview, or apply a declared serving topology profile.	read / bounded	-
serves profile list	List declared serving topology profiles.	read / bounded	-
serves profile preview	Preview a declared serving profile without mutation.	read / bounded	--config
serves profile apply	Apply a declared serving profile transactionally.	mutate / bounded	--dry-run --confirm --config
serves status	Show model serve status.	read / bounded	-
serves probe	Run an engine-aware functional serve probe.	read / bounded	-
serves groups	List serve groups across the manifest set and their members.	read / bounded	-
serves lint	Report manifest defects that no other surface makes visible.	read / bounded	-
serves rollback-check	Prove every declared rollback is actually usable.	read / bounded	-
serves logs	Read bounded model serve logs.	read / bounded	--follow
serves multiplex	Run the single-resident model multiplexer.	process / foreground	-
router	Manage the deployed router and its lifecycle.	read / bounded	-
router workloads	Read a bounded canonical workload snapshot from one router.	read / bounded	--router-url --auth-env --expected-node --owner --kind --state --host --active-only --recent-seconds --limit
router diagnose	Inspect active requests or retained request/session evidence without replaying it.	read / bounded	--request-id --session-id --active --config --router-url --auth-env --timeout
router run	Run the router in the foreground.	process / foreground	--config --host --port
router up	Start the deployed router.	mutate / bounded	--dry-run --confirm --compose --service --env-file --recreate
router down	Stop the deployed router.	mutate / bounded	--dry-run --confirm --compose --service
router restart	Restart the deployed router.	mutate / bounded	--dry-run --confirm --container --no-verify
router reload	Reload router configuration.	mutate / bounded	--dry-run --confirm --container --no-verify
router install-config	Validate and atomically install a router config, including tier-set migrations.	mutate / bounded	--dry-run --confirm --config --router-url --drain-timeout
router endpoint	Show the router listen address and this node's Tailscale DNS name.	read / bounded	-
router status	Show router status.	read / bounded	-
router fleet-status	Report which configured capabilities have a reachable backing serve.	read / bounded	--config --live --container --installed-config --probe-perspective --timeout
router transition-status	Show router tier transition state.	read / bounded	--tier --member --router-url
router quiesce	Quiesce one router tier or declared member.	mutate / bounded	--dry-run --confirm --tier --member --router-url
router drain	Wait for a quiesced tier or declared member to drain.	read / bounded	--tier --member --router-url --timeout
router readmit	Safely readmit one router tier or declared member.	mutate / bounded	--dry-run --confirm --tier --member --router-url
router logs	Read bounded router logs.	read / bounded	--follow
router token	Inspect the router token state.	read / bounded	--reveal --confirm
eval	Run quality evaluation workflows.	read / bounded	-
eval usage	Write usage and role summaries from recorded sessions.	mutate / bounded	--dry-run --confirm
eval preflight	Preflight an endpoint.	mutate / bounded	--dry-run --confirm
eval routed	Run fail-closed router and real-client acceptance for one alias.	mutate / bounded	--dry-run --confirm --base-url --model --api-key-env --expected-served-model --expected-config-fingerprint --expected-router-config-sha256 --min-context-tokens --clients --openclaw-provider --hermes-provider --hermes-expected-provider --no-harness-sync --openclaw-config --pi-models --pi-settings --client-state-path --client-backup-root --timeout-seconds --run-id --output
eval benchmark	Run or import benchmark evidence.	read / bounded	-
eval benchmark context	Measure retrieval and reasoning degradation by context depth.	read / bounded	--profile --observed-context
eval benchmark context prepare	Prepare digest-pinned context harness assets on the benchmark worker.	mutate / bounded	--profile --observed-context --dry-run --confirm --run-id --ownership-id --offline --max-download-bytes
eval benchmark context assets	Inspect prepared context harness assets.	read / bounded	--profile --observed-context --run-id --ownership-id
eval benchmark context cleanup	Clean only the owned work directory for a context benchmark run.	mutate / bounded	--profile --observed-context --run-id --dry-run --confirm --ownership-id
eval benchmark context preflight	Validate the endpoint and worker for a context benchmark job.	read / bounded	--profile --observed-context --spec-json --requirements-json
eval benchmark context submit	Submit a durable context benchmark job.	mutate / bounded	--profile --observed-context --dry-run --confirm --spec-json --follow --detach
eval benchmark context status	Read durable context benchmark job status.	read / bounded	--profile --observed-context --run-id
eval benchmark context logs	Read bounded cursor logs for a context benchmark job.	read / follow	--profile --observed-context --run-id --cursor --limit --follow
eval benchmark context cancel	Cancel a context benchmark job after recording partial evidence.	mutate / bounded	--profile --observed-context --run-id --dry-run --confirm
eval benchmark context artifact	Read the terminal or partial context benchmark artifact.	read / bounded	--profile --observed-context --run-id --path
eval benchmark agentic	Run deterministic tool-use and software-solving scenarios.	read / bounded	--profile --observed-context
eval benchmark agentic prepare	Prepare digest-pinned agentic harness assets on the benchmark worker.	mutate / bounded	--profile --observed-context --dry-run --confirm --run-id --ownership-id --offline --max-download-bytes
eval benchmark agentic assets	Inspect prepared agentic harness assets.	read / bounded	--profile --observed-context --run-id --ownership-id
eval benchmark agentic cleanup	Clean only the owned work directory for a agentic benchmark run.	mutate / bounded	--profile --observed-context --run-id --dry-run --confirm --ownership-id
eval benchmark agentic preflight	Validate the endpoint and worker for a agentic benchmark job.	read / bounded	--profile --observed-context --spec-json --requirements-json
eval benchmark agentic submit	Submit a durable agentic benchmark job.	mutate / bounded	--profile --observed-context --dry-run --confirm --spec-json --follow --detach
eval benchmark agentic status	Read durable agentic benchmark job status.	read / bounded	--profile --observed-context --run-id
eval benchmark agentic logs	Read bounded cursor logs for a agentic benchmark job.	read / follow	--profile --observed-context --run-id --cursor --limit --follow
eval benchmark agentic cancel	Cancel a agentic benchmark job after recording partial evidence.	mutate / bounded	--profile --observed-context --run-id --dry-run --confirm
eval benchmark agentic artifact	Read the terminal or partial agentic benchmark artifact.	read / bounded	--profile --observed-context --run-id --path
eval benchmark swe	Run pinned repository problem-solving benchmarks.	read / bounded	--profile --observed-context
eval benchmark swe prepare	Prepare digest-pinned swe harness assets on the benchmark worker.	mutate / bounded	--profile --observed-context --dry-run --confirm --run-id --ownership-id --offline --max-download-bytes
eval benchmark swe assets	Inspect prepared swe harness assets.	read / bounded	--profile --observed-context --run-id --ownership-id
eval benchmark swe cleanup	Clean only the owned work directory for a swe benchmark run.	mutate / bounded	--profile --observed-context --run-id --dry-run --confirm --ownership-id
eval benchmark swe preflight	Validate the endpoint and worker for a swe benchmark job.	read / bounded	--profile --observed-context --spec-json --requirements-json
eval benchmark swe submit	Submit a durable swe benchmark job.	mutate / bounded	--profile --observed-context --dry-run --confirm --spec-json --follow --detach
eval benchmark swe status	Read durable swe benchmark job status.	read / bounded	--profile --observed-context --run-id
eval benchmark swe logs	Read bounded cursor logs for a swe benchmark job.	read / follow	--profile --observed-context --run-id --cursor --limit --follow
eval benchmark swe cancel	Cancel a swe benchmark job after recording partial evidence.	mutate / bounded	--profile --observed-context --run-id --dry-run --confirm
eval benchmark swe artifact	Read the terminal or partial swe benchmark artifact.	read / bounded	--profile --observed-context --run-id --path
eval benchmark capacity	Measure endpoint latency, throughput, context, and cache behavior.	mutate / bounded	--dry-run --confirm
eval benchmark quality	Run repeated quality suites and retain comparison evidence.	mutate / bounded	--dry-run --confirm
eval benchmark multimodal	Run a hashed deterministic image/video corpus.	mutate / bounded	--dry-run --confirm
eval benchmark evidence	Inspect retained local benchmark evidence.	read / bounded	-
eval benchmark evidence list	List retained local benchmark artifacts.	read / bounded	-
eval benchmark evidence show	Show a normalized benchmark artifact summary.	read / bounded	-
eval benchmark evidence compare	Compare artifacts and flag workload mismatches.	read / bounded	-
eval benchmark report	Generate or check an offline recipe report from retained artifacts.	read / bounded	--format --root --output --check --confirm
eval benchmark external	Manage external benchmark evidence.	read / bounded	-
eval benchmark external init	Initialize benchmark evidence storage.	mutate / bounded	--dry-run --confirm
eval benchmark external sources	List benchmark sources.	read / bounded	-
eval benchmark external fetch	Fetch and import benchmark evidence.	mutate / bounded	--dry-run --confirm
eval benchmark external import	Import saved benchmark evidence.	mutate / bounded	--dry-run --confirm
eval benchmark external list	List normalized benchmark evidence.	read / bounded	-
eval benchmark external report	Render a benchmark report.	read / bounded	-
eval benchmark external export	Export benchmark evidence.	mutate / bounded	--dry-run --confirm
eval benchmark external compare	Compare local benchmark evidence.	read / bounded	-
eval benchmark external notebook	Record, list, or render model-bakeoff notebook runs.	read / bounded	-
eval benchmark external notebook add	Record a bakeoff evidence run.	mutate / bounded	--dry-run --confirm
eval benchmark external notebook list	List recorded bakeoff runs.	read / bounded	-
eval benchmark external notebook render	Render the bakeoff comparison.	read / bounded	-
voice	Manage audio and realtime proxy operations.	read / bounded	-
voice up	Start the co-located managed voice stack.	mutate / bounded	--dry-run --confirm
voice down	Stop the co-located managed voice stack.	mutate / bounded	--dry-run --confirm
voice audio	Manage topology-owned STT/TTS lifecycle.	read / bounded	-
voice audio up	Start audio serves.	mutate / bounded	--dry-run --confirm
voice audio down	Stop audio serves.	mutate / bounded	--dry-run --confirm
voice audio status	Show bounded audio serve status.	read / bounded	-
voice audio logs	Show bounded audio serve logs.	read / bounded	-
voice proxy	Manage the realtime proxy process.	read / bounded	-
voice proxy run	Run the realtime proxy.	process / foreground	-
voice proxy up	Start the realtime proxy.	mutate / bounded	--dry-run --confirm
voice proxy down	Stop the realtime proxy.	mutate / bounded	--dry-run --confirm
voice proxy restart	Restart the realtime proxy.	mutate / bounded	--dry-run --confirm
voice proxy status	Show realtime proxy status.	read / bounded	-
voice proxy logs	Show bounded realtime proxy logs.	read / bounded	-
voice proxy bridge	Run the Mini-to-Dark audio bridge.	process / foreground	--dry-run
voice benchmark	Benchmark a voice session or multi-sample STT corpus.	read / bounded	-
voice corpus	Prepare or validate an STT benchmark corpus.	read / bounded	-
voice corpus prepare	Build the deterministic English STT corpus.	read / bounded	-
voice corpus validate	Validate STT corpus JSONL, audio, and hashes.	read / bounded	-
voice profiles	Inspect voice profiles.	read / bounded	-
voice profiles list	List voice profiles.	read / bounded	-
voice profiles validate	Validate the profile selected by --profile.	read / bounded	-
voice sidecar	Manage the speech-to-speech sidecar.	read / bounded	-
voice sidecar validate	Validate a sidecar manifest.	read / bounded	-
voice sidecar command	Render a sidecar command.	read / bounded	-
voice sidecar compose	Render sidecar compose configuration.	read / bounded	-
media	Inspect and run bounded managed media workflows.	read / bounded	-
media capabilities	List deterministic media capabilities.	read / bounded	--registry --state-db --artifact-root
media bundle	Inventory and stage exact pinned workflow assets.	read / bounded	-
media bundle inventory	Verify exact model assets for one workflow.	read / bounded	--version --bundle-lock --models-volume
media bundle stage	Add missing exact model assets without replacing existing files.	mutate / bounded	--dry-run --confirm --version --bundle-lock --models-volume --user-volume --runtime-uid --runtime-gid
media qualify	Qualify an unavailable pinned workflow without promoting it.	read / bounded	-
media qualify run	Run functional and capacity qualification on the selected worker.	mutate / bounded	--dry-run --confirm --registry --state-db --artifact-root --principal --version --bundle-lock --models-volume --parameters --quality-profile --backend-url --gpu-index --poll-seconds --ffprobe
media workflow	Inspect, validate, and run named workflows.	read / bounded	-
media workflow list	List named workflows.	read / bounded	--registry --state-db --artifact-root
media workflow show	Show one named workflow.	read / bounded	--registry --state-db --artifact-root --version
media workflow validate	Validate one workflow against its selected worker.	read / bounded	--registry --state-db --artifact-root --version --backend-url
media workflow run	Submit one bounded named media workflow.	mutate / bounded	--dry-run --confirm --registry --state-db --artifact-root --principal --version --parameters --quality-profile --idempotency-key --backend-url
media job	Inspect and cancel durable media jobs.	read / bounded	-
media job status	Inspect one durable media job.	read / bounded	--registry --state-db --artifact-root --principal --backend-url
media job cancel	Cancel one caller-owned media job.	mutate / bounded	--dry-run --confirm --registry --state-db --artifact-root --principal --backend-url
media artifact	Inspect authenticated media artifacts.	read / bounded	-
media artifact inspect	Inspect opaque artifact metadata.	read / bounded	--registry --state-db --artifact-root --principal
fleet	Cross-host visibility across the declared operator topology.	read / bounded	-
fleet workloads	Read a bounded canonical workload snapshot from one fleet controller.	read / bounded	--controller-url --auth-env --expected-node --owner --kind --state --host --active-only --recent-seconds --limit
fleet version	Report anvil-serving version skew across declared fleet hosts.	read / bounded	--host --timeout
fleet drift	Compare each host's live operator home against its repository snapshot.	read / bounded	--repo --host --home --timeout
harness	Manage harness integration.	read / bounded	-
harness sync	Synchronize harness configuration	read / bounded	-
harness sync openclaw	Synchronize harness configuration for OpenClaw.	mutate / bounded	--dry-run --confirm
harness sync clients	Reconcile OpenClaw, Hermes profiles, and Pi from authenticated router metadata.	mutate / bounded	--dry-run --confirm
harness sync hermes-media	Install the narrow Anvil media MCP and packaged Hermes skill.	mutate / bounded	--dry-run --confirm
harness sync pi-media	Withdraw Pi's owned direct Anvil media MCP entry.	mutate / bounded	--dry-run --confirm
harness restart	Restart the harness	read / bounded	-
harness restart openclaw	Restart the harness for OpenClaw.	mutate / bounded	--dry-run --confirm
harness status	Show harness status	read / bounded	-
harness status openclaw	Show harness status for OpenClaw.	read / bounded	-
mcp	Expose bounded MCP management tools.	read / bounded	-
mcp serve	Run the MCP management server.	read / protocol	--controller-url --auth-env --auth-file
mcp tools	List bounded MCP tools.	read / bounded	-
controller	Manage the private controller service.	read / bounded	-
controller serve	Run the private controller.	process / foreground	-
controller status	Probe controller health.	read / bounded	-
controller inspect	Read-only metadata inspection for one controller container.	read / bounded	--container
controller logs	Read bounded metadata-only controller audit events.	read / bounded	--container --tail
host	Inspect and repair declared host operations.	read / bounded	-
host services	Inspect, adopt, and operate declared portable supervised services.	read / bounded	-
host services status	Show bounded declared-service status.	read / bounded	--manifest --tail --timeout-seconds
host services discover	Discover eligible unmanaged local services.	read / bounded	-
host services capabilities	Show the owning runtime's supported service operations.	read / bounded	-
host services logs	Read a bounded declared-service log tail.	read / bounded	--manifest --tail --timeout-seconds
host services adopt	Preview or adopt an exact existing launchd or Docker service.	mutate / bounded	--dry-run --confirm --no-dry-run --manifest --tail --timeout-seconds --manager --service-label --resource --engine --support --container --endpoint --model --health-path --models-path --feature --startup-policy --memory-mib --serve --serve-manifest
host services install	Render a declared service supervisor definition without starting it.	mutate / bounded	--dry-run --confirm --no-dry-run --manifest --tail --timeout-seconds
host services up	Start one declared service.	mutate / bounded	--dry-run --confirm --no-dry-run --manifest --tail --timeout-seconds
host services down	Stop one declared service.	mutate / bounded	--dry-run --confirm --no-dry-run --manifest --tail --timeout-seconds
host services restart	Restart one declared service.	mutate / bounded	--dry-run --confirm --no-dry-run --manifest --tail --timeout-seconds
host services enable	Enable automatic start for one declared service.	mutate / bounded	--dry-run --confirm --no-dry-run --manifest --tail --timeout-seconds
host services disable	Disable automatic start for one declared service.	mutate / bounded	--dry-run --confirm --no-dry-run --manifest --tail --timeout-seconds
host config	Inventory and safely export operator-owned configuration.	read / bounded	-
host config inventory	Classify operator-home files and verify dependency closure.	read / bounded	--home --max-bytes
host config export	Export safe config and sanitized Anvil-owned gateway fragments.	read / bounded	--home --gateway-path --path --max-bytes
host status	Show structured host status.	read / bounded	-
host gpus	Show GPU inventory.	read / bounded	-
host gpu-sharing	Inspect and probe CUDA GPU-sharing capabilities.	read / bounded	-
host gpu-sharing inspect	Inspect Green Context and MPS capability without mutation.	read / bounded	-
host gpu-sharing probe	Run the guarded Docker CUDA prerequisite probe.	mutate / bounded	--dry-run --confirm
host nccl	Check two-rank NCCL correctness and transport in a pinned local image.	mutate / bounded	--dry-run --confirm --image --gpu-uuid --p2p --cumem --max-mib --iterations --timeout --output
host doctor	Diagnose host configuration.	read / bounded	-
host native-memory-containment	Prepare or explicitly execute a bounded self-only fatal-memory canary.	mutate / bounded	--dry-run --confirm --prepare --execute --allow-privileged-probe --expected-binary-sha256 --output
host native-memory-probe	Probe bounded Metal allocation accounting without loading a model.	mutate / bounded	--dry-run --confirm --output
host memory	Show host RAM and WSL VM memory usage.	read / bounded	-
host shared-memory	Inspect and reclaim vLLM native KV-offload shared memory.	read / bounded	-
host shared-memory status	Inspect ownership of vLLM offload mmap files.	read / bounded	-
host shared-memory reclaim	Remove only twice-verified orphan vLLM offload mmap files.	mutate / bounded	--dry-run --confirm
host docker-image	Build, inspect, or remove a declared local Docker image.	read / bounded	-
host docker-image build	Build a declared local image with CPU and memory limits.	mutate / bounded	--dry-run --confirm --config
host docker-image inspect	Read the platform and selected build labels of one cached image.	read / bounded	--label
host docker-image remove	Remove one unreferenced full image ID or digest.	mutate / bounded	--dry-run --confirm --config-home
host docker-disk	Inspect and compact the Docker Desktop data disk.	read / bounded	-
host docker-disk compact	Stop Docker Desktop and compact one exact data VHDX.	mutate / bounded	--dry-run --confirm
host wsl-config	Render or update WSL configuration.	mutate / bounded	--dry-run --confirm
host restart-docker	Restart Docker Desktop.	mutate / bounded	--dry-run --confirm
host reset-wsl	Reset WSL.	mutate / bounded	--dry-run --confirm
host reclaim	Drop the WSL VM page cache.	mutate / bounded	--dry-run --confirm --watch
doctor	Check dependencies and configured health.	read / bounded	-
upgrade	Upgrade this CLI to the newest stable published release.	mutate / bounded	--dry-run --confirm
topology	Inspect and resolve deployment topology.	read / bounded	-
topology show	Show a validated topology summary.	read / bounded	-
topology validate	Validate a topology offline.	read / bounded	-
topology resolve	Resolve one canonical command against a topology.	read / bounded	-
topology drift	Compare the installed topology against a canonical fleet reference.	read / bounded	-
topology validate-router-config	Validate a router config against declared topology offline.	read / bounded	--config
collectors	Configure and inspect optional read-only collector adapters.	read / bounded	-
collectors configure	Validate and optionally write adapter configuration.	mutate / bounded	--output --confirm
collectors validate	Validate adapter configuration without network access.	read / bounded	-
collectors capabilities	Report configured adapter capabilities offline.	read / bounded	-
collectors inspect	Perform one bounded read-only adapter inspection.	read / bounded	-
dashboard	Serve the authenticated Workbench or local telemetry dashboard.	read / bounded	-
dashboard serve	Serve the configured Anvil Workbench or packaged local dashboard.	process / foreground	--host --port --auth-env --workload-controller-url --workload-expected-node --workload-authorization-policy --observatory-config
edge	Own the Tailscale tailnet edge in front of the unchanged router.	read / bounded	-
edge bundle	Plan a portable tailnet model endpoint offline.	read / bounded	-
edge bundle validate	Validate a portable endpoint manifest offline.	read / bounded	--manifest
edge bundle render	Render Compose, Serve, and router fragments without applying.	read / bounded	--manifest
edge render	Render the tailscale serve invocations without applying.	read / bounded	-
edge status	Show serve mappings, flagging which this tool manages.	read / bounded	-
edge up	Apply the managed route map (additive; idempotent).	mutate / bounded	--dry-run --confirm
edge down	Remove ONLY the mounts this tool manages.	mutate / bounded	--dry-run --confirm
connect	Manage authenticated API and browser access with Anvil Connect.	read / bounded	-
connect resources	List declared browser services and copyable grant values.	read / bounded	--manifest
connect users	Manage local accounts, service entitlements, enrollment codes and authentication backups.	mutate / bounded	-
connect users list	List local sign-in accounts (not Connect grants).	read / bounded	--manifest
connect users show	Show one local sign-in account (not Connect grants).	read / bounded	--manifest
connect users create	Create an account and request a password-setup email or private handoff.	mutate / bounded	--manifest --email --role --grant --output --dry-run --confirm
connect users access	Replace ALL browser grants, enable the account and revoke its Connect sessions.	mutate / bounded	--manifest --grant --dry-run --confirm
connect users suspend	Disable sign-in and revoke Connect browser and terminal sessions.	mutate / bounded	--manifest --dry-run --confirm
connect users delete	Remove the account and factors; retain backups and disabled authority history.	mutate / bounded	--manifest --dry-run --confirm
connect users reset-password	Request password setup; preserve groups, grants and registered factors.	mutate / bounded	--manifest --output --dry-run --confirm
connect users reset-mfa	Remove passkeys and TOTP; suspend first for a lost or compromised device.	mutate / bounded	--manifest --dry-run --confirm
connect users code	Export a fresh enrollment code or setup link when using filesystem delivery.	mutate / bounded	--manifest --output --dry-run --confirm
connect users backup	Back up all authentication accounts and factors.	mutate / bounded	--manifest --include-gateway --dry-run --confirm
connect users schedule	Install the daily authentication and gateway backup timer.	mutate / bounded	--manifest --dry-run --confirm
connect users deletion-schedule	Install the account-deletion processing timer.	mutate / bounded	--manifest --dry-run --confirm
connect users process-deletions	Process one authorized permanent account deletion.	mutate / bounded	--manifest --dry-run --confirm
connect users restore	Restore authentication backup into a fresh directory without activating it.	mutate / bounded	--input --sha256 --destination --dry-run --confirm
connect qualify	Run an isolated Connect qualification lane using saved local settings.	process / bounded	--prepare-container --lane --config
connect validate	Validate declarations and selected native components.	read / bounded	--manifest --service
connect render	Preview or stage an owned configuration generation.	mutate / bounded	--manifest --dry-run --confirm
connect up	Preview or activate only the selected owned services.	mutate / bounded	--manifest --service --services --upgrade --dry-run --confirm
connect down	Preview or stop only the selected owned services.	mutate / bounded	--manifest --service --dry-run --confirm
connect status	Inspect owned service state without claiming origin readiness.	read / bounded	--manifest --service
connect doctor	Check declared paths, components, and ownership.	read / bounded	--manifest --service
connect logs	Read bounded service event metadata.	read / bounded	--manifest --service --tail
connect init	Initialize an authority or enroll a connector explicitly.	mutate / bounded	--manifest --service --bundle --dry-run --confirm
connect identity	Read the public fingerprint of a declared connector.	read / bounded	--manifest --service
connect admin	Send a declared request to the local gateway authority.	mutate / bounded	--manifest --request --output --dry-run --confirm
connect keygen	Create a private key for a declared local SDK forwarder.	mutate / bounded	--manifest --service --output --dry-run --confirm
connect backup	Back up the stopped gateway authority to a private file.	mutate / bounded	--manifest --output --dry-run --confirm
connect restore	Restore fenced authority into a fresh private directory.	mutate / bounded	--manifest --input --destination --sha256 --native-sha256 --dry-run --confirm
connect migration	Preview Observatory access at one canonical origin.	read / bounded	--manifest --observatory-config --resource
connect edge-status	Compare declared resources with the live Cloudflare edge.	read / bounded	--manifest --edge-config
connect edge-apply	Apply declared DNS records and tunnel ingress rules through Cloudflare.	mutate / bounded	--manifest --edge-config --retire-orphans --dry-run --confirm
connect extend	Extend one enrolled connector with newly declared resources.	mutate / bounded	--manifest --service --dry-run --confirm
workbench	Build Workbench runners and manage the optional companion hub.	read / bounded	-
workbench jev	Configure and request explicitly attributed optional Jev advice.	read / bounded	-
workbench jev setup	Record an installed trusted Anvil bridge without enabling cloud calls.	mutate / bounded	--anvil-binary --confirm
workbench jev status	Show Jev policy without credentials or network access.	read / bounded	-
workbench jev enable	Enable one named optional capability with explicit cloud export permission.	mutate / bounded	--allow-api --allow-export --confirm
workbench jev disable	Stop new calls globally or for one named capability.	mutate / bounded	--confirm
workbench jev advise	Request advice on selected JSON without changing a resource or task.	read / bounded	--input --allow-export --no-jev
workbench build	Build the Workbench hub image from the local companion checkout.	mutate / bounded	--dry-run --confirm --source --image --runner
workbench pi-egress	Approve or remove the isolated Pi provider gateway policy.	mutate / bounded	--dry-run --confirm --config --provider --remove
workbench pi-storage	Provision and verify the bounded Pi runner storage pool.	mutate / bounded	--dry-run --confirm --config
workbench pi-web-install	Install the pinned Pi Web session UI service on loopback.	mutate / bounded	--dry-run --confirm --config
workbench pi-web-up	Start the managed Pi Web session UI service.	mutate / bounded	--dry-run --confirm
workbench pi-web-down	Stop the managed Pi Web session UI service.	mutate / bounded	--dry-run --confirm
workbench pi-web-status	Show the managed Pi Web service state and loopback readiness.	read / bounded	--config
workbench pi-web-logs	Read bounded managed Pi Web service journal logs.	read / bounded	--config --tail
workbench up	Start the private Workbench hub, Postgres, and Neo4j projection.	mutate / bounded	--dry-run --confirm
workbench down	Stop the Workbench hub stack while preserving its named data volumes.	mutate / bounded	--dry-run --confirm
workbench status	Show the bounded Docker Compose service status for Workbench.	read / bounded	-
workbench logs	Read bounded Workbench hub stack logs.	read / bounded	-

Migration from legacy commands

The co-located managed aggregate is now anvil-serving voice up and anvil-serving voice down. The remaining removed module-level voice paths retain actionable replacements:

Removed path	Replacement
anvil-serving voice start	anvil-serving voice audio up
anvil-serving voice stop	anvil-serving voice audio down
anvil-serving voice run	anvil-serving voice proxy run
anvil-serving voice bridge	anvil-serving voice proxy bridge

Split-host deployments must operate the audio and proxy owners explicitly; the aggregate refuses to compose lifecycle operations across hosts.

Related references

• Configuration
• Getting started
• Troubleshooting
• Operator playbooks
• Terminology