marboba CLI
Reference for the `marboba` CLI. Wraps every public /v1 endpoint as a subcommand.
The marboba CLI wraps the public /v1 API as shell subcommands.
Install
# macOS / Linux
brew install marboba/tap/marboba
# Or via npm (any platform)
npm install -g @marboba/cli
Configure
# Set your endpoint + token (one-time per machine)
marboba config set endpoint https://api.marboba.com
marboba config set token "$MARBOBA_API_TOKEN"
# Or use environment variables
export MARBOBA_ENDPOINT=https://api.marboba.com
export MARBOBA_API_TOKEN=mb_pat_live_...
Config lives at ~/.config/marboba/config.yaml (mode 0600).
Global flags
Available on every subcommand:
| Flag | Description |
|---|---|
--endpoint | Override the API endpoint. Defaults to https://api.marboba.com. Use a non-prod URL only if your platform team has given you one. |
--token | Override the PAT |
--output | table (default), json, yaml, or wide |
--config | Override the config file path |
Commands
marboba action
Inspect registered agent actions
| Subcommand | Description |
|---|---|
list | List every registered action |
list | List recent agent runs |
get <run-id> | Show the full record for a single run |
propose | Submit a new agent run for approval |
approve <run-id> | Approve a proposed run (must be a different user than the proposer) |
reject <run-id> | Reject a proposed or approved run |
execute <run-id> | Execute an approved run (admin scope; same gate as approve) |
marboba agent
Drive AI-driven Day-2 actions (rotate keys, rollback, scale, …)
Drive the agent-action framework via /v1.
Lifecycle: propose → approve → execute (or reject). The two-person rule is enforced server-side: the proposer cannot approve their own run.
| Subcommand | Description |
|---|---|
list | List every registered action |
list | List recent agent runs |
get <run-id> | Show the full record for a single run |
propose | Submit a new agent run for approval |
approve <run-id> | Approve a proposed run (must be a different user than the proposer) |
reject <run-id> | Reject a proposed or approved run |
execute <run-id> | Execute an approved run (admin scope; same gate as approve) |
marboba api (aliases: apis)
Manage API entities
| Subcommand | Description |
|---|---|
list | List APIs |
get <id> | Get an API entity |
create | Create an API entity |
update <id> | Update an API entity |
delete <id> | Delete an API entity |
spec <id> | Fetch the spec content (proxied through MarBoba’s auth) |
marboba component (aliases: components, project, projects)
Manage components (catalog projects)
| Subcommand | Description |
|---|---|
list | List components |
get <id> | Show a single component |
create | Create a component |
update <id> | Update a component (PATCH) |
delete <id> | Delete a component (admin scope required) |
marboba config
Manage the CLI’s saved configuration
| Subcommand | Description |
|---|---|
view | Print the resolved config (token redacted) |
set <key> <value> | Set endpoint, token, or orgId |
unset <key> | Clear endpoint, token, or orgId |
path | Print the config file path |
marboba cost (aliases: costs)
View cost roll-ups
| Subcommand | Description |
|---|---|
summary | Show MTD / 30d cost summary |
marboba dependency (aliases: dependencies, edge, edges)
Manage dependency edges
| Subcommand | Description |
|---|---|
list | List dependency edges |
create | Create a dependency edge |
delete <id> | Delete a dependency edge |
marboba deployment (aliases: deployments)
Read deployments (read-only)
| Subcommand | Description |
|---|---|
get <id> | Get a deployment |
marboba domain (aliases: domains)
Manage domains
| Subcommand | Description |
|---|---|
list | List domains |
get <id> | Get a domain |
create | Create a domain |
update <id> | Update a domain |
delete <id> | Delete a domain |
marboba domain (aliases: domains)
List claimed SSO domains (read-only)
| Subcommand | Description |
|---|---|
list | List Identity Providers (priority order) |
get <id> | Show a single Identity Provider |
list | List every claimed SSO domain |
show | Show org-wide SSO enforcement settings |
marboba drift
View configuration drift
| Subcommand | Description |
|---|---|
list | List current drift status across all components |
snapshots | List drift snapshots |
snapshot <id> | Get a drift snapshot |
marboba error-tracking (aliases: errors)
View error-tracker status
| Subcommand | Description |
|---|---|
list | List error-tracker status per component |
snapshots | List error-tracker snapshots |
marboba integration (aliases: integrations)
View integrations (read-only)
| Subcommand | Description |
|---|---|
list | List integrations |
get <type> | Get an integration by type |
marboba issue (aliases: issues, bug, bugs)
Manage issues / bugs
| Subcommand | Description |
|---|---|
list | List issues |
get <id> | Get an issue |
create | Create an issue |
update <id> | Update an issue |
delete <id> | Delete an issue |
marboba oncall
Manage on-call bindings
| Subcommand | Description |
|---|---|
list | List on-call bindings |
get <id> | Get an on-call binding |
create | Create an on-call binding |
update <id> | Update binding label (only mutable field) |
refresh <id> | Force-refresh on-call user from the upstream provider |
delete <id> | Delete an on-call binding |
marboba provider (aliases: providers, idp)
Inspect SSO Identity Providers (read-only)
| Subcommand | Description |
|---|---|
list | List Identity Providers (priority order) |
get <id> | Show a single Identity Provider |
list | List every claimed SSO domain |
show | Show org-wide SSO enforcement settings |
marboba resource (aliases: resources)
Manage resource entities (DBs / queues / buckets / caches)
| Subcommand | Description |
|---|---|
list | List resources |
get <id> | Get a resource |
create | Create a resource |
update <id> | Update a resource |
delete <id> | Delete a resource |
marboba run
Manage agent runs
| Subcommand | Description |
|---|---|
list | List every registered action |
list | List recent agent runs |
get <run-id> | Show the full record for a single run |
propose | Submit a new agent run for approval |
approve <run-id> | Approve a proposed run (must be a different user than the proposer) |
reject <run-id> | Reject a proposed or approved run |
execute <run-id> | Execute an approved run (admin scope; same gate as approve) |
marboba runbook (aliases: runbooks)
Manage runbooks
| Subcommand | Description |
|---|---|
list | List runbooks |
get <id> | Get a runbook (renders body to stdout if —output table) |
create | Create a runbook |
update <id> | Update a runbook |
delete <id> | Delete a runbook (soft-delete on server) |
marboba scaffold-template (aliases: scaffold-templates, scaffold)
View scaffold templates (read-only on /v1)
| Subcommand | Description |
|---|---|
list | List scaffold templates |
get <id> | Get a scaffold template |
marboba scorecard (aliases: scorecards)
Manage scorecards
| Subcommand | Description |
|---|---|
list | List scorecards |
get <id> | Get a scorecard |
create | Create a scorecard. —rules and —tiers accept JSON arrays. |
update <id> | Update a scorecard |
delete <id> | Delete a scorecard |
run <id> | Evaluate a scorecard against an entity |
marboba secret (aliases: secrets)
View secret metadata (admin scope, never shows values)
| Subcommand | Description |
|---|---|
list | List secret metadata |
get <id> | Get secret metadata (no value) |
marboba settings (aliases: setting)
Show org-wide SSO enforcement settings (read-only)
| Subcommand | Description |
|---|---|
list | List Identity Providers (priority order) |
get <id> | Show a single Identity Provider |
list | List every claimed SSO domain |
show | Show org-wide SSO enforcement settings |
marboba slo (aliases: slos)
Manage SLOs
| Subcommand | Description |
|---|---|
list | List SLOs |
get <id> | Get an SLO |
create | Create an SLO |
update <id> | Update an SLO |
delete <id> | Delete an SLO |
snapshots <id> | List burn-down snapshots for an SLO |
marboba spec
Work with marboba.yaml — validate, plan, compile, apply
Work with the portable workload spec (marboba.yaml).
A single declaration:
- validate (parse + schema check)
- plan (dry-run against the catalog; lists creates / updates / orphans)
- compile (emit per-target deploy descriptors: firebase, vercel, render, railway, app stores)
- apply (commit the plan; admin scope required)
All commands accept a path argument. ”-” reads from stdin.
| Subcommand | Description |
|---|---|
| `validate <path | ->` |
| `plan <path | ->` |
| `apply <path | ->` |
| `compile <path | ->` |
marboba sso
Inspect SSO providers, domains, and settings (read-only)
| Subcommand | Description |
|---|---|
list | List Identity Providers (priority order) |
get <id> | Show a single Identity Provider |
list | List every claimed SSO domain |
show | Show org-wide SSO enforcement settings |
marboba system (aliases: systems)
Manage systems
| Subcommand | Description |
|---|---|
list | List systems |
get <id> | Get a system |
create | Create a system |
update <id> | Update a system |
delete <id> | Delete a system |
marboba team (aliases: teams)
Manage teams
| Subcommand | Description |
|---|---|
list | List teams |
get <id> | Get a single team |
create | Create a team |
update <id> | Update a team |
delete <id> | Delete a team |
marboba user (aliases: users)
View users (read-only)
| Subcommand | Description |
|---|---|
list | List users |
get <uid> | Get a user |
See also
- REST API endpoints — every
/v1endpoint the CLI wraps. - Terraform provider — declarative infrastructure-as-code surface for the same primitives.
- @marboba/mcp — MCP tool surface, same auth contract.