207 docs tagged with "Tools"

Activates a CkArchive: provisions the per-archive CrateDB table and transitions the archive to Activated. Use this once after rt-importing the archive entity.

Adds a new identity provider for active directory.

Adds a new client using grant type 'AuthorizationCode'.

Adds a new identity provider for Microsoft Azure Entra ID.

Adds a new client using grant type 'ClientCredentials'.

Adds a client to a group.

Assigns a role to a client

Adds a computed column to an Activated raw or time-range archive and backfills it. The column becomes visible atomically when the backfill completes. (AB#4189)

Adds or updates a named context.

Adds a new client using grant type 'device code'.

Adds a child group to a parent group.

Adds a new identity provider.

Adds a new identity provider for cross-tenant authentication via a parent tenant.

Adds a new identity provider for Open LDAP.

Grants the access to a client for a scope .

Adds a user to a group.

Adds an user to a role

Applies an overlay URI set (RedirectUris / PostLogoutRedirectUris / AllowedCorsOrigins) to a blueprint-managed client. New entries are written with Source = 'overlay:<OverlayName>', kept across blueprint re-apply by the Step 2a preservation pass. Idempotent — duplicates are silently skipped (any source). At least one of the three URI lists must be provided.

Attach an existing database to a tenant.

Gets authentication status to the configured identity services.

Queues a durable background backfill that populates / resets a rollup over the ENTIRE history of its source archive without supplying a timestamp (AB#4269 / AB#4286). Resolves the source archive's earliest timestamp and enqueues a recompute of [sourceMin, now); the heavy work runs in the background so it is never cancelled by a client timeout. Returns the Pending job id immediately. Use -w/--wait to poll until the job completes. A no-op when the source archive holds no data.

Connect an AI assistant to OctoMesh through the MCP server, explore data in natural language, build queries and let the assistant generate a small evaluation or app - within the limits of your token.

Cancels one execution that is still waiting in an adapter pool's queue. It never runs.

Shows the dependency tree for a CK model from a catalog.

Reports which pipeline service accounts (octo-pipeline-sa-*) hold FileManagement; exits non-zero when one is missing. Read-only.

Pre-flight check for CK model upgrade/migration.

Resets a tenant to factory defaults by deleting the construction kit and runtime model.

Strips overlay URI entries from every blueprint-managed client in the tenant. Without -overlayName*'. With -overlayName<name>' exactly. Destructive — typical use is before a sanitised DumpTenant export; the operator can re-apply with Apply-IdentityOverlay afterwards (idempotent, no-op if state matches).

Clears the cache of a tenant

Multi-command playbooks for typical octo-cli usage scenarios. Each step has its own copyable code block — paste them one at a time. Full per-command documentation is in the Command Reference sidebar section.

Configures the active context.

Creates a new tenant and provisions the current user as admin.

Creates an admin provisioning mapping in a target tenant.

Adds a new api resource.

Creates a new API scope.

Adds new API secret for an API resource.

Adds new API secret for a client.

Creates a data permission (AB#4972)

Creates a policy bound to a data permission (AB#4972)

Creates an email domain group rule.

Creates an external tenant user mapping.

Creates a fixup script

Creates a group.

Create a new role

Create a new user account

Deletes an existing tenant.

Deletes an admin provisioning mapping from a target tenant.

Deletes an api resource.

Deletes an API scope.

Deletes a secret of an API resource.

Deletes a secret of a client.

Drops the per-archive CrateDB table and soft-deletes the CkArchive entity. Destructive — historical data is lost.

Deletes a client.

Deletes a data permission including its policies

Deletes an email domain group rule.

Deletes an external tenant user mapping.

Deletes a group.

Deletes an identity provider.

Deletes a role

Deletes the pre-sweep dump of a secret sweep run before it expires (requires SecretManagement). Use -y to skip confirmation.

Deletes an user

Deploys a specific data flow.

Triggers a deploy of a deployment site. The Communication Operator creates the deployment site resources; workloads are deployed separately via DeployWorkload.

This page lists the hosted MCP (Model Context Protocol) Services endpoints and how to register each with your AI client. For the registration mechanics see Getting started.

Deploys a pipeline definition to the corresponding adapter.

Deploys all triggers for the current tenant.

Triggers a deploy of one workload (Adapter or Application) through its parent deployment site.

Detaches a child tenant. The database is kept and can be re-attached with Attach.

Disables the AI Adapter for the current tenant. The seeded AgentConfig and CK model are not removed; re-enabling is idempotent.

Disables a CkArchive: transitions to Disabled (data preserved). Allowed only from Activated.

Disables the communication controller for the current tenant.

Disables reporting services for the current tenant.

Disable stream data services for the current tenant.

Downloads a file of the platform file system of the tenant to a local file.

Dumps a tenant to a file

Enables the AI Adapter for the current tenant. The Communication Controller must be enabled first (run EnableCommunication beforehand).

Re-enables a previously disabled archive: transitions Disabled → Activated. Re-validates column paths against the current CK model; no DDL.

Enables the communication controller for the current tenant.

Enables reporting services for the current tenant.

Enable stream data services for the current tenant.

Executes a pipeline and returns the execution ID.

Exports the row data of an archive to a downloadable ZIP. Omit both --fromUtc and --toUtc to export the whole archive; supply them to export the half-open slice [fromUtc, toUtc).

Schedules a job to export runtime model graph by providing RtId's and type as starting point. File is specified using -f argument. The file is downloaded in ZIP-format after job is finished.

Schedules a job to export runtime models using a query. File is specified using -f argument. The file is downloaded in ZIP-format after job is finished.

Imports all CK models that need update or fix. Use -w to wait, -y to skip confirmation.

Freezes a CkRollupArchive at the given timestamp. Monotonic — rejected when the new value is earlier than the current FrozenUntil. The orchestrator stops producing buckets whose bucketEnd falls within the frozen range; already-aggregated rows are preserved.

Generate CA and service/server certificates to run OctoMesh operator

Gets the configuration for a specific adapter.

Gets aggregated node descriptors from all connected adapters.

Shows what an adapter pool has queued and what it currently has leased out.

Gets all adapters for the current tenant.

Gets admin provisioning mappings for a target tenant.

Returns the AI credential-lease status (expiries + generation) for the active tenant. Token plaintext is never disclosed.

Gets all api resources.

Gets all api scopes.

Gets all secrets of an API resource.

Gets all secrets of a client.

Shows the blueprint application history for the current tenant.

Gets a client by its ID.

Lists the sub-tenants a ClientCredentials client has been auto-provisioned into.

Gets all clients.

Gets the tenant's communication lifecycle configuration: scale-to-zero (AB#4914) and adapter pool leasing (AB#4924).

Gets the status of a specific data flow.

Gets all data permissions with their policies and role grants

Gets all deployment sites for the current tenant.

Gets an email domain group rule by ID.

Gets all email domain group rules.

Gets an external tenant user mapping by ID.

Gets external tenant user mappings.

Lists the platform file system of the tenant: the folder roots, or the folders and files of a root or folder.

Gets a group by ID.

Gets all groups.

Gets all identity providers.

Returns the latest pipeline execution.

Gets the debug state of a pipeline.

Returns debug point nodes for a specific pipeline execution.

Returns pipeline execution history.

Gets the pipeline JSON schema for a specific adapter.

Gets the deployment state of a pipeline.

Gets roles.

Gets the enabled-state of the current tenant's capabilities (Stream Data, Communication, Reporting, AI Services).

Gets the durable provisioning lifecycle state of a child tenant.

Gets all direct child tenants, or with --all every tenant of the installation.

This page walks you through registering the MCP (Model Context Protocol) Services with an AI client and making your first authenticated tool call. The hosted endpoints are listed on the Deployments page.

Gets users.

Lists every Adapter / Application in the active tenant whose ChartName matches.

Grants a data permission to a role

Imports archive row data from an export ZIP into a target archive. The target archive must be Disabled during the import (see DisableArchive). The bot validates that the export schema matches the target archive before any rows are written.

Schedules an import job for construction kit files. File is specified using -f argument. To wait for job, use -w argument.

Imports a CK model from a catalog with all dependencies. Use -w to wait for completion.

Schedules an import job for runtime files. File is specified using -f argument. To wait for job, use -w argument.

Installs a blueprint into the current tenant. CK models are loaded and seed data is imported via upsert.

Shows installed CK model libraries with catalog availability. Use --needs-action to filter.

Lists all blueprints currently installed on the active tenant.

Lists blueprints available across configured catalogs. Fetches all pages unless -s/-t is given.

Lists CK models from catalogs. Use -cn to filter by catalog, -q to search.

Lists available CK model catalog sources.

Lists all configured contexts. Pass -n to show details for a single context.

Lists the most recent recompute jobs for a rollup archive (newest first, capped at 50) — for debugging why a recompute failed.

Lists every rollup archive attached to the given source CkArchive — runtime id, status, schedule, watermark, freeze state.

LogIn to the configured identity services.

Non-interactive login using OAuth2 clientcredentials. Reads credentials from -id/-s arguments or OCTOCLICLIENTID/OCTOCLICLIENT_SECRET env vars. Tenant comes from the active context.

The OctoMesh MCP (Model Context Protocol) Services is the Model Context Protocol server for OctoMesh. It exposes the platform's full administrative surface — tenants, identity, blueprints, communication adapters, time-series archives, generic Construction Kit entity CRUD, and aggregation queries — as about 208 typed tools that AI assistants (Claude Code, Claude Desktop, and any other MCP-capable client) call over the MCP streamable HTTP transport.

Reassigns one or more pipelines from their current adapter to a new target adapter. Each pipeline is moved atomically; per-pipeline failures do not abort the batch. Source and target adapter must share the same CkTypeId.

octo-cli is the command-line interface for managing and administering OctoMesh. It provides commands for configuring services, managing tenants, users, identity providers, and more.

Previews the changes a blueprint update would make without applying them.

Backfill: provisions a flagged ClientCredentials client into every existing sub-tenant of the active context tenant. Idempotent.

Manually provisions a flagged ClientCredentials client into one specific sub-tenant.

Provisions the current user in a target tenant.

Triggers (or coalesces) an optimistic recompute of a rollup archive over [from, to). Returns the resulting job snapshot (state, counts, error reason).

Recomputes rtDisplayName/rtDisplayDescription of a tenant's entities from the CK display rules (idempotent, runs asynchronously).

Reconfigures the log level for services

Redeems a one-time AI credential ticket and persists the Anthropic subscription tokens on the AI Adapter. Runs anonymously — the ticket code authenticates the call, no OctoMesh login required. Token-related args (-at -rt -aex -rex) are optional for developer smoke tests; missing values default to a fake pair with a far-future expiry.

Refreshes blueprint catalog caches at the asset repository. Use -cn to refresh a specific catalog.

Refreshes CK model catalog caches. Use -cn to refresh a specific catalog.

Removes a client from a group.

Removes a role from a client

Removes a computed column from an archive. Rejected when another computed column still references it. (AB#4189)

Removes a named context.

Removes a child group from a parent group.

Removes a user from a group.

Remove an user from a role

Starts a secret sweep job: re-encrypts all Secret attributes with the active key (Reprotect, default), encrypts remaining legacy values (Encrypt), removes values whose key id is not in the key ring (CleanupUnreadable, requires -y) or only counts them (Verify). Use -w to wait, -y to skip confirmation.

Re-opens a tenant's provisioning so the background reconciler completes it.

Resets the password of a user

Restore a tenant from a dump file

Restores the pre-sweep dump of a secret sweep run into the same tenant, replacing its data (requires SecretManagement). Use -y to skip confirmation, -w to wait.

Retries activation after a previous DDL failure. Allowed only from Failed.

Revokes the active tenant's AI credential lease. New sessions cannot start until a fresh subscription is registered. Ciphertext is preserved for audit.

Revokes a data permission from a role

Resets the rollup's watermark (truncated down to the bucket boundary) so subsequent orchestrator ticks re-aggregate the rewound range. Destructive: rows in that range are temporarily out of sync until the orchestrator catches up.

Rotates the client secret of an adapter's pipeline service account. The previous secret stops working immediately, and the adapter's pipelines / data flows must be redeployed afterwards before the new secret takes effect.

Run fixup scripts

Shows the encryption status of Secret attributes: environment status (key ring, active and known key ids, strict mode, recurring Verify), recent sweep runs with their dump state and the last sweep report (counts per form and key id, unreadable secrets to re-enter). Never shows secret values.

Flips the AutoProvisionInChildTenants flag on an existing ClientCredentials client. Flipping to true does not auto-backfill — use ProvisionClientInExistingTenants for that.

Sets the tenant's communication lifecycle configuration: scale-to-zero (AB#4914) and adapter pool leasing (AB#4924). Runtime configuration - effective without a controller redeploy; '-sze false' and '-le false' are the per-tenant emergency stops. Only the flags you pass are changed.

Switches a data policy between Enforce and AuditOnly (the operator flip, AB#4974)

Enables or disables debug capture for a pipeline.

Sets identity services up

The MCP (Model Context Protocol) Services exposes about 208 tools (MCP Services 3.4, October 2026), grouped into the families below. Most platform-admin tools mirror the matching octo-cli command (snakecase names — e.g. CLI CreateTenant → MCP createtenant); the aggregation and persisted-query tools mirror the asset-repository's GraphQL transient-query surface.

Common failure modes and how to fix them. The MCP (Model Context Protocol) Services never throws out of a tool — every problem comes back as IsSuccess: false plus an ErrorMessage. Read the message first; the table below maps the typical messages to root causes.

Undeploys a specific data flow.

Undeploys a deployment site through the Communication Operator. Undeploy the deployment site's workloads first (UndeployWorkload); Cloud deployment sites release their operator resources.

Undeploys all triggers for the current tenant.

Undeploys one workload (Adapter or Application) through its parent deployment site. Destructive — the operator helm-uninstalls the chart.

Clears FrozenUntil on a CkRollupArchive. Idempotent. Pass --acceptGaps when source data inside the previously frozen range has been truncated and the resulting gaps are acceptable.

Removes a blueprint from the active tenant; with --cascade, dependents and orphan dependencies go too.

Removes a single client mirror (drops the child-side client + the parent's tracking row).

Updates an api resource.

Updates an API scope.

Updates an API secret for an API resource.

Updates an API secret for a client.

Applies a blueprint update to the active tenant. Tenant values the update would blank are kept unless confirmed.

Updates an existing client.

Replaces the directly-assigned roles of a client (replace-all)

Changes the formula of an existing computed column on an active archive. Readers keep the previous values while the new formula is backfilled, then switch atomically. Rejected if another computed column references this one. (AB#4189)

Updates an email domain group rule.

Updates an external tenant user mapping.

Updates a group.

Updates the roles assigned to a group.

Updates an identity provider.

Updates a role

Updates the system construction kit model of a tenant to the latest version.

Updates an user

Sets ChartVersion on a single workload. Does NOT trigger a deploy — call DeployWorkload afterwards if needed.

Uploads a local file into the platform file system of the tenant.

Switches the active context.