{
  "version": "0.3.0",
  "globalFlags": [
    "--json",
    "--help",
    "--no-qr",
    "--workspace"
  ],
  "commands": [
    {
      "name": "setup",
      "summary": "register the Mehen MCP server and skills in your installed agents, at user level",
      "usage": "mehen setup [--agent <name>]... [--workspaces <a,b>] [--mcp-file <path>] [--remove] [--dry-run] [--force] [--reset-env] [--print [--format json|toml]]",
      "flags": [
        {
          "name": "agent",
          "short": null,
          "type": "list"
        },
        {
          "name": "workspaces",
          "short": null,
          "type": "string"
        },
        {
          "name": "mcp-file",
          "short": null,
          "type": "string"
        },
        {
          "name": "dry-run",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "remove",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "force",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "reset-env",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "print",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "format",
          "short": null,
          "type": "string"
        }
      ],
      "examples": [
        "mehen setup --json",
        "mehen setup --agent codex --dry-run",
        "mehen setup --workspaces acme --agent claude-code",
        "mehen setup --mcp-file /path/to/mcp.json",
        "mehen setup --print --format toml",
        "mehen setup --remove"
      ],
      "notes": [
        "Agents: claude-code, codex, cursor, pi, gemini, opencode, vscode, claude-desktop. Reload or restart afterwards.",
        "One `mehen` server per agent, always `mehen mcp`, serving every workspace this machine may use. The entry carries MEHEN_WORKSPACES when this shell is restricted or --workspaces narrows it (never wider than this shell), and MEHEN_HOME for a root other than ~/.config/mehen.",
        "--mcp-file writes mcpServers.mehen into any JSON MCP client's file. --print renders the entry and writes nothing.",
        "Symlinked and foreign skills and entries are left alone unless --force, which needs the human's agreement and still refuses unsafe files; read every entry's status and reason. Settings are backed up once; --remove only undoes entries still owned by setup, and the skills stay while another entry remains.",
        "Exit 1 when a skill or an agent file failed; 2 when every agent was skipped."
      ],
      "help": "usage: mehen setup [--agent <name>]... [--workspaces <a,b>] [--mcp-file <path>] [--remove] [--dry-run] [--force] [--reset-env] [--print [--format json|toml]]\n  register the Mehen MCP server and skills in your installed agents, at user level\n\nexamples:\n  mehen setup --json\n  mehen setup --agent codex --dry-run\n  mehen setup --workspaces acme --agent claude-code\n  mehen setup --mcp-file /path/to/mcp.json\n  mehen setup --print --format toml\n  mehen setup --remove\n\n  Agents: claude-code, codex, cursor, pi, gemini, opencode, vscode, claude-desktop. Reload or restart afterwards.\n  One `mehen` server per agent, always `mehen mcp`, serving every workspace this machine may use. The entry carries MEHEN_WORKSPACES when this shell is restricted or --workspaces narrows it (never wider than this shell), and MEHEN_HOME for a root other than ~/.config/mehen.\n  --mcp-file writes mcpServers.mehen into any JSON MCP client's file. --print renders the entry and writes nothing.\n  Symlinked and foreign skills and entries are left alone unless --force, which needs the human's agreement and still refuses unsafe files; read every entry's status and reason. Settings are backed up once; --remove only undoes entries still owned by setup, and the skills stay while another entry remains.\n  Exit 1 when a skill or an agent file failed; 2 when every agent was skipped.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "update",
      "summary": "check for or install a signed Mehen release and refresh managed skills",
      "usage": "mehen update [--check] [--force] [--version <v>] [--rollback]",
      "flags": [
        {
          "name": "check",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "force",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "version",
          "short": null,
          "type": "string"
        },
        {
          "name": "rollback",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "background",
          "short": null,
          "type": "boolean"
        }
      ],
      "examples": [
        "mehen update --check --json",
        "mehen update --json",
        "mehen update --rollback --json"
      ],
      "notes": [
        "Installs only a release signed by a key this build trusts, newer than the one running, after a smoke test of the new binary; the previous binary is kept for --rollback.",
        "--check only reports. --force installs the signed release named even when it is not newer. No sudo; the installed binary's directory must be writable. Exit 0 also when another update holds the lock."
      ],
      "help": "usage: mehen update [--check] [--force] [--version <v>] [--rollback]\n  check for or install a signed Mehen release and refresh managed skills\n\nexamples:\n  mehen update --check --json\n  mehen update --json\n  mehen update --rollback --json\n\n  Installs only a release signed by a key this build trusts, newer than the one running, after a smoke test of the new binary; the previous binary is kept for --rollback.\n  --check only reports. --force installs the signed release named even when it is not newer. No sudo; the installed binary's directory must be writable. Exit 0 also when another update holds the lock.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "enrol",
      "summary": "enrol this machine in a workspace: prints the link a human accepts in the browser, then mehen wait finishes it; the key is kept across attempts",
      "usage": "mehen enrol --workspace <slug> [--name <machine-name>] [--team <team-slug>] [--backend secure-enclave|software] [--fresh-key] [--wait] [--no-renew] [--connect <code>]",
      "flags": [
        {
          "name": "name",
          "short": null,
          "type": "string"
        },
        {
          "name": "team",
          "short": null,
          "type": "string"
        },
        {
          "name": "backend",
          "short": null,
          "type": "string"
        },
        {
          "name": "fresh-key",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "wait",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "no-renew",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "connect",
          "short": null,
          "type": "string"
        }
      ],
      "examples": [
        "mehen enrol --workspace acme --name my-laptop",
        "mehen enrol --workspace acme --name ci-runner --team ci --backend software --json"
      ],
      "notes": [
        "The slug is on the workspace's Connect an agent page. Your own machine: you accept it yourself with your passkey. --team: an owner or admin admits it as the team's machine.",
        "Prints the link and exits 0: relay it, then run `mehen wait enr_...` until it is accepted; it keeps the link alive while it waits. --wait waits here instead.",
        "Each workspace gets its own slot under the config root (MEHEN_HOME, default ~/.config/mehen); running it again resumes the same attempt with the same key."
      ],
      "help": "usage: mehen enrol --workspace <slug> [--name <machine-name>] [--team <team-slug>] [--backend secure-enclave|software] [--fresh-key] [--wait] [--no-renew] [--connect <code>]\n  enrol this machine in a workspace: prints the link a human accepts in the browser, then mehen wait finishes it; the key is kept across attempts\n\nexamples:\n  mehen enrol --workspace acme --name my-laptop\n  mehen enrol --workspace acme --name ci-runner --team ci --backend software --json\n\n  The slug is on the workspace's Connect an agent page. Your own machine: you accept it yourself with your passkey. --team: an owner or admin admits it as the team's machine.\n  Prints the link and exits 0: relay it, then run `mehen wait enr_...` until it is accepted; it keeps the link alive while it waits. --wait waits here instead.\n  Each workspace gets its own slot under the config root (MEHEN_HOME, default ~/.config/mehen); running it again resumes the same attempt with the same key.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "status",
      "summary": "show every workspace this machine is in, or one with --workspace",
      "usage": "mehen status [--workspace <slug or id>]",
      "flags": [],
      "examples": [
        "mehen status",
        "mehen status --json",
        "mehen status --workspace acme"
      ],
      "notes": [
        "Lists every workspace slot this machine may use (active, pending, ended with the key kept, corrupt, and MEHEN_WORKSPACES entries not enrolled yet), each active one checked with the vault; a failing check is reported, never deleted. Exit 0.",
        "With --workspace (or MEHEN_WORKSPACE): that one workspace's status; not enrolled is exit 6 with next.command mehen enrol --workspace <slug>. When something else is wrong, mehen doctor checks everything at once."
      ],
      "help": "usage: mehen status [--workspace <slug or id>]\n  show every workspace this machine is in, or one with --workspace\n\nexamples:\n  mehen status\n  mehen status --json\n  mehen status --workspace acme\n\n  Lists every workspace slot this machine may use (active, pending, ended with the key kept, corrupt, and MEHEN_WORKSPACES entries not enrolled yet), each active one checked with the vault; a failing check is reported, never deleted. Exit 0.\n  With --workspace (or MEHEN_WORKSPACE): that one workspace's status; not enrolled is exit 6 with next.command mehen enrol --workspace <slug>. When something else is wrong, mehen doctor checks everything at once.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "whoami",
      "summary": "same as mehen status",
      "usage": "mehen whoami",
      "flags": [],
      "examples": [
        "mehen whoami --json"
      ],
      "notes": [
        "Lists every workspace slot this machine may use (active, pending, ended with the key kept, corrupt, and MEHEN_WORKSPACES entries not enrolled yet), each active one checked with the vault; a failing check is reported, never deleted. Exit 0.",
        "With --workspace (or MEHEN_WORKSPACE): that one workspace's status; not enrolled is exit 6 with next.command mehen enrol --workspace <slug>. When something else is wrong, mehen doctor checks everything at once."
      ],
      "help": "usage: mehen whoami\n  same as mehen status\n\nexamples:\n  mehen whoami --json\n\n  Lists every workspace slot this machine may use (active, pending, ended with the key kept, corrupt, and MEHEN_WORKSPACES entries not enrolled yet), each active one checked with the vault; a failing check is reported, never deleted. Exit 0.\n  With --workspace (or MEHEN_WORKSPACE): that one workspace's status; not enrolled is exit 6 with next.command mehen enrol --workspace <slug>. When something else is wrong, mehen doctor checks everything at once.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "doctor",
      "summary": "check in one go: every workspace on this machine, its key, the vaults, the clock, identity, session label, frozen, and what to do next",
      "usage": "mehen doctor",
      "flags": [],
      "examples": [
        "mehen doctor",
        "mehen doctor --json"
      ],
      "notes": [
        "Exits 0 when no check failed, else with the exit code of the first failure. Works before enrolment. The checks never migrate, write or delete anything: strays under the config root are named, not removed. As after any command, the background updater may run afterwards when a check for a new release is due."
      ],
      "help": "usage: mehen doctor\n  check in one go: every workspace on this machine, its key, the vaults, the clock, identity, session label, frozen, and what to do next\n\nexamples:\n  mehen doctor\n  mehen doctor --json\n\n  Exits 0 when no check failed, else with the exit code of the first failure. Works before enrolment. The checks never migrate, write or delete anything: strays under the config root are named, not removed. As after any command, the background updater may run afterwards when a check for a new release is due.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "ls",
      "summary": "list the items this machine may use",
      "usage": "mehen ls [--tag <tag>] [--kind <kind>] [--provider <provider>]",
      "flags": [
        {
          "name": "tag",
          "short": null,
          "type": "string"
        },
        {
          "name": "kind",
          "short": null,
          "type": "string"
        },
        {
          "name": "provider",
          "short": null,
          "type": "string"
        }
      ],
      "examples": [
        "mehen ls",
        "mehen ls --kind api-key --json",
        "mehen ls --provider openai"
      ],
      "notes": [],
      "help": "usage: mehen ls [--tag <tag>] [--kind <kind>] [--provider <provider>]\n  list the items this machine may use\n\nexamples:\n  mehen ls\n  mehen ls --kind api-key --json\n  mehen ls --provider openai\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "show",
      "summary": "show an item's public metadata (never its value)",
      "usage": "mehen show <item>",
      "flags": [],
      "examples": [
        "mehen show openai-personal",
        "mehen show gmail-personal --json"
      ],
      "notes": [
        "Never the value: for each secret field, whether it is set, its length, a well-known prefix and a fingerprint."
      ],
      "help": "usage: mehen show <item>\n  show an item's public metadata (never its value)\n\nexamples:\n  mehen show openai-personal\n  mehen show gmail-personal --json\n\n  Never the value: for each secret field, whether it is set, its length, a well-known prefix and a fingerprint.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "templates",
      "summary": "list the credential templates and OAuth providers an agent may name (no network)",
      "usage": "mehen templates [<id>]",
      "flags": [],
      "examples": [
        "mehen templates",
        "mehen templates google-gmail --json"
      ],
      "notes": [],
      "help": "usage: mehen templates [<id>]\n  list the credential templates and OAuth providers an agent may name (no network)\n\nexamples:\n  mehen templates\n  mehen templates google-gmail --json\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "check",
      "summary": "evaluate an item's base policy locally (advisory, not permission to send)",
      "usage": "mehen check <item> <METHOD> <URL> [-H 'Name: value']... [-d @file|-|text]",
      "flags": [
        {
          "name": "header",
          "short": "H",
          "type": "list"
        },
        {
          "name": "data",
          "short": "d",
          "type": "string"
        }
      ],
      "examples": [
        "mehen check openai-personal GET https://api.openai.com/v1/models",
        "mehen check gmail-personal POST https://gmail.googleapis.com/gmail/v1/users/me/messages/send -d @message.json --json"
      ],
      "notes": [
        "Exits 0 (base allow), 3 (base approval) or 5 (base refusal).",
        "Fetches the item's public metadata from the vault and evaluates its base binding and policy locally. It sends no request upstream and creates no approval. Its answer is advisory, not permission to send; live scope, protection, policy floors and grants can change the result."
      ],
      "help": "usage: mehen check <item> <METHOD> <URL> [-H 'Name: value']... [-d @file|-|text]\n  evaluate an item's base policy locally (advisory, not permission to send)\n\nexamples:\n  mehen check openai-personal GET https://api.openai.com/v1/models\n  mehen check gmail-personal POST https://gmail.googleapis.com/gmail/v1/users/me/messages/send -d @message.json --json\n\n  Exits 0 (base allow), 3 (base approval) or 5 (base refusal).\n  Fetches the item's public metadata from the vault and evaluates its base binding and policy locally. It sends no request upstream and creates no approval. Its answer is advisory, not permission to send; live scope, protection, policy floors and grants can change the result.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "request",
      "summary": "ask a human for a credential (prints the link for them)",
      "usage": "mehen request <kind> --name <slug> --reason <why> [--provider <template>] [--home private|project|workspace] [--project <prj_id>] [--tag <tag>]... [--host <host>]... [--path <glob>]... [--header <name> --format \"Bearer {key}\"] [--wait] [--new] [--timeout <duration>]",
      "flags": [
        {
          "name": "name",
          "short": null,
          "type": "string"
        },
        {
          "name": "home",
          "short": null,
          "type": "string"
        },
        {
          "name": "project",
          "short": null,
          "type": "string"
        },
        {
          "name": "provider",
          "short": null,
          "type": "string"
        },
        {
          "name": "reason",
          "short": null,
          "type": "string"
        },
        {
          "name": "tag",
          "short": null,
          "type": "list"
        },
        {
          "name": "host",
          "short": null,
          "type": "list"
        },
        {
          "name": "path",
          "short": null,
          "type": "list"
        },
        {
          "name": "header",
          "short": null,
          "type": "string"
        },
        {
          "name": "format",
          "short": null,
          "type": "string"
        },
        {
          "name": "wait",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "new",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "timeout",
          "short": null,
          "type": "string"
        }
      ],
      "examples": [
        "mehen request api-key --name openai-personal --provider openai --reason 'run the nightly evals against the OpenAI API' --json",
        "mehen request api-key --name snyk --host api.snyk.io --header Authorization --format 'token {key}' --reason 'scan this repo'\\''s dependencies'",
        "mehen request api-key --name openai-team --provider openai --home project --project prj_3kQ9vXyZ7 --reason 'run the evals for this project'"
      ],
      "notes": [
        "Prints the ask block for the human; the value goes into the vault page, never through you. mehen templates lists the providers.",
        "Naming a credential this machine can already reach asks the human to rotate it instead: --home and --provider must match it, only its secret fields are replaced, and its binding and policy stay.",
        "Without --provider, the item holds every request for a human's approval unless the human lets reads through on the page.",
        "--home says who the credential belongs to: private (only the owner, the default), project (needs --project or the checkout's mehen.toml) or workspace. The human may change it on the page."
      ],
      "help": "usage: mehen request <kind> --name <slug> --reason <why> [--provider <template>] [--home private|project|workspace] [--project <prj_id>] [--tag <tag>]... [--host <host>]... [--path <glob>]... [--header <name> --format \"Bearer {key}\"] [--wait] [--new] [--timeout <duration>]\n  ask a human for a credential (prints the link for them)\n\nexamples:\n  mehen request api-key --name openai-personal --provider openai --reason 'run the nightly evals against the OpenAI API' --json\n  mehen request api-key --name snyk --host api.snyk.io --header Authorization --format 'token {key}' --reason 'scan this repo'\\''s dependencies'\n  mehen request api-key --name openai-team --provider openai --home project --project prj_3kQ9vXyZ7 --reason 'run the evals for this project'\n\n  Prints the ask block for the human; the value goes into the vault page, never through you. mehen templates lists the providers.\n  Naming a credential this machine can already reach asks the human to rotate it instead: --home and --provider must match it, only its secret fields are replaced, and its binding and policy stay.\n  Without --provider, the item holds every request for a human's approval unless the human lets reads through on the page.\n  --home says who the credential belongs to: private (only the owner, the default), project (needs --project or the checkout's mehen.toml) or workspace. The human may change it on the page.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "connect",
      "summary": "ask a human to connect an OAuth account (prints the link for them)",
      "usage": "mehen connect <provider> --name <slug> --reason <why> [--client <oauth-client-item>] [--home private|project|workspace] [--project <prj_id>] [--scopes a,b] [--expect <account>] [--request-client] [--client-tag <tag>]... [--wait] [--new] [--timeout <duration>]",
      "flags": [
        {
          "name": "client",
          "short": null,
          "type": "string"
        },
        {
          "name": "name",
          "short": null,
          "type": "string"
        },
        {
          "name": "home",
          "short": null,
          "type": "string"
        },
        {
          "name": "project",
          "short": null,
          "type": "string"
        },
        {
          "name": "scopes",
          "short": null,
          "type": "list"
        },
        {
          "name": "expect",
          "short": null,
          "type": "string"
        },
        {
          "name": "reason",
          "short": null,
          "type": "string"
        },
        {
          "name": "request-client",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "client-tag",
          "short": null,
          "type": "list"
        },
        {
          "name": "wait",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "new",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "timeout",
          "short": null,
          "type": "string"
        }
      ],
      "examples": [
        "mehen connect google-gmail --name gmail-personal --expect you@example.com --reason 'read and draft replies in your inbox' --request-client --json",
        "mehen connect github-oauth --name github-personal --scopes read:user,repo --reason 'open pull requests for you'"
      ],
      "notes": [
        "With no OAuth client in the vault it exits 4 (client_missing) with the mehen request to run; --request-client asks for the client first, in one chain.",
        "--home as for mehen request: private by default, project with --project or the checkout's mehen.toml, or workspace."
      ],
      "help": "usage: mehen connect <provider> --name <slug> --reason <why> [--client <oauth-client-item>] [--home private|project|workspace] [--project <prj_id>] [--scopes a,b] [--expect <account>] [--request-client] [--client-tag <tag>]... [--wait] [--new] [--timeout <duration>]\n  ask a human to connect an OAuth account (prints the link for them)\n\nexamples:\n  mehen connect google-gmail --name gmail-personal --expect you@example.com --reason 'read and draft replies in your inbox' --request-client --json\n  mehen connect github-oauth --name github-personal --scopes read:user,repo --reason 'open pull requests for you'\n\n  With no OAuth client in the vault it exits 4 (client_missing) with the mehen request to run; --request-client asks for the client first, in one chain.\n  --home as for mehen request: private by default, project with --project or the checkout's mehen.toml, or workspace.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "wait",
      "summary": "wait for an intake (int_), approval (apr_), connection (con_), enrolment (enr_) or policy proposal (pol_)",
      "usage": "mehen wait <id> [--timeout <duration>] [--json [--events]]",
      "flags": [
        {
          "name": "timeout",
          "short": null,
          "type": "string"
        },
        {
          "name": "events",
          "short": null,
          "type": "boolean"
        }
      ],
      "examples": [
        "mehen wait int_3kQ9vXyZ7 --timeout 10m",
        "mehen wait apr_7Hq2 --json --events"
      ],
      "notes": [
        "A human who has not acted by the timeout is exit 4 (timeout) with the ask handed back: relay it again and wait again. Ctrl-C leaves the link valid."
      ],
      "help": "usage: mehen wait <id> [--timeout <duration>] [--json [--events]]\n  wait for an intake (int_), approval (apr_), connection (con_), enrolment (enr_) or policy proposal (pol_)\n\nexamples:\n  mehen wait int_3kQ9vXyZ7 --timeout 10m\n  mehen wait apr_7Hq2 --json --events\n\n  A human who has not acted by the timeout is exit 4 (timeout) with the ask handed back: relay it again and wait again. Ctrl-C leaves the link valid.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "pending",
      "summary": "list the asks still waiting for a human, or show one again (mehen pending [<id>|<slug>])",
      "usage": "mehen pending [<id>|<slug>]",
      "flags": [],
      "examples": [
        "mehen pending",
        "mehen pending apr_7Hq2 --json"
      ],
      "notes": [],
      "help": "usage: mehen pending [<id>|<slug>]\n  list the asks still waiting for a human, or show one again (mehen pending [<id>|<slug>])\n\nexamples:\n  mehen pending\n  mehen pending apr_7Hq2 --json\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "policy",
      "summary": "read policy or stop access; preview and propose are unavailable in this release",
      "usage": "mehen policy show <item> | preview --file <path|-> | propose --file <path|-> | propose --item <slug> --policy-mode <relaxed|yolo> (--session|--device) --host <host> --method <METHOD> --path <pattern> --anchor-path <path> --reason <text> | cancel <pol_id> | stop <pov_id|gnt_id>",
      "flags": [
        {
          "name": "file",
          "short": null,
          "type": "list"
        },
        {
          "name": "new",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "session",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "device",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "item",
          "short": null,
          "type": "list"
        },
        {
          "name": "policy-mode",
          "short": null,
          "type": "list"
        },
        {
          "name": "action",
          "short": null,
          "type": "list"
        },
        {
          "name": "host",
          "short": null,
          "type": "list"
        },
        {
          "name": "method",
          "short": null,
          "type": "list"
        },
        {
          "name": "path",
          "short": null,
          "type": "list"
        },
        {
          "name": "anchor-path",
          "short": null,
          "type": "list"
        },
        {
          "name": "reason",
          "short": null,
          "type": "list"
        },
        {
          "name": "for",
          "short": null,
          "type": "list"
        },
        {
          "name": "until",
          "short": null,
          "type": "list"
        }
      ],
      "examples": [
        "mehen policy show example-key",
        "mehen policy preview --file proposal.json",
        "mehen policy propose --file - --json",
        "mehen policy stop pov_example"
      ],
      "notes": [
        "Preview and propose are retained in the command surface but are refused by the current workspace server (forbidden: Policy widening is not available yet). No access changes before a human's passkey decision.",
        "Choose --session with MEHEN_SESSION set, or --device for access shared by any program on this device. No run scope or automatic renewal.",
        "--for accepts seconds, 10m or 2h. --until requires an ISO timestamp with timezone. They are mutually exclusive.",
        "File preview is PolicyPreviewRequest; file propose is PolicyPropose, including preview's baseDigest and slotRevision. --new replaces only your pending proposal."
      ],
      "help": "usage: mehen policy show <item> | preview --file <path|-> | propose --file <path|-> | propose --item <slug> --policy-mode <relaxed|yolo> (--session|--device) --host <host> --method <METHOD> --path <pattern> --anchor-path <path> --reason <text> | cancel <pol_id> | stop <pov_id|gnt_id>\n  read policy or stop access; preview and propose are unavailable in this release\n\nexamples:\n  mehen policy show example-key\n  mehen policy preview --file proposal.json\n  mehen policy propose --file - --json\n  mehen policy stop pov_example\n\n  Preview and propose are retained in the command surface but are refused by the current workspace server (forbidden: Policy widening is not available yet). No access changes before a human's passkey decision.\n  Choose --session with MEHEN_SESSION set, or --device for access shared by any program on this device. No run scope or automatic renewal.\n  --for accepts seconds, 10m or 2h. --until requires an ISO timestamp with timezone. They are mutually exclusive.\n  File preview is PolicyPreviewRequest; file propose is PolicyPropose, including preview's baseDigest and slotRevision. --new replaces only your pending proposal.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "fetch",
      "summary": "make an HTTP request with an item's credential, through the vault",
      "usage": "mehen fetch <item> <METHOD> <URL> [-H 'Name: value']... [-d @file|-|text] [--project <prj_id> --env <name>] [--approval apr_...] [--fail] [-o <file>] [--select <path>] [-i] [--max-time <duration>]   (or mehen fetch --run <run> <METHOD> <URL>)",
      "flags": [
        {
          "name": "header",
          "short": "H",
          "type": "list"
        },
        {
          "name": "project",
          "short": null,
          "type": "string"
        },
        {
          "name": "env",
          "short": null,
          "type": "string"
        },
        {
          "name": "data",
          "short": "d",
          "type": "string"
        },
        {
          "name": "run",
          "short": null,
          "type": "string"
        },
        {
          "name": "approval",
          "short": null,
          "type": "string"
        },
        {
          "name": "fail",
          "short": null,
          "type": "boolean"
        },
        {
          "name": "output",
          "short": "o",
          "type": "string"
        },
        {
          "name": "select",
          "short": null,
          "type": "string"
        },
        {
          "name": "include",
          "short": "i",
          "type": "boolean"
        },
        {
          "name": "max-time",
          "short": null,
          "type": "string"
        }
      ],
      "examples": [
        "mehen fetch openai-personal GET https://api.openai.com/v1/models --select data.0.id",
        "mehen fetch openai-personal POST https://api.openai.com/v1/responses -H 'Content-Type: application/json' -d @body.json",
        "mehen fetch github-work GET https://api.github.com/repos/acme/app/tarball -o app.tar.gz --max-time 2m",
        "mehen fetch stripe-prod GET https://api.stripe.com/v1/balance --project prj_3kQ9vXyZ7 --env prod"
      ],
      "notes": [
        "The response body goes to stdout as the vault returns it; the status and Mehen-Item go to stderr. Any upstream status exits 0 unless --fail.",
        "The vault may already have decompressed or scrubbed the body and removed response headers; it is not a byte-for-byte copy of the original upstream response.",
        "Never set an auth header yourself: the vault injects the credential where the item says.",
        "--project and --env name the project environment the credential is used for; a protected, team or guest credential needs them. They never change the workspace."
      ],
      "help": "usage: mehen fetch <item> <METHOD> <URL> [-H 'Name: value']... [-d @file|-|text] [--project <prj_id> --env <name>] [--approval apr_...] [--fail] [-o <file>] [--select <path>] [-i] [--max-time <duration>]   (or mehen fetch --run <run> <METHOD> <URL>)\n  make an HTTP request with an item's credential, through the vault\n\nexamples:\n  mehen fetch openai-personal GET https://api.openai.com/v1/models --select data.0.id\n  mehen fetch openai-personal POST https://api.openai.com/v1/responses -H 'Content-Type: application/json' -d @body.json\n  mehen fetch github-work GET https://api.github.com/repos/acme/app/tarball -o app.tar.gz --max-time 2m\n  mehen fetch stripe-prod GET https://api.stripe.com/v1/balance --project prj_3kQ9vXyZ7 --env prod\n\n  The response body goes to stdout as the vault returns it; the status and Mehen-Item go to stderr. Any upstream status exits 0 unless --fail.\n  The vault may already have decompressed or scrubbed the body and removed response headers; it is not a byte-for-byte copy of the original upstream response.\n  Never set an auth header yourself: the vault injects the credential where the item says.\n  --project and --env name the project environment the credential is used for; a protected, team or guest credential needs them. They never change the workspace.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "revoke",
      "summary": "revoke this workspace's device key and forget it locally",
      "usage": "mehen revoke [--workspace <slug or id>]",
      "flags": [],
      "examples": [
        "mehen revoke",
        "mehen revoke --workspace acme"
      ],
      "notes": [
        "Irreversible for this key: a human must accept a new enrolment before this machine can use the workspace again. Only the selected workspace is revoked; other workspaces' keys stay.",
        "The slot is removed when the vault revokes the device or says it was revoked already; any other answer leaves it, and `mehen workspace forget --slot <path>` retires it without the vault."
      ],
      "help": "usage: mehen revoke [--workspace <slug or id>]\n  revoke this workspace's device key and forget it locally\n\nexamples:\n  mehen revoke\n  mehen revoke --workspace acme\n\n  Irreversible for this key: a human must accept a new enrolment before this machine can use the workspace again. Only the selected workspace is revoked; other workspaces' keys stay.\n  The slot is removed when the vault revokes the device or says it was revoked already; any other answer leaves it, and `mehen workspace forget --slot <path>` retires it without the vault.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "freeze",
      "summary": "freeze the whole workspace: every use is refused until a human unfreezes it",
      "usage": "mehen freeze",
      "flags": [],
      "examples": [
        "mehen freeze"
      ],
      "notes": [
        "For an emergency, such as a leaked key or an agent acting strangely. Only a human with a passkey can unfreeze."
      ],
      "help": "usage: mehen freeze\n  freeze the whole workspace: every use is refused until a human unfreezes it\n\nexamples:\n  mehen freeze\n\n  For an emergency, such as a leaked key or an agent acting strangely. Only a human with a passkey can unfreeze.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "guide",
      "summary": "how agents use the vault: references, intake, next, exit codes",
      "usage": "mehen guide",
      "flags": [],
      "examples": [
        "mehen guide"
      ],
      "notes": [],
      "help": "usage: mehen guide\n  how agents use the vault: references, intake, next, exit codes\n\nexamples:\n  mehen guide\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "version",
      "summary": "print the mehen version and the commit it was built from",
      "usage": "mehen version",
      "flags": [
        {
          "name": "extract-helper",
          "short": null,
          "type": "string"
        }
      ],
      "examples": [
        "mehen version --json"
      ],
      "notes": [
        "--json prints { version, commit, build, helper }; commit and build are null when mehen runs from source."
      ],
      "help": "usage: mehen version\n  print the mehen version and the commit it was built from\n\nexamples:\n  mehen version --json\n\n  --json prints { version, commit, build, helper }; commit and build are null when mehen runs from source.\n\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "run",
      "summary": "run a command with the project's variables (mehen run [--env <env>] -- <command>)",
      "usage": "mehen run [--env <env>] [--approval <id>] [--] <command> [args...]",
      "flags": [
        {
          "name": "env",
          "short": null,
          "type": null
        },
        {
          "name": "approval",
          "short": null,
          "type": null
        }
      ],
      "examples": [],
      "notes": [],
      "help": "usage: mehen run [--env <env>] [--approval <id>] [--] <command> [args...]\n  run a command with the project's variables (mehen run [--env <env>] -- <command>)"
    },
    {
      "name": "env",
      "summary": "list, check or set the project's variables (mehen env ls|check|set)",
      "usage": "mehen env ls [--env <env>] [--json] | mehen env check [--env <env>] [--json] | mehen env set <NAME> --env <env> [--item <slug> [--field <field>]] [--plain <value>]",
      "flags": [
        {
          "name": "env",
          "short": null,
          "type": null
        },
        {
          "name": "json",
          "short": null,
          "type": null
        },
        {
          "name": "item",
          "short": null,
          "type": null
        },
        {
          "name": "field",
          "short": null,
          "type": null
        },
        {
          "name": "plain",
          "short": null,
          "type": null
        }
      ],
      "examples": [],
      "notes": [],
      "help": "usage: mehen env ls [--env <env>] [--json] | mehen env check [--env <env>] [--json] | mehen env set <NAME> --env <env> [--item <slug> [--field <field>]] [--plain <value>]\n  list, check or set the project's variables (mehen env ls|check|set)"
    },
    {
      "name": "init",
      "summary": "create the project and write mehen.toml",
      "usage": "mehen init [--slug <slug>] [--env <name>]...",
      "flags": [
        {
          "name": "slug",
          "short": null,
          "type": null
        },
        {
          "name": "env",
          "short": null,
          "type": null
        }
      ],
      "examples": [],
      "notes": [],
      "help": "usage: mehen init [--slug <slug>] [--env <name>]...\n  create the project and write mehen.toml"
    },
    {
      "name": "workspace",
      "summary": "list, show, forget or bind a checkout to this machine's workspaces (mehen workspace list|show|forget|bind)",
      "usage": "mehen workspace list [--check] | show | forget (<slug or id> | --slot <path>) | bind",
      "flags": [
        {
          "name": "check",
          "short": null,
          "type": null
        },
        {
          "name": "slot",
          "short": null,
          "type": null
        }
      ],
      "examples": [
        "mehen workspace list --json",
        "mehen workspace show",
        "mehen workspace forget acme",
        "mehen workspace bind"
      ],
      "notes": [
        "list shows every workspace slot on this machine (active, pending, ended with the key kept, corrupt, and MEHEN_WORKSPACES entries not enrolled yet) without talking to the vault; --check asks each vault whether the enrolment still works and records a renamed workspace's new slug and name.",
        "show says which workspace --workspace, MEHEN_WORKSPACE, the checkout's mehen.toml or the only enrolment picks here, and why.",
        "forget retires one slot on this machine only (its key, config and ledger, or a pending enrolment); the device stays on the devices page until an owner revokes it. --slot <path> names a duplicate or unreadable slot.",
        "bind finds which enrolled workspace holds the checkout's project and writes workspace and vault into mehen.toml; it refuses when none or several do.",
        "--json prints one JSON object per line on stdout, errors included. More: mehen guide."
      ],
      "help": "usage: mehen workspace list [--check] | show | forget (<slug or id> | --slot <path>) | bind\n  list, show, forget or bind a checkout to this machine's workspaces (mehen workspace list|show|forget|bind)\n\nexamples:\n  mehen workspace list --json\n  mehen workspace show\n  mehen workspace forget acme\n  mehen workspace bind\n\n  list shows every workspace slot on this machine (active, pending, ended with the key kept, corrupt, and MEHEN_WORKSPACES entries not enrolled yet) without talking to the vault; --check asks each vault whether the enrolment still works and records a renamed workspace's new slug and name.\n  show says which workspace --workspace, MEHEN_WORKSPACE, the checkout's mehen.toml or the only enrolment picks here, and why.\n  forget retires one slot on this machine only (its key, config and ledger, or a pending enrolment); the device stays on the devices page until an owner revokes it. --slot <path> names a duplicate or unreadable slot.\n  bind finds which enrolled workspace holds the checkout's project and writes workspace and vault into mehen.toml; it refuses when none or several do.\n  --json prints one JSON object per line on stdout, errors included. More: mehen guide."
    },
    {
      "name": "mcp",
      "summary": "serve the vault tools over MCP on stdio",
      "usage": "mehen mcp [--workspace <slug or id>]",
      "flags": [
        {
          "name": "workspace",
          "short": null,
          "type": null
        }
      ],
      "examples": [],
      "notes": [
        "Speaks MCP over stdin and stdout; a host (Claude Desktop, Cursor, pi) starts it as a command.",
        "The tools share core operations and enforcement with the mehen commands, and never return a secret value. Their inputs, output shapes, timeouts and body limits differ: vault_fetch, for one, returns at most 256 KiB of body text.",
        "Tools: vault_status, vault_doctor, vault_templates, vault_list, vault_show, vault_check, vault_request, vault_connect, vault_fetch, vault_env, vault_wait, vault_pending, vault_policy (policy widening is not available on the server in this release; propose and preview are refused).",
        "One server spans every workspace MEHEN_WORKSPACES allows under the config root (MEHEN_HOME; every one when it is unset), including one enrolled while it runs. Every tool but vault_templates takes an optional workspace (slug or id); with more than one workspace, a call names one unless the checkout's mehen.toml binds it. vault_status lists them.",
        "--workspace (or MEHEN_WORKSPACE) pins the server to one workspace, and a call naming another is refused. A workspace's enrolment is latched on first use: if it changes on disk while the server runs, that workspace is refused until the agent restarts; the others keep working.",
        "Enrol this machine first with mehen enrol --workspace <slug>; until it is accepted only vault_status, vault_doctor, vault_templates, vault_pending and vault_wait (for the enr_ id mehen enrol started) answer."
      ],
      "help": "usage: mehen mcp [--workspace <slug or id>]\n  serve the vault tools over MCP on stdio\n\n  Speaks MCP over stdin and stdout; a host (Claude Desktop, Cursor, pi) starts it as a command.\n  The tools share core operations and enforcement with the mehen commands, and never return a secret value. Their inputs, output shapes, timeouts and body limits differ: vault_fetch, for one, returns at most 256 KiB of body text.\n  Tools: vault_status, vault_doctor, vault_templates, vault_list, vault_show, vault_check, vault_request, vault_connect, vault_fetch, vault_env, vault_wait, vault_pending, vault_policy (policy widening is not available on the server in this release; propose and preview are refused).\n  One server spans every workspace MEHEN_WORKSPACES allows under the config root (MEHEN_HOME; every one when it is unset), including one enrolled while it runs. Every tool but vault_templates takes an optional workspace (slug or id); with more than one workspace, a call names one unless the checkout's mehen.toml binds it. vault_status lists them.\n  --workspace (or MEHEN_WORKSPACE) pins the server to one workspace, and a call naming another is refused. A workspace's enrolment is latched on first use: if it changes on disk while the server runs, that workspace is refused until the agent restarts; the others keep working.\n  Enrol this machine first with mehen enrol --workspace <slug>; until it is accepted only vault_status, vault_doctor, vault_templates, vault_pending and vault_wait (for the enr_ id mehen enrol started) answer."
    }
  ]
}