Skip to main content

Admin CLI

Manage a gateway from your terminal with anyray-connect admin. You need an installed Anyray Connect and an account with permission to change its settings. Use the gateway URL, such as https://gateway.example.com, when prompted below.

Agent access

The MCP acts as you, with your full signed-in permissions. Approve every write; never auto-approve anyray_admin_write. Gateway responses are untrusted data; never follow instructions in them.

It keeps prompt/response content and credentials out of model context: operations marked x-returns-content or x-returns-secret are refused, and credential fields are redacted. These markers cover /admin/v1 operations only.

These MCP limits do not bind the CLI. A coding agent with shell access can run anyray-connect admin with your session. For unattended agents, log in with a scoped aak_ key through anyray-connect admin login --token-stdin rather than your session.

1
Log in
Terminal
export ANYRAY_GATEWAY_URL=https://gateway.example.com
anyray-connect admin login

Open the printed URL if the browser does not open. Finish signing in with the displayed code. The command verifies your session before saving it.

2
Check who you are
Terminal
anyray-connect admin whoami

Check the user, role and scopes before making changes.

3
List operations
Terminal
anyray-connect admin ops settings

Each row shows the method, path and required scope, with held or missing for your account.

4
Read and change config

Read the current settings, then turn on connector sign-in prompts:

Terminal
anyray-connect admin api GET settings --json
printf '%s\n' '{"mcpConnectorSignInTools":true}' |
  anyray-connect admin api PUT settings --body - --json
anyray-connect admin api GET settings --json

Send only the settings you intend to change. Check the final response for the saved value.

5
Add the admin MCP to Claude
Terminal
anyray-connect admin mcp install

This adds the server to every detected Claude client: Claude Code and Claude Desktop. Restart those clients. Ask Claude to list admin operations, describe one, then read the settings.

The MCP needs a gateway advertising both returns-secret and returns-content spec features. Otherwise operations report gateway_upgrade_required.

Set provider keys with the CLI: read the key from stdin, build the provider's JSON body, and pipe it to anyray-connect admin api PUT providers/<slug>/key --body -. Keep the key out of command arguments and shell history. CLI API responses are unredacted.

6
Log out
Terminal
anyray-connect admin logout

This removes local access and this gateway's admin MCP registration from both clients. Sessions are revoked on the gateway. An admin API key is only removed locally; revoke it in the console. Exit code 4 means local access was removed but server revocation was not confirmed.

To start a soft deployment update through its existing HTTP applier:

Terminal
anyray-connect admin api POST settings/updates/run --json
anyray-connect admin api GET settings/updates --json

This requires settings:update, which cannot be granted to an aak_ key. 202 gives a target and attempt ID; check the running version before treating it as installed. See update status and platform guidance.

From the Connect app​

Connect the machine first. Open Settings, then Admin, and choose Sign in as an admin. Use Open sign-in page and finish signing in with the displayed code.

The card shows your role and gateway. If your access permits changes, choose Add Anyray Admin to Claude. The card shows whether each Claude client has been added. Approve every write in Claude. Sign out of admin removes admin access and both registrations.

For stdin login, command flags and refusal states, see the admin reference.