Command line

The ibexctl command talks to the daemon. Every command takes --json for machine-readable output. This page is generated from the program’s own help.

ibexctl

IbexWall control CLI

Usage: ibexctl [OPTIONS] <COMMAND>

Commands:
  status     Daemon and host information
  plugins    Plugin management
  check      Run checks (all enabled plugins, or one)
  findings   List findings
  plan       Simulate a change: build a previewable plan from a patch
  apply      Apply a plan
  confirm    Confirm a pending transaction
  rollback   Roll back a transaction
  history    Recent transactions
  audit      Audit chain operations
  events     Live events
  apps       Applications seen by the connection monitor
  mcp        Connect an AI assistant (MCP) to IbexWall
  proposals  Changes an assistant proposed, waiting for a human decision
  prompts    Connections held in Ask mode, waiting for an answer
  firewall   The inbound firewall: what is allowed in, and changes to it
  tui        Interactive terminal UI

Options:
      --json     Emit machine-readable JSON for every command
  -h, --help     Print help
  -V, --version  Print version

ibexctl status

Daemon and host information

Usage: ibexctl status [OPTIONS]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl plugins

Plugin management

Usage: ibexctl plugins [OPTIONS] <COMMAND>

Commands:
  list
  info
  enable
  disable

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl plugins list

Usage: ibexctl plugins list [OPTIONS]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl plugins info

Usage: ibexctl plugins info [OPTIONS] <ID>

Arguments:
  <ID>

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl plugins enable

Usage: ibexctl plugins enable [OPTIONS] <ID>

Arguments:
  <ID>

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl plugins disable

Usage: ibexctl plugins disable [OPTIONS] <ID>

Arguments:
  <ID>

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl check

Run checks (all enabled plugins, or one)

Usage: ibexctl check [OPTIONS] [PLUGIN]

Arguments:
  [PLUGIN]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl findings

List findings

Usage: ibexctl findings [OPTIONS]

Options:
      --json             Emit machine-readable JSON for every command
      --plugin <PLUGIN>
  -h, --help             Print help

ibexctl plan

Simulate a change: build a previewable plan from a patch

Usage: ibexctl plan [OPTIONS] <PLUGIN>

Arguments:
  <PLUGIN>

Options:
      --json                 Emit machine-readable JSON for every command
      --set <KEY=VALUE>      Setting for the plugin config, e.g. --set template=dropin
      --set-file <KEY=PATH>  Setting whose value is a file's text, e.g. --set-file profile=lab.conf
  -h, --help                 Print help

ibexctl apply

Apply a plan

Usage: ibexctl apply [OPTIONS] <PLAN_ID>

Arguments:
  <PLAN_ID>

Options:
      --confirm-timeout <CONFIRM_TIMEOUT>  Confirmation window in seconds for network-risk plans
      --json                               Emit machine-readable JSON for every command
  -h, --help                               Print help

ibexctl confirm

Confirm a pending transaction

Usage: ibexctl confirm [OPTIONS] <TRANSACTION_ID>

Arguments:
  <TRANSACTION_ID>

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl rollback

Roll back a transaction

Usage: ibexctl rollback [OPTIONS] <TARGET>

Arguments:
  <TARGET>

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl history

Recent transactions

Usage: ibexctl history [OPTIONS]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl audit

Audit chain operations

Usage: ibexctl audit [OPTIONS] <COMMAND>

Commands:
  verify  Validate the audit hash chain

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl audit verify

Validate the audit hash chain

Usage: ibexctl audit verify [OPTIONS]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl events

Live events

Usage: ibexctl events [OPTIONS]

Options:
      --follow
      --json    Emit machine-readable JSON for every command
  -h, --help    Print help

ibexctl apps

Applications seen by the connection monitor

Usage: ibexctl apps [OPTIONS] <COMMAND>

Commands:
  list     Every application seen, most recently active first
  info     One application and where it connects (key from `apps list`)
  default  What apps nobody decided about may do: allow, monitor or ask
  set      Choose what an application may do on the network

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl apps list

Every application seen, most recently active first

Usage: ibexctl apps list [OPTIONS]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl apps info

One application and where it connects (key from `apps list`)

Usage: ibexctl apps info [OPTIONS] <APP>

Arguments:
  <APP>

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl apps default

What apps nobody decided about may do: allow, monitor or ask

Usage: ibexctl apps default [OPTIONS] <MODE>

Arguments:
  <MODE>  [possible values: allow, monitor, ask]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl apps set

Choose what an application may do on the network

Usage: ibexctl apps set [OPTIONS] <APP> <MODE>

Arguments:
  <APP>   Key from `apps list`
  <MODE>  [possible values: allow, monitor, ask, block]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl mcp

Connect an AI assistant (MCP) to IbexWall

Usage: ibexctl mcp [OPTIONS] <COMMAND>

Commands:
  config  What to paste to connect a client, and the matching mcp.toml stanza
  token   Make an access token for an assistant on another machine and plan the change that lets it in. The token is shown once; only its hash is sent

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl mcp config

What to paste to connect a client, and the matching mcp.toml stanza

Usage: ibexctl mcp config [OPTIONS] <CLIENT>

Arguments:
  <CLIENT>  [possible values: claude-code, opencode, vscode]

Options:
      --json                         Emit machine-readable JSON for every command
      --with-proposals               Show the stanza with change proposals allowed
      --url <https://HOST:PORT/mcp>  Reach `ibexwall-mcp --http` on another machine (https only)
  -h, --help                         Print help

ibexctl mcp token

Make an access token for an assistant on another machine and plan the change that lets it in. The token is shown once; only its hash is sent

Usage: ibexctl mcp token [OPTIONS] --name <NAME>

Options:
      --json               Emit machine-readable JSON for every command
      --name <NAME>        What the token is for, e.g. "work laptop"
      --preset <PRESET>    What the assistant may do: read, plan or propose [default: read]
      --client <CLIENT>    The client entry it belongs to (default: `remote-ID`)
      --id <ID>            Three to sixteen lowercase letters or digits (default: random)
      --expires <EXPIRES>  Last day it works, YYYY-MM-DD
      --secret-stdin       Read your own secret from standard input instead of generating one
  -h, --help               Print help

ibexctl proposals

Changes an assistant proposed, waiting for a human decision

Usage: ibexctl proposals [OPTIONS] <COMMAND>

Commands:
  list     The proposals, newest first (pending by default)
  show     What one proposal would do
  approve  Approve: the plan is made again and applied if it is what was shown
  reject   Reject: nothing is applied

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl proposals list

The proposals, newest first (pending by default)

Usage: ibexctl proposals list [OPTIONS]

Options:
      --json             Emit machine-readable JSON for every command
      --status <STATUS>  [possible values: pending, approved, rejected, expired]
  -h, --help             Print help

ibexctl proposals show

What one proposal would do

Usage: ibexctl proposals show [OPTIONS] <ID>

Arguments:
  <ID>

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl proposals approve

Approve: the plan is made again and applied if it is what was shown

Usage: ibexctl proposals approve [OPTIONS] <ID>

Arguments:
  <ID>

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl proposals reject

Reject: nothing is applied

Usage: ibexctl proposals reject [OPTIONS] <ID>

Arguments:
  <ID>

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl prompts

Connections held in Ask mode, waiting for an answer

Usage: ibexctl prompts [OPTIONS] <COMMAND>

Commands:
  list    The open questions
  answer  Answer one: allow or block, for this connection, this destination or the whole app

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl prompts list

The open questions

Usage: ibexctl prompts list [OPTIONS]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl prompts answer

Answer one: allow or block, for this connection, this destination or the whole app

Usage: ibexctl prompts answer [OPTIONS] <ID> <DECISION>

Arguments:
  <ID>
  <DECISION>  [possible values: allow, block]

Options:
      --json           Emit machine-readable JSON for every command
      --scope <SCOPE>  [default: once] [possible values: once, destination, always]
  -h, --help           Print help

ibexctl firewall

The inbound firewall: what is allowed in, and changes to it

Usage: ibexctl firewall [OPTIONS] <COMMAND>

Commands:
  status   What the firewall allows today
  allow    Let a port or a service in: `8080/tcp`, `53/udp` or `service:http`
  profile  Network profiles (home, work, public, travel): with no name, list them; with a name, switch to it (firewalld only)
  deny     Stop letting a port or a service in

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl firewall status

What the firewall allows today

Usage: ibexctl firewall status [OPTIONS]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help

ibexctl firewall allow

Let a port or a service in: `8080/tcp`, `53/udp` or `service:http`

Usage: ibexctl firewall allow [OPTIONS] <TARGET>

Arguments:
  <TARGET>

Options:
      --json  Emit machine-readable JSON for every command
      --yes   Apply it now (otherwise only the plan is shown)
  -h, --help  Print help

ibexctl firewall profile

Network profiles (home, work, public, travel): with no name, list them; with a name, switch to it (firewalld only)

Usage: ibexctl firewall profile [OPTIONS] [NAME]

Arguments:
  [NAME]

Options:
      --json  Emit machine-readable JSON for every command
      --yes   Apply it now (otherwise only the plan is shown)
  -h, --help  Print help

ibexctl firewall deny

Stop letting a port or a service in

Usage: ibexctl firewall deny [OPTIONS] <TARGET>

Arguments:
  <TARGET>

Options:
      --json  Emit machine-readable JSON for every command
      --yes   Apply it now (otherwise only the plan is shown)
  -h, --help  Print help

ibexctl tui

Interactive terminal UI

Usage: ibexctl tui [OPTIONS]

Options:
      --json  Emit machine-readable JSON for every command
  -h, --help  Print help