The SaaS-replacement platform Shared system for teams and agents. Official CLI + GraphQL surface.

Official CLI product tour

`mbr` is the official product tour for Move Big Rocks.

If you want to know what using Move Big Rocks actually looks like, start here. This page is the official product tour. Agents should inspect it before inferring anything from browser copy. Humans should usually ask their agent to use this page and `/agents` together, then review deeper proof surfaces once the product shape is clear. The CLI is the primary human and agent entry point for owned-runtime bootstrap, auth, context, work primitives, knowledge, automation, extensions, and runtime health.

Install the CLI Open the agent bootstrap
Official product tour: Humans should usually ask their agent to inspect this page and brief them before they browse deeper proof, trust, and deployment surfaces.

Table of contents

Section map.

Jump directly to the part you need.

The CLI is the primary supported machine interface. CLI principles Runtime discovery belongs to explicit bootstrap surfaces, not HTML scraping. Runtime discovery The CLI exposes two practical auth modes and different write scopes. Authentication and write scope The core command surface is broad, explicit, and inspectable. Command surface Read-only inspection comes before mutation or deployment work. Read-only inspection tour These are the main write paths after inspection. Writable action classes Extension-specific admin verbs do not belong in the core CLI. Extension discovery The CLI supports multiple extension bundle sources and trust inputs. Extension installation sources The CLI talks to GraphQL plus a small set of dedicated HTTP endpoints. Transport boundary These short command loops show what using the product actually looks like. Concrete agent loops CLI usage should keep evaluation and operations legible. Agent operating rules

Quickstart

Tour Move Big Rocks through the CLI.

This is the shortest concrete path from public discovery to a live runtime you control and the first read-only inspection. Use it as the official product tour before you make broader deployment or extension decisions.

1. Create the private instance repo

The owned-runtime path begins with the instance template and validated desired state.

$ gh repo create acme/mbr-prod --private --template MoveBigRocks/instance-template --clone$ cd mbr-prod$ scripts/read-instance-config.sh mbr.instance.yaml

2. Log in and store local config

The CLI stores instance, API, and GraphQL URLs plus the principal identity it authenticated as.

$ mbr auth login --url https://app.yourdomain.com --json{  "instanceURL": "https://app.yourdomain.com",  "apiBaseURL": "https://api.yourdomain.com",  "adminBaseURL": "https://admin.yourdomain.com",  "graphqlURL": "https://api.yourdomain.com/graphql",  "principalType": "User",  "principalID": "user_123"}

3. Set context and inspect the contract

Use explicit context, then inspect the machine-readable command contract directly.

$ mbr context set --workspace ws_preview --team team_operations --json$ mbr spec export --json

4. Inspect the product shape

Read the live primitives before you mutate anything.

$ mbr queues list --workspace ws_preview --json$ mbr cases list --workspace ws_preview --json$ mbr knowledge list --workspace ws_preview --search policy --json$ mbr extensions list --workspace ws_preview --json$ mbr health check --url https://app.yourdomain.com --json

CLI principles

The CLI is the primary supported machine interface.

The platform contract is explicit about what the CLI is for. This is not a convenience wrapper around browser actions. It is the main human and agent surface.

Proof bundle

  • Contract docs/AGENT_CLI.md Defines the supported agent CLI contract, auth modes, and command surface.
  • Contract docs/swagger.yaml Documents the public API surface, auth model, and health endpoints.
  • Implementation cmd/api/routers.go Implements the split between `/graphql`, `/admin/graphql`, public routes, and authenticated agent surfaces.
  • Enforcement .github/workflows/_test.yml Verifies builds, tests, and contract-sensitive paths on the public platform codebase.

Primary entry point

The command-line interface is the primary human and agent entry point for Move Big Rocks.

Every command supports `--json`

The public contract assumes machine-readable output on every command family so hosts can reason on structured results.

Stable machine behavior

Exit codes are stable and machine-friendly, and write operations follow backend idempotency requirements where applicable.

One contract across hosts

Optional connectors such as OpenClaw or future MCP surfaces should compose over the same CLI and GraphQL semantics rather than inventing a second contract.

Canonical backend API

GraphQL is underneath

The CLI is the better first surface for product inspection. GraphQL remains the canonical backend API when direct integration is required.

Open resource

Runtime discovery

Runtime discovery belongs to explicit bootstrap surfaces, not HTML scraping.

Once `mbr` is installed or a runtime URL is known, the discovery path should stay deterministic: create or select a runtime you control, read the runtime bootstrap endpoint, then continue through CLI and GraphQL.

Proof bundle

  • Contract docs/AGENT_CLI.md Defines the supported agent CLI contract, auth modes, and command surface.
  • Contract docs/swagger.yaml Documents the public API surface, auth model, and health endpoints.
  • Implementation cmd/api/routers.go Implements the split between `/graphql`, `/admin/graphql`, public routes, and authenticated agent surfaces.
  • Enforcement .github/workflows/_test.yml Verifies builds, tests, and contract-sensitive paths on the public platform codebase.

Read the runtime bootstrap from your own instance

Once a runtime exists, the agent should move through explicit bootstrap and auth surfaces rather than guessing from browser state.

$ curl -fsSL https://app.yourdomain.com/.well-known/mbr-instance.json$ mbr auth login --url https://app.yourdomain.com --json$ mbr auth whoami --json$ mbr spec export --json

Authentication and write scope

The CLI exposes two practical auth modes and different write scopes.

The public contract distinguishes interactive browser login from non-interactive agent-token use. Agents should understand which command families work with bearer tokens, which need a browser-backed session, and which only mutate local CLI state.

Proof bundle

  • Contract docs/AGENT_CLI.md Defines the supported agent CLI contract, auth modes, and command surface.
  • Contract docs/swagger.yaml Documents the public API surface, auth model, and health endpoints.
  • Implementation cmd/api/routers.go Implements the split between `/graphql`, `/admin/graphql`, public routes, and authenticated agent surfaces.
  • Enforcement .github/workflows/_test.yml Verifies builds, tests, and contract-sensitive paths on the public platform codebase.

Interactive browser login

`mbr auth login` opens the browser when no token is supplied, completes login against the admin surface, and stores session-backed CLI auth locally.

Workspace-scoped `hat_*` tokens

Non-interactive automation and installed extensions authenticate with workspace-scoped bearer tokens through `--token` or `MBR_TOKEN`.

Local-only commands

`mbr auth login`, `auth logout`, `context view`, `context set`, and `spec export` all affect or read local CLI state rather than mutating remote product records.

Browser-session-only writes

Some high-trust writes remain browser-session-backed, including `workspaces create`, `teams create`, `teams members add`, `agents create/update/...`, `forms create`, and `automation rules create`.

Bearer-token and session-backed shared surface

Most reads and many workspace-scoped writes work through either bearer-token auth or a browser-backed session, including queues, conversations, cases, knowledge, and extensions.

Interactive browser login

Use this when the CLI should establish a browser-backed session against a runtime.

$ mbr auth login --url https://app.yourdomain.com --json$ mbr auth whoami --json$ mbr context view --json

Non-interactive token-backed usage

Use bearer tokens for automation, agent hosts, and installed extension flows.

$ MBR_TOKEN=hat_example mbr auth whoami --url https://app.yourdomain.com --json$ MBR_TOKEN=hat_example mbr queues list --workspace ws_123 --url https://app.yourdomain.com --json$ MBR_TOKEN=hat_example mbr knowledge search "refund policy" --workspace ws_123 --url https://app.yourdomain.com --json

Command surface

The core command surface is broad, explicit, and inspectable.

Use `mbr` when you want the product shape to stay inspectable. The command families map directly to the operational primitives and lifecycle surfaces agents need to reason about, so you are not starting from a blank framework or a thin wrapper around one-off apps. The excerpts below are grouped from the canonical generated command surface in `docs/AGENT_CLI.md`.

Proof bundle

  • Contract docs/AGENT_CLI.md Defines the supported agent CLI contract, auth modes, and command surface.
  • Contract docs/swagger.yaml Documents the public API surface, auth model, and health endpoints.
  • Implementation cmd/api/routers.go Implements the split between `/graphql`, `/admin/graphql`, public routes, and authenticated agent surfaces.
  • Enforcement .github/workflows/_test.yml Verifies builds, tests, and contract-sensitive paths on the public platform codebase.

Discovery and local state

Auth, context, and `spec export` establish runtime selection, local state, and command-contract awareness.

Topology and access

Workspaces, teams, agents, memberships, and catalog commands expose system topology, ownership, and access control.

Intake and work execution

Forms, queues, conversations, cases, contacts, and automation commands expose the main operational work loop.

Shared knowledge and memory

Knowledge, concepts, and artifacts commands expose durable context, concept specs, and extension-managed content surfaces.

Runtime and bounded capability

Extensions, attachments, and health commands expose packaging, runtime diagnostics, activation state, and support surfaces.

Auth, context, and spec

These commands establish runtime discovery, local state, and the machine-readable contract itself.

mbr auth whoami [--url URL] [--token TOKEN] [--json]mbr auth login --url URL [--token TOKEN | --token-stdin] [--json]mbr auth logoutmbr context view [--json]mbr context set [--workspace WORKSPACE_ID] [--team TEAM_ID] [--clear-team | --clear] [--json]mbr spec export [--json]

Workspaces, teams, and agents

These commands expose topology, ownership, team state, and explicit agent access control.

mbr workspaces list [--url URL] [--token TOKEN] [--json]mbr workspaces create --name NAME --slug SLUG [--description TEXT] [--url URL] [--json]mbr teams list [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr teams create [--workspace WORKSPACE_ID] --name NAME [--description TEXT] [--email ADDRESS] [--response-hours N] [--resolution-hours N] [--auto-assign] [--auto-assign-keywords CSV] [--inactive] [--url URL] [--token TOKEN] [--json]mbr teams show TEAM_ID [--url URL] [--token TOKEN] [--json]mbr teams members list [--team TEAM_ID] [--url URL] [--token TOKEN] [--json]mbr teams members add [--team TEAM_ID] --user USER_ID [--role ROLE] [--url URL] [--token TOKEN] [--json]mbr agents list [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr agents show AGENT_ID [--url URL] [--token TOKEN] [--json]mbr agents create [--workspace WORKSPACE_ID] --name NAME [--description TEXT] [--url URL] [--token TOKEN] [--json]mbr agents update AGENT_ID [--name NAME] [--description TEXT] [--url URL] [--token TOKEN] [--json]mbr agents memberships grant AGENT_ID [--workspace WORKSPACE_ID] [--role ROLE] [--permissions CSV] [--expires-in-days N] [--input-file PATH | --input-json JSON] [--allowed-ips CSV] [--allowed-projects CSV] [--allowed-teams CSV] [--allow-delegated-routing[=BOOL]] [--delegated-routing-teams CSV] [--active-hours-start HH:MM] [--active-hours-end HH:MM] [--active-timezone TZ] [--active-days CSV] [--rate-limit-per-minute N] [--rate-limit-per-hour N] [--url URL] [--token TOKEN] [--json]

Forms, queues, conversations, cases, and automation

These commands expose intake, routing, live interaction, durable casework, and rule-driven follow-through.

mbr forms specs list [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr forms specs show SPEC_ID_OR_SLUG [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr forms specs create [--workspace WORKSPACE_ID] (--input-file PATH | --input-json JSON) [--url URL] [--token TOKEN] [--json]mbr forms submissions list [--workspace WORKSPACE_ID] [--spec SPEC_ID] [--status STATUS] [--limit N] [--offset N] [--url URL] [--token TOKEN] [--json]mbr forms submissions create SPEC_ID_OR_SLUG [--workspace WORKSPACE_ID] (--input-file PATH | --input-json JSON) [--url URL] [--token TOKEN] [--json]mbr queues list [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr queues show QUEUE_ID [--url URL] [--token TOKEN] [--json]mbr queues create [--workspace WORKSPACE_ID] --name NAME [--slug SLUG] [--description TEXT] [--url URL] [--token TOKEN] [--json]mbr queues items QUEUE_ID [--url URL] [--token TOKEN] [--json]mbr conversations list [--workspace WORKSPACE_ID] [--status STATUS] [--channel CHANNEL] [--catalog-node NODE_ID] [--contact CONTACT_ID] [--case CASE_ID] [--limit N] [--offset N] [--url URL] [--token TOKEN] [--json]mbr conversations reply SESSION_ID [--participant PARTICIPANT_ID] [--role ROLE] [--kind KIND] [--visibility VISIBILITY] (--content TEXT | --file PATH) [--url URL] [--token TOKEN] [--json]mbr conversations handoff SESSION_ID --queue QUEUE_ID [--team TEAM_ID] [--operator USER_ID] [--reason TEXT] [--url URL] [--token TOKEN] [--json]mbr conversations escalate SESSION_ID --queue QUEUE_ID [--team TEAM_ID] [--operator USER_ID] [--subject TEXT] [--description TEXT] [--priority PRIORITY] [--category TEXT] [--reason TEXT] [--url URL] [--token TOKEN] [--json]mbr cases list [--workspace WORKSPACE_ID] [--status STATUS] [--priority PRIORITY] [--queue QUEUE_ID] [--assignee USER_ID] [--limit N] [--url URL] [--token TOKEN] [--json]mbr cases show CASE_ID [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr cases set-status CASE_ID --status STATUS [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr cases handoff CASE_ID --queue QUEUE_ID [--team TEAM_ID] [--assignee USER_ID] [--reason TEXT] [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr automation rules list [--workspace WORKSPACE_ID] [--limit N] [--url URL] [--token TOKEN] [--json]mbr automation rules create [--workspace WORKSPACE_ID] --title TITLE (--conditions-file PATH | --conditions-json JSON) (--actions-file PATH | --actions-json JSON) [--description TEXT] [--active] [--priority N] [--max-per-hour N] [--max-per-day N] [--url URL] [--token TOKEN] [--json]

Knowledge, concepts, and artifacts

These commands expose shared knowledge, concept definitions, and extension-managed content-bearing surfaces.

mbr knowledge list [--workspace WORKSPACE_ID] [--team TEAM_ID] [--surface SURFACE] [--review-status STATUS] [--kind KIND] [--status STATUS] [--search QUERY] [--limit N] [--url URL] [--token TOKEN] [--json]mbr knowledge show RESOURCE [--workspace WORKSPACE_ID --team TEAM_ID --surface SURFACE] [--url URL] [--token TOKEN] [--json]mbr knowledge search QUERY [--workspace WORKSPACE_ID] [--team TEAM_ID] [--surface SURFACE] [--review-status STATUS] [--kind KIND] [--status STATUS] [--limit N] [--url URL] [--token TOKEN] [--json]mbr knowledge review-queue [--workspace WORKSPACE_ID] [--team TEAM_ID] [--kind KIND] [--review-status STATUS] [--limit N] [--url URL] [--token TOKEN] [--json]mbr knowledge upsert [RESOURCE] [--workspace WORKSPACE_ID] [--team TEAM_ID] --slug SLUG [--surface SURFACE] [--title TITLE] [--kind KIND] [--concept-spec KEY] [--concept-version VERSION] [--status STATUS] [--summary TEXT] [--body TEXT | --file PATH] [--source-kind KIND] [--source-ref REF] [--path-ref PATH] [--channels CSV] [--share-with CSV] [--keywords CSV] [--frontmatter-file PATH | --frontmatter-json JSON] [--url URL] [--token TOKEN] [--json]mbr knowledge checkout PATH [--workspace WORKSPACE_ID] [--team TEAM_ID] [--surface SURFACE] [--kind KIND] [--review-status STATUS] [--status STATUS] [--search QUERY] [--url URL] [--token TOKEN] [--json]mbr knowledge status [PATH] [--url URL] [--token TOKEN] [--json]mbr knowledge pull [PATH] [--url URL] [--token TOKEN] [--json]mbr knowledge push [PATH] [--url URL] [--token TOKEN] [--json]mbr knowledge sync PATH [--workspace WORKSPACE_ID] [--team TEAM_ID] [--surface SURFACE] [--kind KIND] [--concept-spec KEY] [--concept-version VERSION] [--status STATUS] [--review-status STATUS] [--share-with TEAM_IDS] [--source-kind KIND] [--source-ref REF] [--url URL] [--token TOKEN] [--json]mbr knowledge import PATH [--workspace WORKSPACE_ID] [--team TEAM_ID] [--surface SURFACE] [--kind KIND] [--concept-spec KEY] [--concept-version VERSION] [--status STATUS] [--review-status STATUS] [--share-with TEAM_IDS] [--source-kind KIND] [--source-ref REF] [--mode preview|apply] [--url URL] [--token TOKEN] [--json]mbr concepts list [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr concepts show KEY [--workspace WORKSPACE_ID] [--version VERSION] [--url URL] [--token TOKEN] [--json]mbr concepts register FILE [--workspace WORKSPACE_ID] [--team TEAM_ID] [--source-kind KIND] [--source-ref REF] [--status STATUS] [--url URL] [--token TOKEN] [--json]mbr artifacts list --extension EXTENSION_ID --surface SURFACE [--url URL] [--token TOKEN] [--json]mbr artifacts show --extension EXTENSION_ID --surface SURFACE --path PATH [--ref REVISION] [--url URL] [--token TOKEN] [--json]mbr artifacts publish --extension EXTENSION_ID --surface SURFACE --path PATH (--file FILE | --content TEXT) [--url URL] [--token TOKEN] [--json]

Attachments, health, and extension lifecycle

These commands expose support surfaces, runtime identity checks, and the bounded extension lifecycle.

mbr contacts list [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr attachments upload PATH [--workspace WORKSPACE_ID] [--case CASE_ID] [--description TEXT] [--content-type MIME] [--url URL] [--token TOKEN] [--json]mbr health check [--url URL] [--token TOKEN] [--json]mbr extensions list ([--workspace WORKSPACE_ID] | --instance) [--url URL] [--token TOKEN] [--json]mbr extensions show --id EXTENSION_ID [--url URL] [--token TOKEN] [--json]mbr extensions deploy BUNDLE_SOURCE [--workspace WORKSPACE_ID] [--license-token TOKEN] [--config-file PATH | --config-json JSON] [--no-activate] [--no-monitor] [--url URL] [--token TOKEN] [--json]mbr extensions monitor --id EXTENSION_ID [--url URL] [--token TOKEN] [--json]mbr extensions events list [--workspace WORKSPACE_ID] [--url URL] [--token TOKEN] [--json]mbr extensions skills list --id EXTENSION_ID [--url URL] [--token TOKEN] [--json]mbr extensions skills show --id EXTENSION_ID --name SKILL_NAME [--url URL] [--token TOKEN] [--json]mbr extensions install BUNDLE_SOURCE [--workspace WORKSPACE_ID] [--license-token TOKEN] [--url URL] [--token TOKEN] [--json]mbr extensions upgrade BUNDLE_SOURCE --id EXTENSION_ID [--license-token TOKEN] [--url URL] [--token TOKEN] [--json]mbr extensions configure --id EXTENSION_ID (--config-file PATH | --config-json JSON) [--url URL] [--token TOKEN] [--json]mbr extensions validate --id EXTENSION_ID [--url URL] [--token TOKEN] [--json]mbr extensions activate --id EXTENSION_ID [--url URL] [--token TOKEN] [--json]mbr extensions deactivate --id EXTENSION_ID [--reason TEXT] [--url URL] [--token TOKEN] [--json]

Read-only inspection tour

Read-only inspection comes before mutation or deployment work.

This default inspection sequence shows the product through the real command surface instead of through browser scraping or short site summaries.

Inspect the authenticated identity

Verify whether the CLI is operating as a user or an agent and which GraphQL endpoint it is pinned to.

$ mbr auth whoami --json{  "type": "User",  "id": "user_123",  "name": "Reviewer Name",  "graphqlURL": "https://api.yourdomain.com/graphql"}

Inspect the CLI contract itself

Use the machine-readable command spec when an agent needs to know what verbs, auth modes, and idempotency rules exist.

$ mbr spec export --json

Inspect work in motion

Queues, conversations, and cases are the clearest concrete evidence of the shared operational model.

$ mbr queues list --workspace ws_preview --json$ mbr conversations list --workspace ws_preview --json$ mbr cases list --workspace ws_preview --status open --json

Inspect shared knowledge and memory

Knowledge and concept specs show how Move Big Rocks keeps policy, context, and templates inside the same system as the work.

$ mbr knowledge list --workspace ws_preview --search policy --json$ mbr concepts list --workspace ws_preview --json

Inspect extensions and runtime health

Use this sequence to understand what capability slices are installed and what runtime you are talking to.

$ mbr extensions list --workspace ws_preview --json$ mbr health check --url https://app.yourdomain.com --json

Writable action classes

These are the main write paths after inspection.

The CLI is not only a read surface. It is also the main command surface for explicit writes against shared operational records and extension lifecycle events.

Forms and intake

`mbr forms specs create`, `forms specs update`, and `forms submissions create` drive structured intake before work is routed.

Queues and cases

`mbr queues create`, `mbr cases set-status`, and `mbr cases handoff` drive durable work ownership.

Conversations

`mbr conversations reply`, `handoff`, and `escalate` keep live interaction tied to the same operational model.

Knowledge

`mbr knowledge upsert`, `review`, `publish`, `share`, `pull`, and `push` manage durable context and review state.

Automation rules

`mbr automation rules list` and `create` expose explicit rule-based follow-through on top of shared records.

Agents and memberships

`mbr agents create`, `update`, `suspend`, `activate`, `tokens create`, and `memberships grant` manage agent access explicitly.

Extensions

`mbr extensions install`, `validate`, `activate`, `configure`, `monitor`, and `events list` drive bounded extension lifecycle work.

Forms and submissions

Use explicit form specs and submissions when intake should stay structured before it becomes queue or case work.

$ mbr forms specs list --workspace ws_preview --json$ mbr forms specs show intake-request --workspace ws_preview --json$ mbr forms submissions create intake-request --workspace ws_preview --input-json '{"title":"Need access","category":"finance"}' --json

Queue and case operations

Use queue and case verbs when the job is durable operational follow-through rather than one-off scripting.

$ mbr queues create --workspace ws_preview --name Ops --slug ops --json$ mbr cases list --workspace ws_preview --status open --json$ mbr cases set-status case_123 --status resolved --workspace ws_preview --json

Knowledge update path

Use explicit upsert, review, and publish verbs rather than treating operational knowledge as ad hoc files.

$ mbr knowledge upsert handbook/api-policy --workspace ws_preview --team team_operations --slug api-policy --title "API policy" --kind policy --body "..." --json$ mbr knowledge review handbook/api-policy --workspace ws_preview --team team_operations --status reviewed --json$ mbr knowledge publish handbook/api-policy --workspace ws_preview --team team_operations --to-surface workspace_shared --json

Extension lifecycle path

Use the same CLI surface for source verification, installation, and runtime inspection rather than inventing a separate extension toolchain.

$ mbr extensions lint ./my-extension --json$ mbr extensions verify ./my-extension --workspace ws_preview --json$ mbr extensions nav --instance --json$ mbr extensions widgets --instance --json$ mbr extensions events list --workspace ws_preview --json

Automation rule path

Use automation rules when follow-through should stay visible and bounded by explicit conditions and actions.

$ mbr automation rules list --workspace ws_preview --json$ mbr automation rules create --workspace ws_preview --title "Escalate urgent payment failures" --conditions-file conditions.json --actions-file actions.json --active --json

Extension discovery

Extension-specific admin verbs do not belong in the core CLI.

The core CLI stays stable by exposing extension metadata, runtime diagnostics, event catalogs, and bundled agent skills instead of hardcoding product-specific binaries or per-extension verbs into the core command surface.

Proof bundle

Extension manifests declare extra capability

Extensions publish their own command catalogs and bundled skill assets through the extension manifest and asset bundle rather than forcing changes into the core CLI.

Use runtime discovery surfaces

Use `mbr extensions show`, `nav`, `widgets`, and `monitor` to inspect runtime diagnostics, resolved menu placement, workspace and instance visibility, service health, scheduled jobs, event consumers, and latest errors.

Use workspace event catalogs

Use `mbr extensions events list --workspace ...` to inspect core and extension-published event types plus publisher/subscriber relationships.

Use bundled skills

Use `mbr extensions skills list/show` to discover agent-usable Markdown skills shipped with a bounded extension.

Keep core flows in core

Forms and automation remain on the core CLI through `mbr forms ...` and `mbr automation rules ...` even when extensions add deeper capability slices.

Inspect extension runtime state and skills

Use these commands to understand what a bounded extension adds without assuming custom binaries exist.

$ mbr extensions lint ./my-extension --json$ mbr extensions verify ./my-extension --workspace ws_preview --json$ mbr extensions show --id ext_123 --json$ mbr extensions nav --workspace ws_preview --json$ mbr extensions nav --instance --json$ mbr extensions widgets --instance --json$ mbr extensions monitor --id ext_123 --json$ mbr extensions events list --workspace ws_preview --json$ mbr extensions skills list --id ext_123 --json$ mbr extensions skills show --id ext_123 --name review-candidates --json

Extension installation sources

The CLI supports multiple extension bundle sources and trust inputs.

The public contract already defines the supported bundle source shapes and the resolver inputs around them. Agents should use these supported forms rather than inventing private installation flows.

Proof bundle

  • The current public first-party default is signed OCI refs such as `ghcr.io/movebigrocks/mbr-ext-ats:<version>` rather than a marketplace alias.
  • `--license-token` is optional and mainly matters for instance-bound or marketplace-managed bundle flows.
  • `MBR_MARKETPLACE_URL` points the CLI at the marketplace alias resolver when a private catalog is in use.
  • `MBR_REGISTRY_TOKEN` provides bearer auth for private OCI registries.
  • `MBR_REGISTRY_USERNAME` and `MBR_REGISTRY_PASSWORD` provide basic auth when bearer auth is not used.
  • Server-side trust enforcement can require signed bundle installs through `INSTANCE_ID`, `EXTENSION_TRUST_REQUIRE_VERIFICATION=true`, and `EXTENSION_TRUSTED_PUBLISHERS_JSON`.
  • When a bundle is instance-scoped, the CLI can install and later list it with `mbr extensions list --instance`.

Supported bundle source forms

These example forms are documented in the canonical CLI contract.

$ mbr extensions install ./my-extension --workspace ws_123$ mbr extensions install ./dist/my-extension.hext --workspace ws_123$ mbr extensions install https://downloads.example.com/my-extension-0.1.0.hext --workspace ws_123$ mbr extensions install ghcr.io/example/my-extension:v0.1.0 --workspace ws_123$ mbr extensions install vendor/my-extension@0.1.0 --workspace ws_123 --license-token LICENSE_TOKEN

Transport boundary

The CLI talks to GraphQL plus a small set of dedicated HTTP endpoints.

The transport contract is simple: most reads and writes go through GraphQL; a few auth, upload, and bundle-transfer flows use dedicated HTTP endpoints. Agents should know this boundary so they switch to GraphQL deliberately rather than by guesswork.

Proof bundle

`POST /graphql`

Default CLI and agent backend path for most reads and writes.

`POST /admin/graphql`

Browser-session-backed admin path for high-trust human workflows. Do not treat it as the default agent path.

Dedicated HTTP endpoints

Auth bootstrap, file upload, and extension bundle transfer use a small set of dedicated HTTP endpoints beside GraphQL.

MCP is not a separate product surface

If MCP exists, it should adapt the same auth model, permissions, and semantics rather than introducing MCP-only business logic.

Use GraphQL directly only when needed

This direct query path is appropriate when the CLI is too high-level or an integration already operates over HTTP.

$ curl -sS https://api.your-app-domain/graphql \  -H "Authorization: Bearer hat_YOUR_TOKEN_HERE" \  -H "Content-Type: application/json" \  -d '{"query":"query { __typename }"}'

Concrete agent loops

These short command loops show what using the product actually looks like.

Use these as concrete examples of the shared operational model in action. They are intentionally compact and stay on the supported CLI contract.

Agent-assisted queue triage loop

Inspect queued work, read the live conversation, pull in shared knowledge, reply, then hand off or resolve the durable case.

$ mbr queues items queue_ops --json$ mbr conversations show sess_123 --json$ mbr knowledge search "refund policy" --workspace ws_preview --json$ mbr conversations reply sess_123 --content "I checked the policy and here is the next step." --json$ mbr cases handoff case_123 --queue queue_finance --reason "Needs finance approval" --workspace ws_preview --json$ mbr cases set-status case_123 --status resolved --workspace ws_preview --json

Extension install and verification loop

Install a bounded extension into a workspace, validate and activate it, then inspect runtime health, menu placement, and bundled skills.

$ mbr extensions install ghcr.io/movebigrocks/mbr-ext-ats:v0.8.21 --workspace ws_preview$ mbr extensions validate --id ext_123 --json$ mbr extensions activate --id ext_123 --json$ mbr extensions show --id ext_123 --json$ mbr extensions nav --workspace ws_preview --json$ mbr extensions nav --instance --json$ mbr extensions monitor --id ext_123 --json$ mbr extensions skills list --id ext_123 --json

Agent operating rules

CLI usage should keep evaluation and operations legible.

The CLI is strongest when agents treat it as the explicit contract for product interaction rather than as a thin wrapper around browser actions.

  • Prefer `--json` on every command so follow-up reasoning stays machine-parseable.
  • Default to `mbr spec export`, `auth whoami`, runtime bootstrap reads, and read-only list/show commands before mutations.
  • Use `mbr context set` so later commands stay explicit about workspace and team scope.
  • If a product-specific verb is not in the core CLI, look for extension-declared skills, event catalogs, or GraphQL instead of inventing a private binary.
  • Use GraphQL directly only when the CLI is too high-level or when lower-level integration is required.
  • Treat MCP or other host connectors as adapters over the same CLI and GraphQL semantics, not as a separate source of truth.
  • Treat deployment, permissions, and production extension activation as human-visible decisions even when the CLI can drive the mechanics.

References

Canonical next surfaces.

Each link goes to the next authoritative page, reference, or support surface.

Move Big Rocks

Let agents inspect the CLI-first surface. Let humans decide trust, rollout, and boundaries.

Start from /agents, use /docs/cli as the official product tour, inspect /resources for source and proof, and review /security before making deployment or data-handling decisions.

Open /agents Open resources