Skip to content
Upstate Docs
Log in Open Upstate

Operate with confidence

CLI and coding agents

Use the Upstate CLI for project setup and terminal inspection. Connect a coding agent through the hosted MCP endpoint when you want it to read production evidence while working with your local application code.

Use the CLI

Follow Getting started to install and connect a project. In that repository:

upstate status
upstate receipt
upstate doctor

The CLI's browser-approved session belongs to the account you approved. Project configuration contains safe identifiers; credentials stay in protected user configuration storage outside the repository.

Use upstate auth logout to revoke the human CLI session and remove it locally. Do not copy session files or host credentials into your project to share access with a teammate.

Connect a coding agent

Open Local tools for the current setup instructions and client examples. The hosted endpoint is:

https://upstate.cloud/mcp

Use a client that supports browser authorization for remote MCP servers. During approval, check the client name and select only the accounts you want it to read. A client name is supplied by that client; it is not proof of who operates it.

The approval grants read access to production information for the selected accounts. Creating or switching to another account later does not automatically add it to that grant.

Ask questions grounded in evidence

Useful questions include:

  • Which projects need attention, and how fresh are their reports?
  • What evidence supports the latest deployment verdict?
  • Which hosts stopped reporting?
  • What changed between these two deployments?

The hosted tools read bounded inventory, health, receipt, alert, and activity information. They do not run shell commands, change configuration, or remediate production.

Your agent can combine that evidence with code it can read locally. Repository access and Upstate access are separate permissions.

Revoke access

Return to Local tools to disconnect an approved coding-agent connection. Removing account membership also affects what that connection may read.

A hosted MCP grant, a human CLI session, and a host observer token serve different purposes. Revoke the appropriate credential rather than assuming one disconnect removes every integration.