Reference

The mb CLI

mb is a single zero-dependency Node ≥ 18 file that wraps the HTTP API. It's what an agent uses day-to-day: proxy a secret, run a query, push a brief, watch for your reply. Everything it does is also reachable over plain HTTP.

Install

The CLI ships with every invite, so a fresh agent can grab it before it even has a token:

curl -fsSL "https://meltbox.ai/invite/<code>/cli" -o mb.mjs

Run it with node mb.mjs <command>. Throughout these docs we write mb <command>. Alias it if you like:

alias mb="node $PWD/mb.mjs"

Config

mb finds its endpoint and token in one of two places (env vars win):

1. Environment: MB_URL and MB_TOKEN.
2. Config file: ~/.meltbox/meltbox.json, written automatically on invite redeem:

{
  "url":   "https://meltbox.ai",
  "token": "mb_…",
  "staging_url":   "https://…workers.dev",   // optional
  "staging_token": "mb_…"                     // optional
}

Write that file yourself with mb login:

mb login --url https://meltbox.ai --token mb_…      # saved to ~/.meltbox/meltbox.json (chmod 600)
mb me                                                  # confirm: prints /api/me

Global flags

Identity

mb me        # whoami — actor, role, active workspace, scopes
mb login --url … --token …   # save credentials
mb open [app]                # open the app (or a dashboard) in your browser

Resources & secrets

Discover, proxy, and (with scope) reveal credentials. Prefer proxy / query over run. The secret stays on the server.

mb resources list                         # the catalog (no secret values)
mb resources show stripe                   # config + secret KEY names + identity layer

# proxy an ad-hoc request — secret injected server-side
mb proxy --resource stripe --env prod \
  --request '{"method":"GET","path":"/v1/subscriptions","query":{"limit":"3"}}'

# reveal: materialise secrets into a subprocess env (reveal scope) — nothing hits disk
mb run --resource google-ads --env prod -- python build_report.py
mb run --resource aws --resource stripe -- ./script.sh   # merge several

# reveal to a dotenv file for scripts that `source .env.*` (regenerate on demand)
mb inject --resource google-ads --env prod --out .env.google

Admins can also configure resources from the CLI: mb resources create <id> --type http|aws, mb resources set <id> --env prod -c base_url=… -s API_KEY=…, mb resources meta <id> --provider … --export secrets.KEY=ENV_VAR, mb resources note <id> --append '…', mb resources reveal|test <id> --env prod.

App queries

Run a named, server-side query an app exposes (the "externalized skill"):

mb query signups conversions --env prod --params '{"since":"1748736000"}'

Briefs

Push an artifact to the inbox, then watch for the human's selections and notes. This is the core agent ↔ human loop. See Authoring briefs.

# push a single self-contained file (or a directory bundle)
mb brief push ./hello.html --title "Q3 directions — pick one" \
  --kind options --summary "3 concepts, leave a note"
# → ✓ br_8f3k… v1 → https://meltbox.ai/#/brief/br_8f3k…

# watch the feedback stream — selections, notes, and a status:archived "reviewed & decided" event
mb brief watch br_8f3k --since 0 --interval 3

mb brief list [--status inbox|archived|all] [--project P] [--kind K] [--json]
mb brief show br_8f3k      # brief + reduced selections
mb brief events br_8f3k --since 12   # raw events past a cursor
mb brief archive|delete|open br_8f3k

brief push flags: --title (required), --summary, --kind, --accent (green|amber|blue|violet|rose|cyan), --project (defaults to the cwd basename), --session (defaults to $CLAUDE_SESSION_ID), --task, --id <br_…> (re-push a returned id to edit in place: fixes only; new rounds get new briefs), --meta '{…}'.

Building apps

mb init spend --name "Ad Spend" --folder marketing --accent amber   # scaffold apps/spend/
# …edit apps/spend/manifest.json (add queries) + index.html…
mb push apps/spend          # validate + upload + activate → ✓ spend v1
mb pull spend                # download the active bundle
mb apps list|show spend|archive spend
mb folders list|create marketing

Invites, scopes & tokens

# admin: mint a one-time invite link for a new agent
mb invite create --scope proxy:stripe --scope reveal:google-ads \
  --label "marketing agent" --token-ttl 30d --ttl 60
mb invite list|revoke inv_…

# agent: ask for access to a resource you can see but not use
mb request-scope bigquery --access proxy --reason "join signups with spend"

# admin: review + decide scope requests
mb scope-requests list --status pending
mb scope-requests approve|deny sr_…

# admin: manage long-lived tokens (plaintext shown once)
mb tokens list
mb tokens create ci-bot --resource stripe --reveal google-ads --expires 2026-12-31
mb tokens revoke ci-bot

mb audit --n 50      # recent workspace activity (admin)