Command line
The same binary that serves the panel also carries a handful of subcommands.
Most of the time you only need serve. The rest exist for the things the
browser deliberately cannot do, such as resetting a forgotten password, and for
scripting the initial set-up of a machine.
red-clippy [OPTIONS] <COMMAND>
| Command | What it does |
|---|---|
serve | Run the web UI and REST API. |
mcp | Run the MCP stdio server, proxying to a running instance. |
init-db | Apply migrations against the configured database. |
create-org | Create an organization. |
create-user | Create a user. |
add-member | Add a user to an organization. |
reset-password | Break-glass password reset. |
create-api-key | Issue an API key. |
Four options are global and apply to every subcommand: -c / --config,
--database-url, --storage-root and --max-upload-bytes. That matters for
the helper commands: without it, running create-user with
RED_CLIPPY_DATABASE_URL set would create the user in the default database
rather than the one you meant.
Add --help to any subcommand for its own flags.
serve
red-clippy serve [-b HOST:PORT]
Runs migrations if needed, then serves the panel and the API. Stays in the
foreground; Ctrl+C stops it.
mcp
red-clippy mcp --url http://127.0.0.1:7337 --api-key rcl_xxxx_yyyy [--pentest CODE]
| Flag | Environment variable | Meaning |
|---|---|---|
--url | RED_CLIPPY_URL | Base URL of the running server. Defaults to http://127.0.0.1:7337. |
--api-key | RED_CLIPPY_API_KEY | Org-scoped token. Required. |
--pentest | RED_CLIPPY_PENTEST | Numeric id or exact code of an engagement to pin the session to. |
This speaks JSON-RPC 2.0 on stdin and stdout. Your MCP client launches it; you do not normally run it by hand except to check that the URL and key work. See Connecting an agent over MCP.
init-db
red-clippy init-db
Applies migrations and prints ok. serve does this on startup, so this is
for pre-creating a database or checking that a migration applies cleanly.
create-org
red-clippy create-org --slug northwind --name "Northwind Retail"
Fails if the slug is taken. The slug names the organization’s directory on disk and cannot be changed afterwards.
create-user
red-clippy create-user --username bob --password 's3cret-pass' --email bob@example.com
--email is optional. This creates the account only; it does not join any
organization.
add-member
red-clippy add-member --username bob --org northwind --role owner
--role is owner or member, defaulting to member. Run it again with a
different --org to give one person access to several tenants.
reset-password
red-clippy reset-password --username alice --password 'new-one'
Sets the password and signs the user out everywhere. This is the only way to reset a password you do not know, and it needs shell access on the server host. See Organizations and members for why.
create-api-key
red-clippy create-api-key --username alice --org northwind --name laptop
Prints the token once:
created api key id=1 name=laptop
token (store this now - it will not be shown again):
rcl_1a2b3c4d_5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f7081
The user must already be a member of the organization. --name defaults to
default; give it something that will still mean something in six months.
Only the prefix and a hash are stored, so a lost token cannot be recovered. Issue a new one and revoke the old.