CLI reference.

chat              Interactive REPL — local llama.cpp with RPC fallback,
                  session history, /history, /load
faucet            Request testnet TNZO via tenzro_faucet
info              Node summary (chain id, role, height, peers, version)
version           CLI version
set-username      Bind a human-readable username to your identity

node              Run a node, status, role, list addresses
join              One-click network participation (identity + wallet + hardware profile)
hardware          Local TEE + hardware profile detection
events            Subscribe / list events
auth              DPoP token + JWT bearer flows
key               Key generation and management
iroh              Content-addressed blob publish / fetch
validator         Validator admission, profile check, reputation
provider          Provider registration, stats, pricing, capacity, and
                  compute bond (bond post / increase / get / list /
                  withdraw / finalize / params)
schedule          Provider availability scheduling
admin             Admin-token operations
canton            Canton tenant + DAML command flows

wallet            Create, import, balance, send, list
identity          TDIP: register human / machine / autonomous,
                  resolve, list, document, add-credential, add-service,
                  add-claim, add-trusted-issuer, add-resource, delegation-scope
passkey           Passkey enrollment, FIDO2 / WebAuthn flows, recovery
device            Devices bound to an identity: list, wallet-readiness,
                  revoke (unbinds and ends that device's sessions),
                  transfer (move a machine to another identity)
rails             Settlement rails and micropayment routing: list
                  (cheapest-first, with the smallest worthwhile payment
                  on each), route (accumulate / primary / secondary /
                  no viable rail for a given charge)
custody           ERC-7579 modular validators (social recovery, session keys,
                  spending limit)
crypto            Standalone crypto primitives (sign, verify, derive)
compliance        Freeze / unfreeze / whitelist / country restriction
ivms101           Travel rule (IVMS 101 originator / beneficiary)
capability        Capability registry and attestation
username          Username registry

contract          Deploy / interact with EVM / SVM / DAML contracts
token             Create, transfer, wrap, unwrap, info
nft               NFT factory mint, mintRandom (VRF), transfer
cct               Chainlink Cross-Chain Token v1.6+ pools
escrow            Create, release, refund, channel open / close, settle
permit2           Permit2 SignatureTransfer flows
eip7702           EIP-7702 delegation install / get / revoke
erc7579           ERC-7579 validator module install / uninstall / state

bridge            Generic bridge router quote / send / track
bridge_fee        Bridge fee schedule and sponsorship
crosschain        Multi-adapter route comparison
wormhole          Wormhole + NTT
wormhole_ntt      Wormhole NTT explicit surface
hyperlane         Hyperlane V3 (sovereign Tenzro-set ISM)
axelar            Axelar GMP (30+ chains)
babylon           Babylon Bitcoin staking
debridge          deBridge DLN
lifi              LI.FI aggregator
erc7683           ERC-7683 cross-chain intents (open, list, fill)
interop           Cross-VM token + cross-chain composite flows
caip              CAIP-2 / CAIP-10 / CAIP-19 discovery
secure_mint       Secure-Mint reserve-bound minting

model             List, info, download, serve, stop, delete, endpoints,
                  get-hash, list-hashes, record-hash,
                  seal, install-sealed, sealed-list, sealed-get, recipient-key
inference         Submit inference requests (any modality)
multimodal        Forecast / vision-embed / text-embed / segment / detect /
                  transcribe / video-embed
train             Tenzro Train: post-task, list-runs, get-run, enroll-trainer,
                  submit-gradient, finalize-round, sealed-manifest
cortex            Cortex reasoning runtime
memory            Per-agent memory: grant / recall / archive / list
agent             Register, list, send, spawn, run-task, create-swarm,
                  terminate-swarm, list-templates, get-template,
                  spawn-template, run-template
app               Register and run agent-driven apps
site              Static-site hosting: deploy / get / list / remove,
                  set-alias / get-alias / list-aliases / remove-alias
marketplace       Agent template marketplace
skill             Skill registry: list / register / search / use / get
tool              Tool registry: list / register / search / use / get
task              Task marketplace: list / post / get / cancel / quote /
                  assign / complete

payment           Create challenge, pay (MPP / x402 / native), receipt
ap2               AP2 mandate sign / verify / validate-pair
x402              Direct x402 pay-resource flow
provenance        Stripe SPT settlement-outcome dispatcher
settlement        On-chain settlement primitives
capital           Capital intent open / quote / assign / execute /
                  verify / compensate / settle
workflow          Long-running workflow open / step-execute / step-verify /
                  step-compensate / finalize
dispute           Dispute filing / adjudication
insurance         AgentBond insurance claim / list / get / pool
bond              AgentBond post / increase / withdraw / get / list
approval          User approval flows (HITL)

governance        List, propose, vote, voting-power
stake             Deposit, withdraw, info, liquid-stake (stTNZO)
reputation        Provider reputation, history, badges
adaptive_burn     Burn-rate config, supply metrics, recommendations
seed_agent        Treasury earmark, charter, list-agents, network-activity
zk                Plonky3 STARK prove / verify / keygen / circuits
vrf               ECVRF prove / verify / keygen
tee               TEE attestation generation, verification, provider info
pq_hybrid         PQ-hybrid signature helpers
erc7579           (modular validators — also payments path)
erc8004           Trustless agent identity + reputation
urwa              URWA kill-switch / frozen tokens
attested_clock    TEE-attested clock service

node did-document          Every way of reaching this node, in one document
admin service-key add      Require a key before this node serves anyone
admin service-key status   Is the gate on, and by how many keys
admin service-key revoke   Refuse a key from now on (survives restart)
shell login                Sign in to hardware you rented (passkey ceremony)
shell lease open           Issue a service key and open an access lease
shell lease list           Every lease on this node
shell lease revoke         End a lease; kills its outstanding grants

The service-key gate is off by default and covers the four service surfaces at once. It never gates consensus or P2P — a gated node still validates and gossips — and never gates /health or /ready, since an orchestrator that cannot present a key still needs to see the node.

shell login is the gcloud auth login shape: it prints a link, you verify with the passkey on your Tenzro wallet, and the CLI collects a single-use session grant. A service key alone opens nothing — the operator also has to have named your wallet on the lease.