Command-line tool
messh CLI
Six commands. login, publish and add are the core loop.
Install#
Static binary · macOS and Linux · every release is SHA-256 checksummed.
$ curl -fsSL https://messh.io/install.sh | shmessh login#
Google in the browser. No browser → device code.
$ messh login Open https://messh.io/device?code=WXYZ-4821 and confirm the code WXYZ-4821 ✓ Logged in as mukul
Token: ~/.config/messh/token (0600). messh logout revokes it.
messh publish#
Uploads a public key to messh.io/<you>. Default: ~/.ssh/id_ed25519.pub.
$ messh publish --name laptop --agent claude-code signing ownership challenge with ~/.ssh/id_ed25519… ✓ ssh-ed25519 SHA256:7b1Qx9…09de (laptop) ✓ Live at messh.io/mukul
| --keypath | Path to a .pub file. |
| --namestring | Label: laptop, devbox. |
| --agentstring | Agent using this key. Repeatable. |
messh resolve <username>#
Read-only lookup. Writes nothing. For agents: --json.
$ messh resolve mukul mukul · Google ✓ ssh-ed25519 SHA256:7b1Qx9…09de laptop verified ssh-ed25519 SHA256:c44aP2…81f0 devbox verified
messh verify mukul: pass or fail on signatures, links, possession and revocation.
messh add <username>#
Resolves the user, shows fingerprints, asks, then appends to authorized_keys.
$ messh add mukul mukul · 2 keys ssh-ed25519 SHA256:7b1Qx9…09de laptop ssh-ed25519 SHA256:c44aP2…81f0 devbox Add to ~/.ssh/authorized_keys? [y/N] y ✓ Added 2 keys (tagged messh:mukul)
| --userstring | Target account. Needs sudo. |
| --yesflag | No prompt, for scripts and cloud-init. |
| --fingerprintSHA256:… | Add only this exact key. Use it from agents. |
| --dry-runflag | Print, don’t write. |
Lines are tagged messh:mukul. Only tagged lines are ever touched.
messh remove <username>#
Deletes messh:<username> lines. Hand-added keys stay.
messh sync#
Re-resolves messh:* lines and drops revoked keys. Cron it, or run messhd.
$ messh sync checked 3 identities · 5 keys − removed mukul · old-laptop (revoked Oct 18) ✓ in sync
messh request <server>#
An agent asks for time-boxed access, signed with its own key. A person approves in the dashboard. Not available yet
$ messh request prod-02 --user deploy --ttl 1h --reason "INC-2291" waiting for approval… ✓ Approved · expires 14:02
Keys endpoint#
Public, no auth, CDN-cached. Works without the CLI (and skips the confirm step).
$ curl -fsSL https://messh.io/mukul.keys >> ~/.ssh/authorized_keys{
"username": "mukul",
"agents": ["claude-code", "codex", "build-bot"],
"keys": [
{ "type": "ssh-ed25519", "name": "laptop", "fingerprint": "SHA256:7b1Qx9…09de" }
],
"linked": [{ "provider": "google", "verified": true }]
}