{
  "markdown": "# Tuning Engines CLI & MCP Server\n\n[![tuning-engines-cli MCP server](https://glama.ai/mcp/servers/cerebrixos-org/tuning-engines-cli/badges/card.svg)](https://glama.ai/mcp/servers/cerebrixos-org/tuning-engines-cli)\n\n[![npm version](https://img.shields.io/npm/v/tuningengines-cli.svg)](https://www.npmjs.com/package/tuningengines-cli)\n[![MCP Registry](https://img.shields.io/badge/MCP_Registry-tuning--engines-blue)](https://registry.modelcontextprotocol.io)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n\nGovern every AI workflow through one API.\n\n**[Tuning Engines](https://tuningengines.com)** is a governed AI runtime for model, agent, skill, and MCP workflows. Route inference through one OpenAI-compatible API, apply RBAC and traffic policies, request approvals for high-risk actions, inspect traces and usage, and connect durable orchestration frameworks such as LangGraph and Temporal. The same CLI and MCP server also manage domain-specific fine-tuning of open-source models.\n\n## Training Agents\n\nTuning Engines uses specialized **agents** that control how your data is analyzed and converted into training data. Each agent produces a different kind of domain-specific fine-tuned model optimized for its use case. Current agents focus on code, with more coming for customer support, data extraction, security review, ops, and other domains.\n\n### Cody (`code_repo`) — Code Autocomplete Agent\n\nCody fine-tunes on your GitHub repo using QLoRA (4-bit quantized LoRA) via the Axolotl framework (HuggingFace Transformers + PEFT). It learns your codebase's patterns, naming conventions, and project structure to produce a fast, lightweight adapter optimized for real-time completions.\n\n**Best for:** code autocomplete, inline suggestions, tab-complete, code style matching, pattern completion.\n\n```bash\nte jobs create --agent code_repo \\\n  --base-model Qwen/Qwen2.5-Coder-7B-Instruct \\\n  --repo-url https://github.com/your-org/your-repo \\\n  --output-name my-cody-model\n```\n\n### SIERA (`sera_code_repo`) — Bug-Fix Specialist\n\nSIERA (Synthetic Intelligent Error Resolution Agent) uses the Open Coding Agents approach from AllenAI to generate targeted bug-fix training data from your repository. It synthesizes realistic error scenarios and their resolutions, then fine-tunes a model that learns your team's debugging style, error handling conventions, and fix patterns.\n\n**Best for:** debugging, error resolution, patch generation, root cause analysis, fix suggestions.\n\n```bash\nte jobs create --agent sera_code_repo \\\n  --quality-tier high \\\n  --base-model Qwen/Qwen2.5-Coder-7B-Instruct \\\n  --repo-url https://github.com/your-org/your-repo \\\n  --output-name my-siera-model\n```\n\n**Quality tiers (SIERA only):**\n- `low` — Faster, fewer synthetic pairs (default)\n- `high` — Deeper analysis, more training data, better results\n\n### Coming Soon\n\n| Agent | Persona | What it does |\n|-------|---------|-------------|\n| **Resolve** | Mira | Fine-tunes on support tickets, macros, and KB articles for automated ticket resolution |\n| **Extractor** | Flux | Trains for strict schema extraction from docs, PDFs, and business text |\n| **Guard** | Aegis | Security-focused code reviewer that catches risky patterns and proposes safer fixes |\n| **OpsPilot** | Atlas | Incident response agent trained on runbooks, postmortems, and on-call notes |\n\n## Supported Base Models\n\n| Size | Models |\n|------|--------|\n| **3B** | `Qwen/Qwen2.5-Coder-3B-Instruct` |\n| **7B** | `codellama/CodeLlama-7b-hf`, `deepseek-ai/deepseek-coder-7b-instruct-v1.5`, `Qwen/Qwen2.5-Coder-7B-Instruct` |\n| **13-15B** | `codellama/CodeLlama-13b-Instruct-hf`, `bigcode/starcoder2-15b`, `Qwen/Qwen2.5-Coder-14B-Instruct` |\n| **32-34B** | `deepseek-ai/deepseek-coder-33b-instruct`, `codellama/CodeLlama-34b-Instruct-hf`, `Qwen/Qwen2.5-Coder-32B-Instruct` |\n| **70-72B** | `codellama/CodeLlama-70b-Instruct-hf`, `meta-llama/Llama-3.1-70B-Instruct`, `Qwen/Qwen2.5-72B-Instruct` |\n\n## Quick Start\n\n```bash\nnpm install -g tuningengines-cli\n\n# Or run without installing\nnpx -y --package tuningengines-cli@latest te auth status\n\n# Sign up or log in (opens browser — works for new accounts too)\nte auth login\n\n# Add credits (opens browser to billing page)\nte billing add-credits\n\n# Estimate cost before training\nte jobs estimate --base-model Qwen/Qwen2.5-Coder-7B-Instruct\n\n# Train Cody on your repo\nte jobs create --agent code_repo \\\n  --base-model Qwen/Qwen2.5-Coder-7B-Instruct \\\n  --repo-url https://github.com/your-org/your-repo \\\n  --output-name my-model\n\n# Monitor training\nte jobs status <job-id> --watch\n\n# View your trained models\nte models list\n\n# Create a governed orchestration starter\nte orchestration init langgraph\nte orchestration init temporal\nte orchestration init inngest\nte orchestration init triggerdev\nte orchestration init hatchet\nte orchestration init restate\nte orchestration init dbos\nte orchestration init dapr\nte orchestration init prefect\nte orchestration init dagster\nte orchestration init airflow\n```\n\n## MCP Server Setup\n\nThe CLI includes a built-in MCP server with 60+ tools. Any AI assistant that supports MCP can fine-tune models, manage training jobs, run evaluations, check inference usage, inspect traces, review approvals, and manage non-secret tenant registry metadata through natural language.\n\nFor security, the MCP server intentionally does not expose internal proxy routes. It also refuses MCP-side inference-key creation and raw secret-bearing mutation fields. Use the CLI or web UI for workflows that intentionally create one-time keys, submit raw provider secrets, validate S3 credentials, or import/export S3 assets with raw credentials.\n\n### Claude Desktop\n\nAdd to `~/Library/Application Support/Claude/claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"tuning-engines\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"--package\", \"tuningengines-cli@latest\", \"te\", \"mcp\", \"serve\"],\n      \"env\": {\n        \"TE_API_KEY\": \"te_your_key_here\"\n      }\n    }\n  }\n}\n```\n\n### Claude Code\n\n```bash\nclaude mcp add tuning-engines -- npx -y --package tuningengines-cli@latest te mcp serve\n```\n\n### Work Sessions and outcomes\n\nLabel the desired outcome for a project without interrupting your coding workflow:\n\n```bash\nte goal start \"Fix flaky checkout retries\"\nte goal show\nte goal complete --result succeeded\n```\n\nInstall optional native telemetry hooks for Claude Code or Codex:\n\n```bash\nte guard claude-code install --mode observe --project .\nte guard claude-code doctor\nte guard claude-code doctor --probe\nte guard codex install\nte guard codex doctor\n```\n\nClaude Code writes project-local hooks into `.claude/settings.local.json`. On\nWindows, verify with `dir .\\.claude`, `type .\\.claude\\settings.local.json`,\nthen restart Claude Code from the same project root and review `claude /hooks`.\n`doctor --probe` is available in `tuningengines-cli` 0.4.20 and later; it runs\nsynthetic hook events through the installed commands and checks that the trace is\nvisible to Tuning Engines. Hook invocations also write a local redacted status\nlog at `.claude/tuning-engines-hook-status.jsonl`.\nCodex project hooks require review and trust from `/hooks`. The installer pins\nhooks to the exact CLI executable that created them; `te guard codex doctor`\nreports that path, CLI version, native-event contract, required lifecycle\nhooks, and any conflicting `te` command found on `PATH`. Each Codex or Claude\nCode user prompt starts a new trace while retaining one stable Work Session for\nthe native conversation. Tuning Engines sends pseudonymous session and\ntranscript references by default, not transcript contents or local absolute\npaths.\n\n### Claude Code Plugin\n\nThe repository also ships a Claude Code plugin wrapper around the same MCP\nserver. It keeps installation discoverable while preserving the same\n`TE_API_KEY` environment-variable boundary:\n\n```bash\nclaude plugin marketplace add cerebrixos-org/tuning-engines-cli\nclaude plugin install tuning-engines@tuning-engines\n```\n\nThe same plugin directory includes a Codex plugin manifest, marketplace entry,\nMCP server, and tenant-operations skill. It uses the Tuning Engines web app as\nthe shared control-plane UI for traces, approvals, policies, cost, and review.\n\n### DeepSeek Harness Plugin\n\nInstall the native Harness bundle to capture turn, model-step, and tool\nlifecycle telemetry and optionally enforce TE governance before tool execution:\n\n```bash\nexport TE_API_KEY=\"your-tenant-token-or-inference-key\"\ndsh plugin --profile default add tuningengines-cli\n```\n\nThe adapter uses a disk-backed local spool, background batching, bounded\nretries, stable tool-call correlation, and metadata-only capture by default.\n\n### VS Code / Cursor / Windsurf\n\nAdd to your MCP settings (`.vscode/mcp.json` or equivalent):\n\n```json\n{\n  \"servers\": {\n    \"tuning-engines\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"--package\", \"tuningengines-cli@latest\", \"te\", \"mcp\", \"serve\"],\n      \"env\": {\n        \"TE_API_KEY\": \"te_your_key_here\"\n      }\n    }\n  }\n}\n```\n\n### What the AI assistant can do\n\nWhen connected, your AI assistant can:\n\n- \"Fine-tune Qwen 7B on my-org/my-repo using the SIERA agent with high quality\"\n- \"How much would it cost to train a 32B model for 3 epochs on this repo?\"\n- \"Check the status of my latest training job\"\n- \"List my trained models\"\n- \"Export my model to s3://my-bucket/models/\"\n- \"Show my account balance\"\n- \"Train a bug-fix specialist on this repo\" (auto-selects SIERA)\n- \"Create an autocomplete model for this codebase\" (auto-selects Cody)\n\nThe `create_job` tool description includes full agent details and model lists, so AI assistants automatically select the right agent and model based on what you ask for.\n\n## Unified API Endpoint\n\nTuning Engines can be used anywhere a tool accepts an OpenAI-compatible API\nbase URL. Point the client at:\n\n```text\nhttps://api.tuningengines.com/v1\n```\n\nUse an inference key that starts with `sk-te-...` for live model calls, and use\nthe model IDs shown by:\n\n```bash\nte inference models\n```\n\nThis lets OpenCode, Temporal activities, LangGraph apps, OpenAI SDK clients,\nand other custom-provider clients route through the same Tuning Engines control\nplane for model RBAC, routing, fallbacks, guardrails, AGT policy, traces,\nusage metering, and cost attribution.\n\nSee [docs/unified-api-endpoint.md](docs/unified-api-endpoint.md) for copy-paste\nexamples for OpenCode, Temporal, Python, JavaScript, and other\nOpenAI-compatible clients.\n\n## Agent Runtime SDK and Orchestration Starters\n\nUse the CLI/MCP package when you want `npx` tools for assistants. Use the\nPython SDK when you want your own app to run durable agent workflows while\nTuning Engines remains the governed control plane for models, agents, skills,\nMCP tools, RBAC, AGT policy, audit, usage, and token economics.\n\nOpenAI Agents SDK users can install the native model and trace integration:\n\n```bash\npip install \"tuning-engines[openai-agents]\"\n```\n\nSee [packages/tuning-agents/README.md](packages/tuning-agents/README.md#openai-agents-sdk)\nfor setup. The OpenAI Agents runtime owns the loop; TE supplies the governed\nendpoint and receives metadata-only SDK traces through its background processor.\n\nInstall the published Python SDK:\n\n```bash\npip install \"tuning-engines[langgraph]\"\npip install \"tuning-engines[temporal]\"\n```\n\nThe package installs the `tuning_agents` Python module.\n\nLangGraph example:\n\n```python\nfrom langgraph.checkpoint.memory import InMemorySaver\n\nfrom tuning_agents import TuningClient\nfrom tuning_agents.langgraph import create_tuning_langgraph_agent, invoke_with_trace\n\nclient = TuningClient(api_key=\"te_your_key_here\")\n\nagent = create_tuning_langgraph_agent(\n    client,\n    model=\"llama-3.3-70b-fp8\",\n    agent_names=[\"billing-escalation\"],\n    checkpointer=InMemorySaver(),\n    interrupt_before=[\"tools\"],\n)\n\nresult = invoke_with_trace(\n    client,\n    agent,\n    [{\"role\": \"user\", \"content\": \"Triage this ticket and escalate if needed.\"}],\n    thread_id=\"ticket-123\",\n)\n\nclient.flush_trace(name=\"ticket-triage\", runtime=\"langgraph\", status=\"succeeded\")\n```\n\nTemporal example:\n\n```python\nfrom tuning_agents.temporal import (\n    TuningEnginesTemporalFeatures,\n    create_tuning_engines_plugin,\n    define_temporal_workflow,\n)\n\nplugin = create_tuning_engines_plugin(\n    features=TuningEnginesTemporalFeatures(\n        built_in_workflow=False,\n        model_calls=True,\n        skill_tools=True,\n        mcp_tools=True,\n        agents=True,\n        approvals=True,\n        traces=True,\n        state_references=True,\n        interventions=True,\n        model_catalog=True,\n        usage=True,\n    )\n)\nTuningAgentWorkflow = define_temporal_workflow()\n# Pass plugin to Client.connect(..., plugins=[plugin]) and register the workflow.\n```\n\nThe SDK captures runtime events from LangGraph/Temporal and posts them to\n`POST /api/v1/traces`. Each event carries a `run_id`, `request_id`, and a\nnormalized event type such as `model.call`, `mcp.tool_call`, `agent.message`,\n`workflow.step`, `human.edit`, `action.finalized`, `outcome.recorded`, or\n`state.reference`. The app pairs that with inference usage, request capture,\npolicy decisions, approval requests, external state references, audit, and\nbilling logs.\n\nJavaScript/TypeScript users can also import lightweight tracing helpers from\nthe npm package:\n\n```ts\nimport { createOpenAIAgentsTraceAdapter } from \"tuningengines-cli/adapters/openai-agents\";\nimport { createClaudeAgentSdkTraceAdapter } from \"tuningengines-cli/adapters/claude-agent-sdk\";\n```\n\nBoth helpers send redacted run, model, tool, handoff, error, goal, and outcome\nevents to the existing trace API. `goal_key`, `goal_status`, and `goal_score`\nare normalized into the same success-signal analytics as `outcome_key`.\n\nFor decision traces, store redacted signals in `metadata.decision`, for example\n`proposal_summary`, `changed_fields`, `change_summary`, `final_action`,\n`outcome_label`, and `reason_summary`. Do not place raw prompts, provider keys,\ntenant secrets, or full customer data in trace metadata.\n\nGenerate a starter kit:\n\n```bash\nte orchestration init langgraph --dir ./lg-te-demo\nte orchestration init temporal --dir ./temporal-te-demo\nte orchestration init inngest --dir ./inngest-te-demo\nte orchestration init triggerdev --dir ./trigger-te-demo\nte orchestration init hatchet --dir ./hatchet-te-demo\nte orchestration init restate --dir ./restate-te-demo\nte orchestration init dbos --dir ./dbos-te-demo\nte orchestration init dapr --dir ./dapr-te-demo\nte orchestration init prefect --dir ./prefect-te-demo\nte orchestration init dagster --dir ./dagster-te-demo\nte orchestration init airflow --dir ./airflow-te-demo\n```\n\nLangGraph and Temporal starters use the Python runtime SDK. Inngest,\nTrigger.dev, and Hatchet starters generate TypeScript projects with a small\nself-contained Tuning Engines helper. Restate, DBOS, and Dapr starters use the\nsame TypeScript helper. Prefect, Dagster, and Airflow starters generate Python\nworkflow examples with a small helper module. All generated examples include\ngoverned model calls, trace flushing, registry manifests, policy context\nmetadata, decision metadata, runtime state references, and approval retry\npatterns.\n\n## CLI Commands\n\n### Authentication\n\n| Command | Description |\n|---------|-------------|\n| `te auth login` | Sign up or log in via browser |\n| `te auth logout` | Clear saved credentials |\n| `te auth status` | Show current auth status (email, balance) |\n\n### Training Jobs\n\n| Command | Description |\n|---------|-------------|\n| `te jobs list` | List all training jobs |\n| `te jobs show <id>` | Show job details |\n| `te jobs create` | Submit a training job (`--agent`, `--quality-tier`, `--base-model`, `--repo-url`, `--output-name`) |\n| `te jobs status <id>` | Live status (`--watch` for continuous polling) |\n| `te jobs cancel <id>` | Cancel a running job |\n| `te jobs retry <id>` | Retry from last checkpoint |\n| `te jobs estimate` | Cost estimate before submitting |\n| `te jobs validate-s3` | Pre-validate S3 credentials |\n\n### Models\n\n| Command | Description |\n|---------|-------------|\n| `te models list` | List your trained models |\n| `te models show <id>` | Show model details |\n| `te models base` | List supported base models |\n| `te models import` | Import a model from S3 |\n| `te models export <id>` | Export a model to S3 |\n| `te models delete <id>` | Delete a model |\n| `te models status <id>` | Check import/export status |\n\n### Datasets\n\n| Command | Description |\n|---------|-------------|\n| `te datasets list` | List all datasets |\n| `te datasets show <id>` | Show dataset details |\n| `te datasets create` | Create a dataset from S3 (`--name`, `--s3-url`, `--for-evaluation`) |\n| `te datasets delete <id>` | Delete a dataset |\n| `te datasets status <id>` | Check import/processing status |\n\n### Evaluations\n\n| Command | Description |\n|---------|-------------|\n| `te evals list` | List all evaluations |\n| `te evals show <id>` | Show evaluation details and scores |\n| `te evals create` | Run an evaluation (`--model`, `--dataset`, `--evaluators`) |\n| `te evals cancel <id>` | Cancel a running evaluation |\n| `te evals status <id>` | Live evaluation progress |\n| `te evals evaluators` | List available evaluators |\n| `te evals estimate` | Cost estimate for an evaluation |\n\n### Inference\n\n| Command | Description |\n|---------|-------------|\n| `te inference models` | List available inference models |\n| `te inference usage` | Show inference API usage stats |\n| `te inference jwt` | Get a JWT for direct API access |\n| `te inference token` | Exchange an inference key (`sk-te-...`) for a short-lived inference JWT |\n| `te inference chat --data '<json>'` | Run an OpenAI-compatible chat completion |\n| `te inference responses --data '<json>'` | Run an OpenAI Responses request |\n| `te inference embeddings --data '<json>'` | Create embeddings |\n| `te inference messages --data '<json>'` | Run an Anthropic-compatible Messages request |\n\n### Runtime Traces and Approvals\n\n| Command | Description |\n|---------|-------------|\n| `te traces list` | List LangGraph, Temporal, and custom runtime traces |\n| `te traces show <run-id>` | Show one trace, including events, policy decisions, and approvals when linked |\n| `te traces ingest --data '<json>'` | Ingest or update a trace using a user API token or inference key |\n| `te outcomes list` | List observed outcomes, goals, evals, and workflow success signals |\n| `te outcomes record --run-id ... --key ... --label ...` | Record a success signal for a run |\n| `te outcomes map --outcome-key ... --criteria '<json>'` | Map unmapped events to an outcome key |\n| `te insights list` | List Insight Loop recommendations |\n| `te insights accept <id>` | Accept an insight as valid; does not change production |\n| `te insights apply <id>` | Apply or queue the approved action for an accepted insight |\n| `te doctor simulate --data '<json>'` | Simulate inference access, role, endpoint, policy, and resource checks |\n| `te policy-decisions list` | List AGT YAML policy decisions |\n| `te policy-decisions show <id>` | Show one policy decision with redacted context |\n| `te policy-templates list` | List curated AGT YAML policy templates |\n| `te policy-templates render <id> --params '<json>'` | Render disabled/shadow policy YAML from safe structured parameters |\n| `te policy-drafts generate --prompt '<text>'` | Generate an AI-assisted disabled/shadow draft for review and testing |\n| `te approvals list --status pending` | List policy approval requests |\n| `te approvals show <id>` | Show approval detail and retry metadata |\n| `te approvals approve <id>` | Approve a pending request |\n| `te approvals deny <id>` | Deny a pending request |\n| `te interventions list/show/request/ack/complete/fail` | Manage runtime pause, resume, cancel, and replay requests |\n| `te state list/show/upsert` | Manage safe external workflow-state and memory references |\n| `te registry sync --file tuning-registry.yml --dry-run/--apply` | Diff or apply agent, skill, and MCP registry manifests |\n| `te registry show <id>` | Inspect an applied registry sync |\n| `te work-sessions list/show/complete/confirm-outcome` | Inspect and update Work Sessions |\n| `te initiatives list/show/create/update` | Manage strategic initiative groupings |\n\n### Orchestration Starters\n\n| Command | Description |\n|---------|-------------|\n| `te orchestration init langgraph` | Create a LangGraph starter wired to Tuning Engines governance and traces |\n| `te orchestration init temporal` | Create a Temporal worker starter wired to Tuning Engines governance and traces |\n| `te orchestration init inngest` | Create an Inngest function starter wired to Tuning Engines governance and traces |\n| `te orchestration init triggerdev` | Create a Trigger.dev task starter wired to Tuning Engines governance and traces |\n| `te orchestration init hatchet` | Create a Hatchet workflow starter wired to Tuning Engines governance and traces |\n| `te orchestration init restate` | Create a Restate service starter wired to Tuning Engines governance and traces |\n| `te orchestration init dbos` | Create a DBOS workflow starter wired to Tuning Engines governance and traces |\n| `te orchestration init dapr` | Create a Dapr Workflow starter wired to Tuning Engines governance and traces |\n| `te orchestration init prefect` | Create a Prefect flow starter wired to Tuning Engines governance and traces |\n| `te orchestration init dagster` | Create a Dagster asset starter wired to Tuning Engines governance and traces |\n| `te orchestration init airflow` | Create an Airflow DAG starter wired to Tuning Engines governance and traces |\n\n### Agents\n\n| Command | Description |\n|---------|-------------|\n| `te agents list` | List available agents |\n| `te agents show <id>` | Show agent details and capabilities |\n| `te agents message <name> --data '<json>'` | Send a governed A2A agent message |\n\n### Skills and MCP Execution\n\n| Command | Description |\n|---------|-------------|\n| `te skills list` | List skills visible to the inference identity |\n| `te skills prepare <name> --data '<json>'` | Prepare a governed skill |\n| `te skills invoke <name> --data '<json>'` | Invoke a governed skill |\n| `te mcp call --server <name> --tool <name> --arguments '<json>'` | Call an enabled governed MCP tool |\n| `te mcp rediscover <server-id>` | Refresh MCP tool discovery |\n| `te mcp tools list/enable/disable/toggle` | Administer discovered MCP tools |\n\n### Compliance Automation\n\n| Command | Description |\n|---------|-------------|\n| `te compliance validate --data '<json>'` | Validate bounded content against adopted rulepacks |\n| `te compliance rewrite --data '<json>'` | Produce and revalidate a safe rewrite |\n| `te compliance evidence <id>` | Inspect compliance evidence |\n| `te compliance risks list/show/create/update` | Manage the tenant risk register |\n| `te compliance risks assess/map-control/add-subject/remove-subject` | Operate the risk-to-control lifecycle |\n| `te compliance source-runs create/show/submit-results/complete` | Ingest normalized scanner or webhook results |\n| `te compliance certifications create/show` | Run and inspect compliance certification jobs |\n\n### Tenant Admin Automation\n\nThese commands require an API token for a tenant owner or tenant admin. They are\ndesigned for CI smoke tests and end-to-end product checks. Secret fields can be\nsent on create/update where the server supports them, but responses never print\nstored provider keys, AWS secrets, or invitation tokens.\n\n| Command | Description |\n|---------|-------------|\n| `te tenant resources` | List supported tenant resource names |\n| `te tenant list <resource>` | List resources such as `inference_keys`, `inference_roles`, `model_deployments`, `routing_profiles`, `guardrail_policies`, `governance_policies`, `mcp_servers`, `tenant_agents`, `tenant_skills`, and `credential_sources` |\n| `te tenant show <resource> <id>` | Show one tenant resource |\n| `te tenant create <resource> --data '<json>'` | Create a tenant resource from JSON |\n| `te tenant update <resource> <id> --data '<json>'` | Update a tenant resource from JSON |\n| `te tenant delete <resource> <id>` | Delete a tenant resource; inference keys are revoked |\n| `te tenant validate guardrail_policies --data '<json>' --sample-text 'hello'` | Validate/test an unsaved simple guardrail without creating records |\n| `te tenant validate governance_policies --data '<json>' --context '<json>'` | Validate/test an unsaved Governance Rule without creating records |\n| `te tenant test-policy <id> --context '<json>'` | Dry-run a Governance Rule |\n| `te tenant test governance_policies <id> --context '<json>'` | Compatibility alias for governance policy dry-runs |\n| `te tenant team list` | List tenant members, pending invitations, and allowed domains |\n| `te tenant team invite <email> --role member` | Invite a user by email; the invite token is emailed and never printed |\n| `te tenant team set-role <member-id> --inference-role-id <id>` | Assign an inference role to a member |\n| `te tenant team disable <member-id>` | Disable a member |\n| `te tenant team enable <member-id>` | Re-enable a member |\n| `te tenant team remove <member-id>` | Remove a member |\n| `te tenant team cancel-invite <invitation-id>` | Cancel a pending invitation |\n| `te tenant team domains --set \"example.com,example.org\"` | Replace allowed email domains |\n| `te tenant capture show` | Show inference capture settings |\n| `te tenant capture update --data '<json>'` | Update inference capture settings |\n\n### Billing & Account\n\n| Command | Description |\n|---------|-------------|\n| `te billing show` | Balance and transaction history |\n| `te billing add-credits` | Open browser to add credits |\n| `te account` | Account info |\n\n### Configuration\n\n| Command | Description |\n|---------|-------------|\n| `te config set-token <key>` | Set API key manually |\n| `te config set-url <url>` | Override API URL |\n| `te config show` | Show current config |\n\nAll commands support `--json` for machine-readable output.\n\n## MCP Tools Reference\n\n### Training Jobs\n\n| Tool | Description |\n|------|-------------|\n| `create_job` | Fine-tune an LLM on a GitHub repo. Supports agent selection (Cody, SIERA), quality tier, base model, epochs, S3 export. |\n| `estimate_job` | Cost estimate before training. Returns cost range, balance, sufficiency check. |\n| `list_jobs` | List training jobs with status filter |\n| `show_job` | Full job details including agent, model, GPU usage, cost, retry info |\n| `job_status` | Live status with GPU minutes, charges, delivery progress |\n| `cancel_job` | Cancel a running/queued job |\n| `retry_job` | Retry a failed job from its last checkpoint |\n\n### Models\n\n| Tool | Description |\n|------|-------------|\n| `list_models` | List trained and imported models |\n| `show_model` | Model details (status, size, base model, training job) |\n| `delete_model` | Delete a model from cloud storage |\n| `model_status` | Import/export progress |\n| `list_supported_models` | Available base models with GPU hours per epoch |\n\n### Marketplace\n\n| Tool | Description |\n|------|-------------|\n| `list_catalog_models` | Browse pre-built models and datasets |\n| `get_catalog_model` | Details of a marketplace item |\n| `catalog_export_status` | Check marketplace export progress |\n\n### Datasets\n\n| Tool | Description |\n|------|-------------|\n| `list_datasets` | List datasets for training and evaluation |\n| `show_dataset` | Dataset details and status |\n| `create_dataset` | Create a dataset from S3 |\n| `delete_dataset` | Delete a dataset |\n| `dataset_status` | Check dataset import/processing status |\n\n### Evaluations\n\n| Tool | Description |\n|------|-------------|\n| `list_evaluations` | List model evaluations |\n| `show_evaluation` | Evaluation details, scores, and metrics |\n| `create_evaluation` | Run an evaluation against a dataset |\n| `cancel_evaluation` | Cancel a running evaluation |\n| `evaluation_status` | Live evaluation progress |\n| `list_evaluators` | Available evaluators (code_execution, similarity, llm_judge, etc.) |\n| `estimate_evaluation` | Cost estimate for an evaluation |\n\n### Inference\n\n| Tool | Description |\n|------|-------------|\n| `list_inference_models` | Models available for inference |\n| `inference_usage` | Inference API usage statistics |\n| `get_inference_jwt` | Get JWT token for direct API access |\n| `get_inference_token` | Exchange an inference key for a short-lived inference JWT |\n| `call_inference` | Call chat, Responses, embeddings, or Messages using the configured credential |\n| `send_agent_message` | Send a governed A2A agent message |\n| `list_skills` / `invoke_skill` | Discover, prepare, or invoke governed skills |\n\n### Runtime, Policy, and Approvals\n\n| Tool | Description |\n|------|-------------|\n| `list_traces` | List runtime traces |\n| `show_trace` | Show a trace with linked events, policy decisions, and approvals |\n| `create_trace` | Ingest a trace payload without secrets |\n| `list_outcomes` | List observed outcomes/goals normalized as success signals |\n| `list_insights` | List Insight Loop recommendations |\n| `show_insight` | Show one Insight Loop recommendation |\n| `doctor_simulate` | Simulate inference access, role, endpoint, policy, and resource checks |\n| `record_outcome` | Record an outcome/goal signal; requires `--enable-registry-writes` |\n| `map_outcome` | Create an outcome mapping rule; requires `--enable-registry-writes` |\n| `accept_insight` | Accept an insight for review; requires `--enable-registry-writes` |\n| `apply_insight` | Apply or queue an accepted insight; requires `--enable-registry-writes` |\n| `list_policy_decisions` | List AGT YAML policy decisions |\n| `show_policy_decision` | Show one decision with redacted context |\n| `list_policy_templates` | List curated AGT YAML policy templates |\n| `render_policy_template` | Render disabled/shadow policy YAML from safe structured parameters |\n| `generate_policy_draft` | Generate an AI-assisted disabled/shadow draft; secret-looking prompts are refused |\n| `list_approvals` | List policy approval requests |\n| `show_approval` | Show one approval request |\n| `approve_approval` | Approve a pending request |\n| `deny_approval` | Deny a pending request |\n| `list_runtime_interventions` / `show_runtime_intervention` | Inspect runtime control requests |\n| `create/ack/complete/fail_runtime_intervention` | Operate intervention lifecycle; requires `--enable-registry-writes` |\n| `list/show/upsert_runtime_state_reference` | Manage safe external state and memory pointers |\n| `registry_sync_dry_run` / `registry_sync_apply` / `show_registry_sync` | Diff, apply, and inspect registry manifests |\n| `list_work_sessions` / `show_work_session` / `complete_work_session` | Inspect and complete Work Sessions |\n| `list_initiatives` / `show_initiative` | Inspect initiative groupings |\n| `list_compliance_risks` / `show_compliance_risk` | Inspect the tenant risk register |\n| `validate_compliance` / `show_compliance_evidence` | Validate content and inspect evidence |\n| `create/submit/complete_compliance_source_run` | Ingest normalized external test results; writes require `--enable-registry-writes` |\n| `show_compliance_certification` | Inspect a certification run |\n\n### Tenant Admin MCP Tools\n\nThese tools require a tenant owner/admin API token. The MCP server refuses internal\nproxy routes, inference-key creation, and raw secret-bearing mutation fields.\n\n| Tool | Description |\n|------|-------------|\n| `list_tenant_resources` | List allowlisted tenant resource names |\n| `tenant_resource_list` | List models, roles, policies, MCP servers, agents, skills, credential sources, and related metadata |\n| `tenant_resource_show` | Show one resource without returning stored secrets |\n| `tenant_resource_create` | Create non-secret tenant registry/config metadata |\n| `tenant_resource_update` | Update non-secret tenant registry/config metadata |\n| `tenant_resource_delete` | Delete or revoke a tenant resource |\n| `tenant_resource_validate` | Validate/test unsaved guardrail or AGT policy payloads without creating records |\n| `test_governance_policy` | Dry-run an AGT YAML governance policy |\n| `tenant_team_list` | List members, invitations, and allowed domains |\n| `tenant_team_invite` | Invite a user without returning invitation tokens |\n| `tenant_team_set_inference_role` | Assign or clear an inference role |\n| `tenant_team_disable` / `tenant_team_enable` | Disable or re-enable a member |\n| `tenant_team_remove` | Remove a tenant member |\n| `tenant_invitation_cancel` | Cancel a pending invitation |\n| `tenant_domains_update` | Replace allowed email domains |\n| `inference_capture_show` / `inference_capture_update` | Manage request-capture settings using credential-source references |\n\n### Agents\n\n| Tool | Description |\n|------|-------------|\n| `list_agents` | List available agents |\n| `show_agent` | Agent details and capabilities |\n\n### Account\n\n| Tool | Description |\n|------|-------------|\n| `get_balance` | Account balance and recent transactions |\n| `get_account` | Account details |\n\n## Environment Variables\n\n| Variable | Description |\n|----------|-------------|\n| `TE_API_KEY` | API key (overrides config file) |\n| `TE_API_URL` | API URL (default: `https://app.tuningengines.com`) |\n| `TE_INFERENCE_KEY` | Optional `sk-te-*` key for direct model, agent, skill, and MCP calls |\n| `TE_INFERENCE_URL` | Inference base URL (default: `https://api.tuningengines.com/v1`) |\n\nTenant management commands keep the configured `te_*` API token local and\nexchange it for a short-lived management JWT before calling the API. Inference\nkeys (`sk-te-*`) are for inference-only flows such as `te inference token` and\nproxy calls; they are not accepted for tenant registry management commands.\n\n## Inference Smoke Testing\n\nUse `te-inference-smoke` to exercise inference behavior as a tenant admin and, optionally, real tenant users. The default run is read-only. Set `TE_SMOKE_MUTATE=1` to create temporary inference roles, keys, policies, guardrails, MCP servers, agents, and skills, then test permission permutations and clean them up.\n\nIf you only have an `sk-te-*` inference key, set `TE_INFERENCE_KEY` for\nproxy-only checks. Full role/user/policy permutations require a tenant-admin\napp API key that starts with `te_`.\n\n```bash\nTE_API_URL=https://app.tuningengines.com \\\nTE_ADMIN_API_KEY=te_admin_key_here \\\nTE_USER_API_KEY=te_user_key_here \\\nnpx -y --package tuningengines-cli@latest te-inference-smoke\n```\n\nFor actual proxy model calls, enable live calls explicitly:\n\n```bash\nTE_API_URL=https://app.tuningengines.com \\\nTE_INFERENCE_BASE=https://api.tuningengines.com/v1 \\\nTE_ADMIN_API_KEY=te_admin_key_here \\\nTE_SMOKE_MUTATE=1 \\\nTE_SMOKE_LIVE_CALLS=1 \\\nTE_SMOKE_CREATE_MODEL_DEPLOYMENT=1 \\\nTE_SMOKE_ALLOWED_MODEL=llama-3.1-8b-fast \\\nTE_SMOKE_DENIED_MODEL=llama-3.3-70b-fp8 \\\nTE_SMOKE_AGENT_URL=https://httpbin.org/post \\\nnpx -y --package tuningengines-cli@latest te-inference-smoke\n```\n\n`TE_SMOKE_CREATE_MODEL_DEPLOYMENT=1` is useful for disposable tenants that do\nnot already have an enabled model. By default the runner treats a provider\nauthentication failure on an allowed model as proof that Tuning Engines RBAC\nallowed the request through to the provider. Set\n`TE_SMOKE_ALLOW_PROVIDER_AUTH_FAILURE=0` when the tenant has real provider\ncredentials and the allowed call must return `200`.\n\nTo test multiple tenant users, provide their API tokens:\n\n```bash\nTE_SMOKE_USERS_JSON='[\n  {\"email\":\"member1@example.com\",\"api_key\":\"te_user_key_1\"},\n  {\"email\":\"member2@example.com\",\"api_key\":\"te_user_key_2\"}\n]' \\\nTE_ADMIN_API_KEY=te_admin_key_here \\\nTE_SMOKE_MUTATE=1 \\\nnpx -y --package tuningengines-cli@latest te-inference-smoke\n```\n\nPreview coverage:\n\n```bash\nnpx -y --package tuningengines-cli@latest te-inference-smoke --list\n```\n\nEach run writes a masked JSON report under `te-smoke-results/`, or to\n`TE_SMOKE_REPORT` when that env var is set.\n\n## Authentication\n\n`te auth login` uses a secure device authorization flow (same pattern as `gh auth login`):\n\n1. CLI generates a device code and opens your browser\n2. Sign up or log in (email/password, Google, or GitHub)\n3. Click \"Authorize\" to grant CLI access\n4. Token flows back automatically — no copy-paste\n\nWorks for both new sign-ups and existing accounts. Token saved to `~/.tuningengines/config.json` with `0600` permissions.\n\n## Links\n\n- [Website](https://tuningengines.com)\n- [MCP Registry](https://registry.modelcontextprotocol.io)\n- [npm](https://www.npmjs.com/package/tuningengines-cli)\n- [GitHub](https://github.com/cerebrixos-org/tuning-engines-cli)\n\n## License\n\nMIT\n",
  "bytes": 36588,
  "sha": "adaaccf9bd2ca2c41b74bf0ef585307bbc24cfebafedac77bcc069af3af72c3f",
  "repo_slug": "cerebrixos-org/tuning-engines-cli",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_cerebrixos_tuning_engines_235ca92e/readme"
}