saphan server
Runs the projection server, which serves the installation's record over MCP (stdio and HTTP), as static HTML, and as the console at /console, reading state fresh from the record on every request.
Runs the projection server, which serves the installation's record over MCP (stdio and HTTP), as static HTML, and as the console at /console, reading state fresh from the record on every request. The MCP surface is read-only: it has no tools that change anything. The console is not: behind its login session it records the owner's gate decisions, merges pull requests, dispatches work, saves the egress policy table and opens live terminals on admitted machines. The installation's saphan-server daemon also runs this projection service; this command starts it on its own.
saphan server reload
Tells the running projection server (found through its process-id file) to re-read its configuration; if the new configuration does not load, the server keeps the previous one. The record is always read fresh, so state needs no reload.
saphan server start
Starts the projection server in the foreground, listening on 127.0.0.1:7654 by default. It only listens beyond this machine when you give a full address such as 0.0.0.0:7654; MCP requests over HTTP require a bearer token and console pages a login session. It refuses to start until this machine has an enrolled actor and a loadable root public key, and when the configuration asks for passkey-signed console acts but the private act listener cannot be bound. ⚠ A few routes answer without any credential: /metrics (aggregate counts of runs, refusals and gates) and the install bootstrap files under /get/.
| flag | type | default | what it does |
|---|---|---|---|
--access-log | string | Where to write one access-log line per request: a file path (appended), off, or empty for standard output (standard error with --stdio); a path that cannot be appended to stops the start. | |
--config | string | The configuration file to read the act-signing settings from; defaults to the installation's own configuration file, and a file you name that does not exist stops the start. | |
--detach | bool | false | Start in the background, logging to the server log file, and return once the server is confirmed to be answering. Cannot be combined with --stdio or with port 0. |
--listen | string | 127.0.0.1:7654 | The address to listen on, as host:port; the host is required, so :7654 alone is refused rather than read as all interfaces. Without the flag, the SAPHAN_SERVER_LISTEN variable, then the server.listen setting, then the loopback default apply. |
--stdio | bool | false | Speak MCP on standard input and output for a local MCP client, instead of serving HTTP. |
--tunnel | bool | false | Expose the listener publicly through a Cloudflare quick tunnel, run as a child process; requires cloudflared on PATH. Cloudflare handles TLS and exposure; MCP still needs a bearer token and the console a login session, but the credential-free routes become public too. |
saphan server status
Reports whether the projection server is running, with its process id and the act-signing mode the running server recorded. ⚠ The listen address it prints is the one a fresh start would resolve from the current settings, not one read from the running process.
saphan server stop
Stops the running projection server by sending it a termination signal; it finishes open requests for up to five seconds.
Global options apply to every command — see Every command.