CLI reference
One static binary, dynv. It runs your app, manages your account from a terminal, and hosts the MCP server. This page is generated from dynv 0.1.0's own --help.
Install
curl -fsSL https://dynv.dev/install.sh | sh
dynv --versionOr build from source with cargo build --release -p dynv, or copy it into an image from the client stage of deploy/Dockerfile (Quickstart).
Configuration is environment only
Secrets are never accepted as arguments: argv is readable by other users through /proc and ends up in shell history. DYNV_URL, DYNV_TOKEN, DYNV_MASTER_TOKEN and DYNV_BOOTSTRAP_TOKEN also have a _FILE form (for example DYNV_TOKEN_FILE=/run/secrets/dynv) that reads the value from a file, for Docker secrets.
| Variable | Used by | Meaning |
|---|---|---|
DYNV_URL | all | API base URL, https://api.dynv.dev. Must be https, except to loopback or with DYNV_ALLOW_INSECURE_HTTP=1. No credentials or query string. |
DYNV_TOKEN | run, get | Service token (dynv_pt_…). |
DYNV_PROCESS | run, get | Expected service name; data for any other name is refused. Same as --process. |
DYNV_CACHE | run | Cache file path. Same as --cache. |
DYNV_MASTER_TOKEN | admin, mcp | Master token (dynv_mt_…). |
DYNV_BOOTSTRAP_TOKEN | admin init | One-time setup secret of a self-managed server. |
DYNV_STATE_DIR | admin, mcp | Where the newest version you have seen is remembered (default under XDG_STATE_HOME, ~/.local/state/dynv). It protects you against a server replaying old data. |
DYNV_ALLOW_INSECURE_HTTP | all | Set to 1 to allow plain http:// on a trusted private network. |
Inside the process that dynv run starts, you also get DYNV_AGENT_URL and DYNV_AGENT_KEY (used by the SDK). DYNV_TOKEN is removed from your app's environment.
Common tasks
# run your app; hot values update, restart values restart it
dynv run --cache /var/lib/app/dynv.cache -- node dist/api.js
# read one value in a script
dynv get PROXY_SERVER
# see what exists (values stay masked)
dynv admin ls
# set several variables without touching shell history
printf 'PROXY_SERVER=http://proxy.example:8000\nPROXY_USER=alice\n' | dynv admin set web --stdin --hot
# a token for a new deployment, written to a file
dynv admin token create web --label "eu-1" --out web-eu-1.token
# something leaked: revoke it and rotate the key in one write
dynv admin token revoke <token-id>All commands
Each block is the verbatim output of --help for that command.
dynv
Global flags are only -h and -V. Everything else lives on a subcommand.
Zero-knowledge live environment variables
Usage: dynv <COMMAND>
Commands:
run Run a command with its Dynv env; hot-apply or restart on change
get Print one variable's current value (for scripts)
admin Admin operations (needs DYNV_MASTER_TOKEN)
mcp Local stdio MCP server for agents (needs DYNV_MASTER_TOKEN)
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
-V, --version Print versiondynv run
Starts your command with its Dynv environment and keeps it current. Everything after -- is your command. Exits with your command's exit code, so a Docker restart policy keeps working. Forwards SIGHUP; SIGTERM and SIGINT stop your command gracefully. --poll is clamped to a minimum of 5. --agent-listen is the address of the local agent that serves hot values, and must be a loopback address. --boot-timeout is how many seconds the first live fetch may take before falling back to the cache or the inherited env.
Run a command with its Dynv env; hot-apply or restart on change
Usage: dynv run [OPTIONS] <CMD>...
Arguments:
<CMD>...
Options:
--process <PROCESS> Expected process name (also DYNV_PROCESS) [env: DYNV_PROCESS=]
--require Fail instead of starting with the inherited env when Dynv is unreachable and there is no cache
--poll <POLL> Poll interval / max backoff, seconds [default: 120]
--no-watch Disable long-poll; poll every --poll seconds instead
--grace <GRACE> Seconds between SIGTERM and SIGKILL on restart [default: 10]
--agent-listen <AGENT_LISTEN> [default: 127.0.0.1:0]
--cache <CACHE> Ciphertext-only cache file for offline boot and rollback protection [env: DYNV_CACHE=]
--boot-timeout <BOOT_TIMEOUT> [default: 10]
-h, --help Print helpdynv get
Prints one variable's current value to stdout and exits 0; exits 1 with an error if it is not set. Needs DYNV_URL and DYNV_TOKEN.
Print one variable's current value (for scripts)
Usage: dynv get [OPTIONS] <KEY>
Arguments:
<KEY>
Options:
--process <PROCESS> [env: DYNV_PROCESS=]
-h, --help Print helpdynv admin
Everything that manages your account from a terminal. Needs DYNV_URL and DYNV_MASTER_TOKEN. Write commands need a writer (owner) master token; a recovery token can read only.
Admin operations (needs DYNV_MASTER_TOKEN)
Usage: dynv admin <COMMAND>
Commands:
init Create the account (needs DYNV_BOOTSTRAP_TOKEN). Prints the master token once
ls List processes, variable names and tokens
show Show a process's variables (masked unless --reveal)
add Create a process
rm Delete a process and revoke its tokens
set Set KEY=VALUE pairs. Use --stdin to read KEY=VALUE lines (keeps values out of shell history)
unset Remove variables
prune-removed Drop deletion tombstones (all, or the given keys) once deployments no longer inherit those keys
mode Change how variables apply
token Process tokens
master Add another master token (recovery kit / second admin)
rotate Rotate a process's data key
audit Recent audit events
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print helpdynv admin init
One-time setup for a self-managed server. Needs DYNV_BOOTSTRAP_TOKEN. Prints the new master token once (or writes it to --out, mode 0600). Hosted accounts are created in the browser instead.
Create the account (needs DYNV_BOOTSTRAP_TOKEN). Prints the master token once
Usage: dynv admin init [OPTIONS]
Options:
--out <OUT>
-h, --help Print helpdynv admin ls
Lists every service with its version, each variable name and apply mode, and each token with its live or revoked state.
List processes, variable names and tokens
Usage: dynv admin ls
Options:
-h, --help Print helpdynv admin show
Prints one service's variables. Values are masked to their length unless you pass --reveal.
Show a process's variables (masked unless --reveal)
Usage: dynv admin show [OPTIONS] <PROCESS>
Arguments:
<PROCESS>
Options:
--reveal
-h, --help Print helpdynv admin add
Creates an empty service. Names: letters, digits, . _ -, up to 128 characters, not starting with . or -.
Create a process
Usage: dynv admin add <PROCESS>
Arguments:
<PROCESS>
Options:
-h, --help Print helpdynv admin rm
Deletes the service and revokes all its tokens. Running copies keep their last values until they restart.
Delete a process and revoke its tokens
Usage: dynv admin rm <PROCESS>
Arguments:
<PROCESS>
Options:
-h, --help Print helpdynv admin set
Sets KEY=VALUE pairs. Use --stdin to read KEY=VALUE lines (blank lines and # comments are skipped) so values stay out of your shell history. --hot and --restart set the apply mode and cannot be combined; without either, an existing variable keeps its mode. Variables that control program startup or code loading (NODE_OPTIONS, LD_PRELOAD, PATH and the like) are refused unless you pass --allow-dangerous.
Set KEY=VALUE pairs. Use --stdin to read KEY=VALUE lines (keeps values out of shell history)
Usage: dynv admin set [OPTIONS] <PROCESS> [PAIRS]...
Arguments:
<PROCESS>
[PAIRS]...
Options:
--stdin
--hot
--restart
--allow-dangerous Allow variables that control program startup / code loading (NODE_OPTIONS, LD_PRELOAD, PATH, ...)
-h, --help Print helpdynv admin unset
Removes variables. A signed marker is kept so a removed variable does not fall back to an inherited value.
Remove variables
Usage: dynv admin unset <PROCESS> [KEYS]...
Arguments:
<PROCESS>
[KEYS]...
Options:
-h, --help Print helpdynv admin prune-removed
Drops those markers (all, or the keys you list) once no deployment still inherits the old values. A service holds at most 256 of them.
Drop deletion tombstones (all, or the given keys) once deployments no longer inherit those keys
Usage: dynv admin prune-removed <PROCESS> [KEYS]...
Arguments:
<PROCESS>
[KEYS]...
Options:
-h, --help Print helpdynv admin mode
Sets the apply mode of the listed keys. MODE is hot or restart.
Change how variables apply
Usage: dynv admin mode <PROCESS> <MODE> [KEYS]...
Arguments:
<PROCESS>
<MODE> [possible values: hot, restart]
[KEYS]...
Options:
-h, --help Print helpdynv admin token
Service token commands: create and revoke.
Process tokens
Usage: dynv admin token <COMMAND>
Commands:
create Create a process token. Prints it once (or writes it to --out, mode 0600)
revoke Revoke tokens (all of one process) and rotate its key, in one write
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print helpdynv admin token create
Creates a service token and prints it once, or writes it to --out with mode 0600 (it refuses to overwrite a file). --label is encrypted, and helps you recognise the token later.
Create a process token. Prints it once (or writes it to --out, mode 0600)
Usage: dynv admin token create [OPTIONS] <PROCESS>
Arguments:
<PROCESS>
Options:
--label <LABEL> [default: ""]
--out <OUT>
-h, --help Print helpdynv admin token revoke
Revokes the tokens whose ids you pass and rotates the service's data key in the same write. --emergency only cuts access (use it from a machine that lacks your state file); writes to that service are then refused until it is rotated, which the next normal write does for you. Token ids come from dynv admin ls.
Revoke tokens (all of one process) and rotate its key, in one write
Usage: dynv admin token revoke [OPTIONS] <TOKEN_IDS>...
Arguments:
<TOKEN_IDS>... Token ids are base64url and may start with '-'
Options:
--emergency Cut access now without rotating (e.g. from a machine without the state file). Writes to the process are refused until it rotates
-h, --help Print helpdynv admin master
Creates another master token (a read-only recovery kit by default, label recovery). Store the file offline.
Add another master token (recovery kit / second admin)
Usage: dynv admin master [OPTIONS]
Options:
--label <LABEL> [default: recovery]
--out <OUT>
-h, --help Print helpdynv admin rotate
Rotates a service's data key and re-issues it to every live token.
Rotate a process's data key
Usage: dynv admin rotate <PROCESS>
Arguments:
<PROCESS>
Options:
-h, --help Print helpdynv admin audit
Prints recent events: time, action, ok or FAIL, actor, service id, token id and IP. Metadata only.
Recent audit events
Usage: dynv admin audit [OPTIONS]
Options:
--limit <LIMIT> [default: 50]
-h, --help Print helpdynv mcp
Runs the local MCP server over stdio. See the MCP page for what each flag does and the safe way to set it up.
Local stdio MCP server for agents (needs DYNV_MASTER_TOKEN)
Usage: dynv mcp [OPTIONS]
Options:
--allow-reveal Allow agents to read plaintext values back (off by default)
--read-only
--allow-token-create Allow agents to mint process tokens (written to --token-dir). An agent that can also read files as this user could read them: only enable where the agent has no filesystem access, or a different OS user owns --token-dir
--allow-process-admin Expose create_process and revoke_token to agents (off by default)
--allow-keys <ALLOW_KEYS> Restrict which variables agents may set/unset (glob, repeatable), e.g. --allow-keys 'PROXY_*'
--token-dir <TOKEN_DIR>
-h, --help Print help