gatewayctl is the Go CLI for onboarding, policy, diagnostics, and operations against a deployed gateway. Every verb accepts --format text|json (use JSON in scripts and CI), and targeting flags like --environment, --control-plane-url, and --tenant.
gatewayctl explain # what gatewayctl does
gatewayctl <verb> --help # flags for any verb
Verb Purpose validate-manifestValidate an MCP server manifest before submitting. register-serverSubmit an MCP server to the registry. call-toolInvoke a governed tool. import-api / import-openapiImport selected REST operations as MCP tools. validate-agentValidate an agent manifest. register-agentRegister an agent.
See Register an MCP server and Import an OpenAPI spec .
Verb Purpose simulate-policyTest how a policy version decides a request. diagnose-denyTurn a machine deny reason into a diagnosis. policyReview and publish policy versions. validate-credential-bindingValidate a credential binding. credential-bindingList / get / update / rotate / disable / revoke / status. client-surfaceList / get / disable / revoke client surfaces.
See Simulate a policy decision .
Verb Purpose statusDeployment, data‑planes, and data‑plane detail. connectors / connector-statusManage and inspect private connectors. list-sessions / inspect-sessionList and inspect active sessions. drain-session / terminate-session / revoke-sessionSession lifecycle controls. emergency-disableBreak‑glass disable of a resource. telemetry / siem-webhookConfigure telemetry and SIEM/webhook delivery. environmentsList and read environments. licenseRead license status and entitlements.
Verb Purpose search-auditSearch the audit trail and pull request bundles. admin-activitySearch the admin activity log.
See Search the audit trail .
Verb Purpose bootstrap-adminCreate the first admin (local identity). bootstrap-self-hostedInitialize a self‑hosted deployment. claude-configEmit client config for connecting an AI client.
