# TARE CLI

> Command reference for the `tare` CLI, the single-command operator tool that installs, upgrades, and manages the Agent Router data plane.

# TARE CLI

  <code>tare</code> (Tetrate Agent Router) is a single-command operator tool for deploying the Agent Router dataplane. It collapses three manual steps (image sync, pull-secret creation, and Helm deployment) into one invocation.

## Commands

| Command | Description |
|---|---|
| [`tare install`](./install.mdx) | Install the Agent Router dataplane |
| [`tare uninstall`](./uninstall.mdx) | Tear down the Agent Router dataplane (cluster-only; reverses install) |
| [`tare upgrade`](./upgrade.mdx) | Upgrade an existing Agent Router dataplane release (HA-safe, atomic) |
| [`tare gateway install`](./install-gateway.mdx) | Install serve gateway resources (GCP, Azure, or AWS) |
| [`tare gateway config init`](./gateway-config-init.mdx) | Generate a starter `gcp-gateway.json` from a domain + project ID |
| [`tare gateway config lint`](./gateway-config-lint.mdx) | Lint a `gcp-gateway.json` config (hermetic, CI-safe) |
| [`tare mcp install`](.) | Deploy MCP server pods on a customer cluster |
| [`tare mcp list`](.) | Show deployed MCP server status |
| [`tare mcp enable`](.) | Register a deployed MCP server in the management plane's MCP catalog |
| [`tare mcp uninstall`](.) | Remove the `tars-mcp` Helm release |
| [`tare integrate`](/agent-router-service/guides/coding-agents/configure-tools-with-tare-cli) | Configure local coding tools (Claude Code, Codex, and others) against your Agent Router gateway |

## Quick start

```bash
# Print Helm values without touching the cluster
tare install identity.json --serve-url https://proxy.acme.com --print-helm-values

# Full install
tare install identity.json --serve-url https://proxy.acme.com

# Sync images to a private registry then install
tare install identity.json --serve-url https://proxy.acme.com \
  --image-sync myregistry.example.com

# Sync + create pull secret + install in one command
echo "user:password" | tare install identity.json \
  --serve-url https://proxy.acme.com \
  --image-sync myregistry.example.com \
  --image-pull-secret-stdin
```

## Identity file

`tare` accepts the service-account file in both formats produced by the
management plane:

**Wrapped format** (standard):
```json
{
  "serviceAccount": { ... },
  "checksum": "664b355c...",
  "checksumAlgorithm": "sha256"
}
```

**Naked format** (direct service account JSON):
```json
{
  "type": "service_account",
  "clientEmail": "default.prod@acme.sa.iam.tetrate.ai",
  ...
}
```

Use `tars sa wrap` to convert a naked file to the wrapped format.

## Gateway config schema

For `tare gateway install`, the config file shape depends on the provider:

- [`gcp-gateway.json` schema](./gcp-gateway-config.mdx): `--type gcp`
- [`azure-gateway.json` schema](./azure-gateway-config.mdx): `--type azure`
- `--type aws` takes no config file; it is configured entirely by flags

## Version

```bash
tare --version
```

## CLI reference docs

The `docs/tare/cli/ref/` directory contains auto-generated per-command reference
files derived directly from each command's `--help` output.

Regenerate after any flag or help-text change:

```bash
make cli.docs
```

CI verifies the directory is up to date on every PR:

```bash
make cli.docs && git diff --exit-code docs/tare/cli/ref/
```

`make cli.docs` depends on `cli.embed-charts` and `cli.manifest` (both run
automatically as prerequisites).  The generator binary lives at
`svc/cli/cmd/tare-docgen`.

Where to go next

  <Link to="/reference/tare-cli/install" className="tare-nav-card">
    tare install
    Full reference for installing the data plane on a target cluster.
  </Link>
  <Link to="/reference/tare-cli/gateway-config-init" className="tare-nav-card">
    tare gateway config init
    Generate a starter gateway config from a domain and project ID.
  </Link>