# MesangeBleue > MesangeBleue hosts AI agents and web services. You push code with git; the platform builds it, runs it on its own HTTPS address, and can attach managed PostgreSQL. Everything is driven by the `mb` CLI. This file is for AI coding agents operating `mb` on a user's behalf. Human guide: https://get.mesangebleue.io/start Machine-readable endpoints: https://get.mesangebleue.io/agents.txt ## Install - macOS/Linux: `curl -fsSL https://get.mesangebleue.io | sh` (installs to `~/.local/bin`, verifies SHA-256, no root). Set `MB_INSTALL_DIR` to change the location, `MB_VERSION=vX.Y.Z` to pin a version. - Windows (PowerShell): `irm https://get.mesangebleue.io/install.ps1 | iex` - Check: `mb version`. Latest version: https://get.mesangebleue.io/mb/latest.txt ## Authenticate - Interactive: `mb login` opens a browser. You cannot complete it headlessly; ask the user to run it. - Headless/CI: a workspace API client. Export `MB_CLIENT_ID` and `MB_CLIENT_SECRET`, then run `mb service-login`. Never pass the secret as a flag: it shows in process lists. - `mb whoami` shows the current identity. Sessions refresh automatically. - Git pushes authenticate through the credential helper that `mb login` installs; no SSH keys or tokens to handle. ## Workspace selection Every `agent`/`tenant` command acts in one workspace: `--tenant `, else `MB_TENANT`, else the only workspace the user belongs to. If the user belongs to several, the command fails and lists them; ask which one to use and set `MB_TENANT`. ## Agent lifecycle 1. In the project's git repository: `mb agent create --name --runtime python|go|langchain`. This adds a git remote named `mb`. The slug is derived from the name; `--slug` sets it explicitly. 2. Deploy: `git push mb main`. Every push to the agent's branch (default `main`) builds and deploys. 3. Watch: `mb agent get --slug ` (JSON; wait for `status: running` and `pod.ready: true`; `status_db` is the stored value), `mb agent logs --slug `, `mb agent logs --slug --previous` after a crash. Follow live (like tail -f, survives restarts): `mb agent logs --slug -f [--grep TEXT]`. Search the archive (app and build logs, up to 30 days per search, lines arrive within ~3 min): `mb agent logs --slug --grep TEXT [--since 2h|7d] [--builds | --build ID] [--json]`. 4. Address: `https://..mesangebleue.io` (the `endpoint` field of `agent get`). App contract: listen on `$PORT` (HTTP). Python: `main.py`, `app.py` or `server.py` is started automatically; `requirements.txt` for dependencies; a `Procfile` `web:` line or `--start-command` overrides. A start command is one shell command line: plain commands (quotes allowed, e.g. `python -c "print(1)"`) run directly; anything using shell syntax (`&&`, `|`, `$VAR`, redirections, `FOO=bar cmd`) runs under `sh -c`. Go: a `go.mod` module with a main package. A `Dockerfile` in the repo root is used as-is. ## Commands - `mb agent list [--json]`, `mb agent get --slug S`, `mb agent update --slug S [--branch B] [--start-command C] [--port N] [--resource-plan small|medium|large] [--replicas N] [--private|--private=false] [--autoscale MIN-MAX|off]`, `mb agent rebuild --slug S`, `mb agent delete --slug S --yes` - Secrets (env vars, stored encrypted): `mb agent secret set --slug S --key K --stdin` (value on stdin), `mb agent secret list --slug S [--json]`, `mb agent secret delete --slug S --key K`, `mb agent secret copy --from S1 --to S2 --key K [--key K2]` (copies values between agents in the workspace without revealing them; needs owner or workspace owner/admin on the source, owner/contributor on the target; each copied key is logged in the source's `secret reads`). `mb agent secret get --slug S --key K --reason "..."` shows a value masked (`--reveal` prints it, `--out FILE` saves it with mode 0600): owner or workspace owner/admin only, signed-in people only, every read audited (`mb agent secret reads --slug S`). Agents: prefer `secret copy`; leave `get --reveal` to the human. Values apply after `mb agent secret sync --slug S` (restarts the agent) or the next push. - Databases: `mb agent db create --name D`, `mb agent db bind --slug S --db D --env-var DATABASE_URL` (restarts the agent with the URL set), `mb agent db list --slug S [--json]`, `mb agent db unbind --slug S --env-var V`. - Direct database access (requires the operator network; most users don't have it): `mb agent db credentials --slug S [--role readonly|readwrite] [--ttl 1h] --reason "..." [--json]`, `mb agent db connect --slug S -- `. - Custom domains: `mb agent alias add --slug S --domain D` prints a TXT record to add; point the domain at the agent with a CNAME; then `mb agent alias verify --slug S --domain D`. `mb agent alias list --slug S [--json]`. - Team: `mb agent owner --slug S`, `mb agent contributor add|remove --slug S --user EMAIL`, `mb agent transfer --slug S --to EMAIL`. EMAIL finds a member only after they have signed in with that verified address (otherwise pass their user sub); an invite can be accepted only by the address it was sent to. ## Autoscaling `mb agent update --slug S --autoscale 1-5` lets CPU load move the agent's pod count between 1 and 5 (within the plan's replica limit); `--autoscale off` returns to the fixed `--replicas`. Scale-down waits 5 minutes after load drops. Needs the owner or a workspace owner/admin. `mb agent get` shows the setting under `autoscale`. CPU is a weak signal for LLM agents that mostly wait on the model; request-based scaling is planned. ## Private agents `--private` (on `agent create` or `agent update`) removes the public URL. Only agents in the same workspace can call a private agent, at its internal address: `internal_endpoint` in `mb agent get --slug S` (shown before and after the switch, so point callers at it first, then run `--private`), e.g. `http://-.agent-workloads.svc.cluster.local:`. Use it for helper agents that only another agent calls; keep an auth check in the app anyway. Changing it needs the owner or a workspace owner/admin. ## Permissions Workspace members can read every agent (status, logs). The agent's owner and contributors can push, rebuild, and change settings and secrets. Deleting, transferring, contributors, domains and database bindings need the owner or a workspace owner/admin. A 403 that says "this needs ship/manage access" means the user lacks that role; tell them, don't retry. ## Conventions for agents - Exit codes: 0 success, 2 usage error (fix the flags), 1 anything else (read stderr). - Prefer `--json` where offered and `agent get` (always JSON) for state. - Destructive commands ask for confirmation; pass `--yes` only when the user explicitly asked for the deletion. - Don't print or log secret values; use `--stdin` for `secret set`. - `mb --help` and ` --help` list every flag.