/usr/local/bin/tsh

Usage: tsh [<flags>] <command> [<args> ...]

Teleport Command Line Client

Flags:
  -l, --login=LOGIN              Remote host login ($TELEPORT_LOGIN)
      --proxy=PROXY              Teleport proxy address ($TELEPORT_PROXY)
      --relay=RELAY              Teleport relay address, "none" to explicitly disable the use of a
                                 relay, or "default" to use the cluster-provided address even if a
                                 different address was specified at login time. ($TELEPORT_RELAY)
      --user=USER                Teleport user, defaults to current local user ($TELEPORT_USER)
      --ttl=TTL                  Minutes to live for a session
  -i, --identity=IDENTITY        Identity file ($TELEPORT_IDENTITY_FILE)
      --cert-format=CERT-FORMAT  SSH certificate format
      --[no-]insecure            Do not verify server's certificate and host name. Use only in test
                                 environments
      --auth=AUTH                Specify the name of authentication connector to use.
                                 ($TELEPORT_AUTH)
      --[no-]skip-version-check  Skip version checking between server and client.
  -d, --[no-]debug               Verbose logging to stdout.
  -k, --add-keys-to-agent="auto"
                                 Controls how keys are handled. Valid values are [auto no yes only].
                                 ($TELEPORT_ADD_KEYS_TO_AGENT)
      --[no-]enable-escape-sequences
                                 Enable support for SSH escape sequences. Type '~?' during an SSH
                                 session to list supported sequences. Default is enabled.
      --bind-addr=BIND-ADDR      Override host:port used when opening a browser for cluster logins
                                 ($TELEPORT_LOGIN_BIND_ADDR)
      --callback=CALLBACK        Override the base URL (host:port) of the link shown when opening a
                                 browser for cluster logins. Must be used with --bind-addr.
      --mfa-mode=auto            Preferred mode for MFA and Passwordless assertions (auto,
                                 cross-platform, platform, otp, sso) ($TELEPORT_MFA_MODE)
      --[no-]headless            Use headless login. Shorthand for --auth=headless.
                                 ($TELEPORT_HEADLESS)
      --mlock="auto"             Determines whether process memory will be locked and whether
                                 failure to do so will be accepted (off, auto, best_effort, strict).
                                 ($TELEPORT_MLOCK_MODE)
      --piv-slot=PIV-SLOT        Specify a PIV slot key to use for Hardware Key support instead of
                                 the default. Ex: "9d" ($TELEPORT_PIV_SLOT)
  -J, --jumphost=JUMPHOST        SSH jumphost

Commands:
  help                         Show help.
  version                      Print the tsh client and Proxy server versions for the current context.
  ssh                          Run shell or execute a command on a remote SSH node.
  resolve                      Resolves an SSH host.
  aws                          Access AWS API.
  az                           Access Azure API.
  gcloud                       Access GCP API with the gcloud command.
  gsutil                       Access Google Cloud Storage with the gsutil command.
  apps ls                      List available applications.
  apps login                   Retrieve short-lived certificate for an app.
  apps logout                  Remove app certificate.
  apps config                  Print app connection information.
  recordings ls                List recorded sessions.
  recordings export            Export recorded desktop sessions to video.
  proxy ssh                    Start local TLS proxy for ssh connections when using Teleport in single-port mode.
  proxy db                     Start local TLS proxy for database connections when using Teleport in single-port mode.
  proxy app                    Start local TLS proxy for app connection when using Teleport in single-port mode.
  proxy mcp                    Start local proxy for MCP access.
  proxy aws                    Start local proxy for AWS access.
  proxy azure                  Start local proxy for Azure access.
  proxy gcloud                 Start local proxy for GCP access.
  proxy kube                   Start local proxy for Kubernetes access.
  db ls                        List all available databases.
  db login                     Retrieve credentials for a database.
  db logout                    Remove database credentials.
  db env                       Print environment variables for the configured database.
  db config                    Print database connection information. Useful when configuring GUI clients.
  db connect                   Connect to a database.
  db exec                      Execute database commands on target database services.
  join                         Join the active SSH or Kubernetes session.
  play                         Replay the recorded session (SSH, Kubernetes, App, DB).
  scp                          Transfer files to a remote SSH node.
  ls                           List remote SSH nodes.
  clusters                     List available Teleport clusters.
  sessions ls                  List active sessions.
  login                        Log in to a cluster and retrieve the session certificate.
  logout                       Delete a cluster certificate.
  latency ssh                  Measure latency to a particular SSH host.
  status                       Display the list of proxy servers and retrieved certificates.
  env                          Print commands to set Teleport session environment variables.
  request ls                   List access requests.
  request show                 Show request details.
  request create               Create a new access request.
  request review               Review an access request.
  request search               Search for resources to request access to.
  request drop                 Drop one more access requests from current identity.
  headless approve             Approve a headless authentication request.
  kubectl                      Runs a kubectl command on a Kubernetes cluster.
  kube ls                      Get a list of Kubernetes clusters.
  kube login                   Login to a Kubernetes cluster.
  kube sessions                Get a list of active Kubernetes sessions. (DEPRECATED: use tsh sessions ls --kind=kube instead)
  kube exec                    Execute a command in a Kubernetes pod.
  kube join                    Join an active Kubernetes session.
  mfa ls                       Get a list of registered MFA devices.
  mfa add                      Add a new MFA device.
  mfa rm                       Remove a MFA device.
  scan keys                    Scan the local machine for SSH private keys and report findings to Teleport.
  scopes ls                    List scopes at which user has assigned privileges.
  config                       Print OpenSSH configuration details.
  update                       Update client tools (tsh, tctl) to the latest version defined by the cluster configuration.
  device enroll                Enroll this device as a trusted device. Requires Teleport Enterprise.
  svid issue                   Issue a SPIFFE SVID using Teleport Workload Identity and write it to a local directory.
  workload-identity issue-x509 Use Teleport Workload Identity to issue an X509 credential write it to a local directory.
  vnet                         Start Teleport VNet, a virtual network for TCP application access.
  vnet-ssh-autoconfig          Automatically include VNet's generated OpenSSH-compatible config file in ~/.ssh/config.
  git login                    Opens a browser and retrieves your login from GitHub.
  git ls                       List Git servers.
  git config                   Check Teleport config on the working Git directory. Or provide an action ('update' or 'reset') to configure the Git repo.
  git clone                    Clone a Git repository.
  piv agent                    Start PIV key agent.
  mcp db config                Print client configuration details.
  mcp ls                       List available MCP server applications.
  mcp config                   Print client configuration details.

Try 'tsh help [command]' to get help for a given command.