nesly CLI

Every command, its flags and what it prints.

Account

nesly login	Sign in with the device flow and store the token.
nesly whoami	Show the signed-in account and which API is in use.
nesly logout	Remove the stored credentials from this machine.
nesly token create <name>	Create an access token for CI (shown once).
nesly token list	List your access tokens and when they were last used.
nesly token revoke <id>	Revoke a token immediately.

Projects

nesly new [template] [dir]	Start from a template (no argument lists the gallery).
nesly project create <name>	Create a project and print its address.
nesly project list	List your projects.
nesly project delete <name> --yes	Delete a project, its deployments and its addons.
nesly project info	Everything about one project on a single screen: address, what is live, domains, databases.
nesly project rename <project> <new-name>	Change a project's name. Its address does not change, so no link breaks.
nesly project transfer <project> --to <account> --yes	Transfer a project to another account you belong to. The site stays up.
nesly link <project>	Link this directory to a project (writes .nesly/project.json).
nesly open	Open the project's URL in your browser.

Deploying

nesly deploy	Build and publish the current directory; prints the live URL.
nesly deploy --preview	Deploy to an address of its own; the live site is left exactly as it is.
nesly deploy --prod	Deploy to the live site. This is what a deploy does anyway; the flag says so in a script.
nesly deploy --yes	Same, creating and linking the project if it does not exist.
nesly cancel <deployment-id> --yes	Stop a queued or in-progress build before it goes live.
nesly redeploy <deployment-id> --yes	Start a new build from the same source as an existing deployment.
nesly ls	List deployments, newest first, with their ids.
nesly inspect <deployment-id>	Status, tier, failure reason and URLs for one deployment.
nesly rollback <deployment-id>	Repoint traffic at a previous deployment, instantly.
nesly deploy --percent 10	Give the new release a tenth of your visitors; the rest stay on the one that is live.
nesly rollout	How the two releases are doing: the share each has, what it served, what failed.
nesly rollout set 50	Change how much of your traffic the new release takes (1-99).
nesly rollout promote	Give the new release everything. You can still roll back to the one it replaced.
nesly rollout abort	Send every visitor back to the release that is live. It keeps its address and its logs.
nesly maintenance on	Show visitors a page instead of the site — every address, previews included.
nesly maintenance on --message "..."	Say it in your own words, in your visitors' language.
nesly maintenance off	Serve the site again.
nesly maintenance	Whether the page is up, and how long it has been.
nesly logs	What your application wrote, including after it stopped running (kept for 7 days).
nesly logs --follow	Stream build and runtime output.
nesly ps	Every process this project runs, whether it is running, and how much CPU and memory it is using against what it is allowed.
nesly logs --worker <name>	Stream one background process instead of the server.
nesly logs drains add <url>	Forward everything your application writes to your own log system, signed.
nesly logs drains list	Where this project's logs go, and whether they are arriving.
nesly logs drains test <id>	Send one line now and see what your receiver answered.
nesly traffic	Which routes your project served, and which of them failed.
nesly traffic --sort errors	Rank routes by how many requests failed inside your application.
nesly traffic failures	The individual failed requests: the exact status, when, and how long it took.
nesly traffic failures --status 502	Only the requests where your application could not be reached.
nesly scan	Known vulnerabilities in the image your deployment runs: the package, the version you have, and the version that fixes it.
nesly scan --min-severity high	Only the findings at that severity or above. The totals still describe the whole image.
nesly diagnose	Explain a failed deployment: findings, missing env vars, the fix.
nesly mcp setup	Connect the AI assistants installed here, so one can deploy and read logs for you.
nesly mcp	Serve the platform as MCP tools on stdio, for MCP clients.

Builds

nesly init	Detect the framework here and write nesly.toml.
nesly build show	Show the build settings and what this directory would build.
nesly build set --output dist	Change a build setting (root, install, command, output, start).
nesly build clear [field...]	Return a setting to nesly.toml and detection.

Protecting your site

nesly protect show	Whether a rate limit is set, and whether it is being applied.
nesly protect set --per-minute 600 --burst 100	Limit how quickly one visitor address may load the site. Off by default; the platform never limits your visitors on its own.
nesly protect off	Remove the limit.
nesly protect countries --allow TR	Serve the site only in the countries you list. Visitors whose country cannot be determined are always served.
nesly protect countries --block RU,CN	Serve everyone except the countries you list.
nesly protect countries --off	Remove the country rule.

Deploy hooks

nesly hooks create "contentful, production"	Make a URL that rebuilds this project. It is shown once; paste it into the system that should trigger the build.
nesly hooks ls	The project's hooks, how many builds each has started, and when it last fired.
nesly hooks rm <id> --yes	Remove one. Its URL stops working immediately.

Scheduled jobs

nesly cron add nightly --schedule "0 3 * * *" -- php artisan schedule:run	Run a command inside your application on a clock. Add --timezone to set it in your own time.
nesly cron ls	The schedules on this project and when each one runs next.
nesly cron run <name>	Run a schedule now, without waiting for its next time, and print what it printed.
nesly cron run <name> --detach	Start it and return, instead of waiting for it to finish.
nesly cron runs <name>	The recent runs, with how long each took and what it exited with.
nesly cron logs <name>	What the most recent run printed; --run reads an older one.
nesly cron pause <name>	Stop it firing without losing the schedule.
nesly cron resume <name>	Start firing again.
nesly cron rm <name>	Remove the schedule.

Configuration

nesly env set KEY=VALUE	Set variables; they apply to the next deployment.
nesly env set KEY	Read the value from standard input instead — a secret written as an argument is visible to anyone who can list processes, and your shell keeps it in its history.
nesly env set --from-file .env	Import KEY=VALUE lines from a file, the way another platform exported them.
nesly env set KEY=V --env preview	Set a value for one environment only; it wins over the general one.
nesly env ls [--reveal]	List variables; values are hidden unless --reveal.
nesly env ls --env preview	Show what a preview actually resolves to.
nesly env rm KEY [--env preview]	Remove a variable, everywhere or from one environment.
nesly env share KEY --with preview	Let previews use production's value for KEY, on purpose.
nesly auth protect	Close this project's addresses to everyone but your team, at the edge, before your app sees a request.
nesly auth allow ada@client.com	Let somebody outside your team in; a whole domain works too (@client.com).
nesly auth clear	Remove the sign-in requirement.
nesly auth status	Whether the gate is on, and who may pass it.
nesly auth provider set --kind oidc --issuer https://accounts.google.com --client-id ... --client-secret ...	Sign your visitors in with your own Google, Microsoft, OIDC or GitHub app. Your application writes no auth code — it reads X-Nesly-User-Id / Email / Name from the request.
nesly auth provider show	Which provider a project uses, and the one redirect URI to register with it.
nesly auth provider clear	Go back to platform sign-in.
nesly protect preview set --password ...	Ask for a password before anyone opens your preview addresses.
nesly protect preview token	Create a token so CI can reach a protected preview; shown once.
nesly protect preview off	Open preview addresses to anyone with the link again.
nesly protect ip block <addr\|range>	Block one address or range; allow does the opposite.
nesly protect rule block --path /wp-admin/*	Block requests by what they ask for rather than where they come from — a path, a header, or the client's name.
nesly protect rule ls	The request rules on this project, in the order they apply.
nesly activity	Who did what in this account, denied attempts included.
nesly bisect --good X --bad Y -- <cmd>	Find which release broke something; your command decides.
nesly certs add --cert ... --key ...	Serve your own certificate on one of your domains.
nesly deploy --image ghcr.io/...	Deploy an image you already built; nothing is uploaded or built.
nesly registry set ghcr.io --username USER --password-stdin --yes	Store a pull login for a private third-party registry used by deploy --image. Password from stdin or --password-file.
nesly registry ls	List saved private-registry hosts (passwords are never shown).
nesly registry rm ghcr.io --yes	Remove a saved private-registry pull login.
nesly logs --request req_...	Only the log lines mentioning one request.
nesly run --tty -- bash	Open a shell in a new container from the deployment's image.
nesly env pull [file]	Write the variables to a local .env — real secrets, keep it out of git.
nesly env get KEY	Print one value and nothing else, for scripts.
nesly env run -- <cmd>	Run a local command with the project's variables, writing nothing to disk.
nesly addon add postgres	Attach a managed PostgreSQL database (injects DATABASE_URL).
nesly addon add mysql	Attach a managed MySQL database (injects DATABASE_URL; Laravel DB_* derived).
nesly addon add mssql	Attach a managed SQL Server database (also injects ConnectionStrings__Default for .NET).
nesly addon add valkey	Attach a Redis-compatible key-value store (injects REDIS_URL and VALKEY_URL).
nesly addon add bucket	Attach an S3-compatible object-storage bucket (injects AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_ENDPOINT_URL, AWS_BUCKET).
nesly proxy	Open the project's database on a local port, for TablePlus, DBeaver or any tool you already use.
nesly db	Open a database prompt using the client installed on this machine (psql, sqlcmd).
nesly addon ls	List attached addons.
nesly addon rotate postgres --yes	Rotate credentials without deleting data; redeploy so the app picks up the new env.
nesly addon rm postgres --yes	Detach an addon.
nesly backup create	Copy the project's database now (nightly copies happen anyway).
nesly backup ls	List backups, newest first, with sizes.
nesly backup restore <id> --yes	Replace the database's contents with that copy.
nesly backup download <id>	Download the archive; pg_restore reads it anywhere.
nesly run -- <cmd>	Run a command in the deployed image; exits with its exit code.
nesly domain add <fqdn>	Add a custom domain (root domains get A records) and print what to create.
nesly domain delegate <fqdn>	Manage the domain's DNS here: prints the nameservers to set at your registrar, and after that you create no records at all.
nesly domain verify <fqdn>	Check the DNS records now instead of waiting for the next automatic round.
nesly domain verify <fqdn> --wait	Keep checking until the domain is live — what you want right after creating the records.
nesly domain ls	List domains, their status, and any release they are pinned to.
nesly dns ls <fqdn>	List DNS records in a zone whose nameservers point here (after domain delegate + verify).
nesly dns add <fqdn> --type TXT --name mail --value "…"	Create or update one DNS record (A, AAAA, CNAME, TXT, MX). Platform records that keep the site online cannot be overwritten.
nesly dns rm <fqdn> --type TXT --name mail --yes	Delete DNS records of that type and name. Platform A/challenge records cannot be removed.
nesly domain pin staging.example.com <deployment-id>	Make one address serve a specific release while every other address follows new deployments.
nesly domain unpin staging.example.com	Let the address follow whatever is live again.
nesly certs	The HTTPS certificate each of your addresses actually serves, and when it expires.
nesly usage	Requests, egress and build time for the last 30 days.
nesly limits	What your plan allows and how much of it you have used.
nesly egress	Shared outbound IP addresses for bank and payment-gateway allow lists.
nesly status	Active platform notices (shared engine maintenance). Empty means none. Not project maintenance.
nesly operator notices ls	Operator: list platform notices (requires operator grant).
nesly operator notices publish --title T --body B --yes	Operator: publish a tenant-visible notice. Optional --severity and --engine.
nesly operator notices resolve ID --yes	Operator: hide a notice from tenants.
nesly account ls	The accounts you can work in, and which one commands act on.
nesly account use <name>	Work in one of them; remembered until you change it or sign in again.
nesly team ls	Who is in this account, their role, and who has not signed in yet.
nesly team invite <email> --role member	Invite a user; they join when they sign in with that address.
nesly team invite <email> --project shop	Give a user one project instead of the account. They see nothing else here.
nesly team ls --project shop	Who was given that one project.
nesly team remove <email>	Remove access, or withdraw an invitation. Their tokens stop working too.
nesly team remove <email> --project shop	Take away that one project.
nesly team leave	Give up your own access to the account you are working in.
nesly account export	Download everything the platform holds about your account.
nesly rm <deployment-id>	Remove one deployment and the files it published.
nesly account notifications ls	The messages we sent you, and whether they arrived.
nesly account notifications show	Which messages reach you right now.
nesly account notifications set	Choose which messages reach you, and in which language.
nesly account close --confirm <email> --yes	Close the account and destroy everything in it.

Flags on every command

--project <name>	Act on this project instead of the linked one.
--dir <path>	Use another directory as the project root (default: .).
--json	Print exactly one JSON object on stdout — for scripts and agents.
--yes	Confirm destructive actions and create a missing project.
--api <host:port>	Point at another platform (or set NESLY_API).
--account <name>	Work in one of your other accounts for this command only.

Environment variables

For CI: create a token with nesly token create "github actions", store it as a secret, and the pipeline deploys as you — with your role in the team. Leave the team and the token stops working.

NESLY_TOKEN	An access token. Set it in CI and every command uses it — no browser sign-in.
NESLY_API	The platform API address, when it is not the default.
NESLY_ACCOUNT	The account a pipeline works in, when it is not your own.

Exit codes

Stable, so scripts can branch on them. Errors go to stderr; results go to stdout.

0	success
1	error
2	usage error
3	not signed in, or not allowed
4	not found
5	conflict (already exists, wrong state)

Scripting and agents

With --json every command prints one object on stdout and nothing else; progress and logs stay on stderr. That, plus the exit codes above, is the whole contract — no output parsing required.

nesly deploy --json | jq -r .url