CLI reference

Help and version

Bare invocation prints the command overview; it does not start a long-running process:

dataporch
dataporch --help
dataporch -l
dataporch help status
dataporch --version

Published builds print dataporch v<version>. Unversioned source builds print dataporch devel. Help accepts -h and --help at each command level.

Runtime lifecycle

The lifecycle commands are:

dataporch secrets init
dataporch run
dataporch run -f
dataporch restart
dataporch status
dataporch stop

secrets init creates the local master key and encrypted secret store using the configured paths. The connection-definition and MCP-token stores are created when their corresponding commands first write state. run registers and starts the native per-user service; run -f runs in the current terminal. restart refreshes and restarts a registered service. stop stops and unregisters the generated service definition while preserving state.

status reports running, stopped, or failed. A running status includes the PID, HTTP address, and native log location. A stopped status uses exit code 3; successful commands use 0, runtime failures use 1, and usage errors use 2.

dataporch start and dataporch run --foreground are invalid. Use dataporch run and dataporch run -f respectively.

Connections

dataporch connections import --id finance --kind postgres

Supported kinds are postgres, sqlite, and mysql. The connection string is read from a hidden prompt, not a command-line argument.

Local MCP stdio adapter

dataporch mcp

Connects an MCP client over stdio to the running DataPorch service through the owner-only Unix socket. The command reads the current runtime credential from the configured local control-token path and refreshes it when the runtime rotates credentials. It requires initialized state and an already running runtime; it does not start the service.

Direct HTTP MCP token lifecycle

dataporch mcp-token create
dataporch mcp-token list
dataporch mcp-token rotate
dataporch mcp-token revoke
dataporch mcp-token revoke --yes

Create and rotate print the plaintext token once. List reports token state without returning the secret. Revoke is interactive unless --yes is supplied.

Local admin transport

The CLI talks to the Unix socket configured by DATAPORCH_ADMIN_SOCKET_PATH. The HTTP admin API behind that socket exposes connection import and direct HTTP MCP token lifecycle endpoints, but it is not an internet-facing API. If you built from source, replace dataporch with ./bin/dataporch.