Cheatsheet

On the laptop #

Check setup and connect:

1lend keys --socket "$SSH_AUTH_SOCK"
2lend doctor --config ./policy.json
3lend ssh --config ./policy.json -- agent-vm
4lend ssh --config ./profiles.json --profile development -- agent-vm

Inspect sessions from another terminal:

1lend status --all --watch
2lend history --all
3lend pause --all
4lend resume --all
5lend clear-leases --all

Control one session with the socket path printed by lend ssh:

1lend status --socket /path/to/agent.sock --json
2lend revoke --socket /path/to/agent.sock REQUEST_ID
3lend clear-leases --socket /path/to/agent.sock LEASE_ID

Explain a rule without requesting access:

1lend explain --config ./policy.json --reason "Inspect the pull request" -- \
2  gh pr view 123 --repo example/project
3lend explain --config ./policy.json \
4  --key SHA256:KEY_FINGERPRINT --purpose sshsig --namespace git

On the remote host #

Check forwarding and request a local command:

1lend doctor --remote
2lend exec --reason "Inspect the pull request" -- \
3  gh pr view 123 --repo example/project
4lend keys

Start the stdio MCP bridge from a client that inherits the forwarded socket:

1lend mcp

Manually managed proxy #

Keep this running in a laptop terminal:

1lend agent --config ./policy.json --socket "$HOME/.lend/agent.sock"

Connect from a second laptop terminal:

1SSH_AUTH_SOCK="$HOME/.lend/agent.sock" ssh -A agent-vm

The manually managed proxy stays running until you stop it. Use lend ssh for per-connection lifetime management and approval leases.