CLI

pando

Host your apps without setting up a deployment pipeline

Flags

Commands

• pando adapter
• pando admin
• pando ai
• pando app
• pando approvals
• pando audit
• pando backup
• pando cluster
• pando config
• pando deploy
• pando events
• pando exec
• pando export
• pando grant
• pando group
• pando host-agent
• pando identity-provider
• pando instructions
• pando join
• pando login
• pando logs
• pando mcp
• pando migrate
• pando notifications
• pando notify
• pando plan
• pando policy
• pando restart
• pando role
• pando rollback
• pando secret
• pando section
• pando self-update
• pando serve
• pando slot
• pando source
• pando subscriptions
• pando token
• pando two-factor
• pando updates
• pando upgrade
• pando user
• pando version

pando config

Show the server's startup configuration and where each setting came from

Lists every setting the server started with, its value, and where it was set: an environment variable, the config file, or the default. Host policy fields set there are listed separately; they cannot be changed with pando policy set while they are set. Secrets are never shown.

Flags

Global flags

pando deploy

Deploy an app, or a directory on this machine

With an app ID, deploys that app. With a path, packs the directory, uploads it as the app's source, and deploys that.

The second form is for an agent: something that has just generated an app cannot commit and push, but it can run a command.

Flags

Global flags

pando events

List the events a subscription can name, or an app's recent events with --app

Flags

Global flags

pando exec

Run a command inside a running app

Opens a terminal inside a running workload.

This is the most privileged thing you can do to an app: what runs here can read the app's database directly and read its injected environment, including secrets. The command is recorded in the audit log; what happens inside the session is not.

Flags

Global flags

pando export

Print an app's spec

Flags

Global flags

pando join

Join a new Pando to a cluster with a join token

Joins the Pando at --server, which must be new, with no account or app, to the cluster that minted the join token (pando cluster tokens create). The Pando checks the cluster's certificate authority against the token, joins, and restarts into the cluster. It also needs the setup_token that Pando printed to its log at startup.

Each token is read from PANDO_JOIN_TOKEN and PANDO_SETUP_TOKEN, or asked for without echoing, or read from standard input one per line, join token first.

Flags

Global flags

pando login

Sign in and store a token for this machine

Opens Pando in your browser, where you sign in however your account signs in — a password, two-factor authentication, or your organization's identity provider — and approve this CLI. The CLI then stores a token that acts as you and holds nothing you do not. pando mcp uses the same token.

On a machine with no browser, such as over SSH, --no-browser prints the address to open on another computer and asks for the code shown there.

--username signs in with a username and password in the terminal instead.

Flags

Global flags

pando logs

Read an app's logs

Read an app's logs.

An app made of several parts — a web service, a worker, a database it brought with it — has a log per part. Without --workload this is the primary one, which is the part the app's address resolves to. pando app status <app> lists the names.

Flags

Global flags

pando mcp

Run an MCP server over stdio, for agents

Exposes Pando's API as MCP tools, using the token from pando login.

An agent is a principal like any other: nothing here bypasses authorization, and every action lands in the audit log under the token's owner. The most dangerous actions — running commands in apps, reading secret values, changing who has access — are refused by host policy for tokens by default, and are not offered as tools.

Flags

Global flags

pando migrate

Apply pending database migrations and exit

Global flags

pando plan

Show what a deploy would do, without doing it

Flags

Global flags

pando restart

Restart Pando, loading its adapters and configuration file again

Restart Pando. Requests in flight finish first, and apps behind Pando are unreachable for the seconds it takes. Adapters and the configuration file are read again; environment variables are not.

Flags

Global flags

pando rollback

Roll an app back to an earlier spec

Flags

Global flags

pando self-update

Replace this pando CLI with the latest release, after checking its signature

Downloads the release for this platform, checks the release's checksums.txt against its signature from Pando's release workflow and the archive against checksums.txt, and replaces this binary. A CLI installed with Homebrew or a Linux package is upgraded by that package manager instead, and this prints its command.

Flags

Global flags

pando serve

Run the Pando server

Global flags

pando updates

Show whether a newer Pando is released, what changed, and how to upgrade

Shows the version the server runs, the latest release on the update channel, and the changelog of every version in between, with security fixes and breaking changes marked. Then the command that upgrades the server. The check is host policy: disable_update_check turns it off and update_channel chooses stable or prerelease (pando policy set). Pando checks at startup and every six hours; --check asks GitHub now.

Flags

Global flags

pando version

Print the version

Global flags

pando adapter

See and configure this installation's adapters

Flags

Global flags

Commands

• pando adapter add
• pando adapter kinds
• pando adapter list

pando adapter add

Add an adapter, or change one, by kind

Adds an adapter of a kind from pando adapter kinds. Ordinary settings go in --set KEY=VALUE; a secret setting such as an API key is asked for without echoing it, so it never lands in your shell history (piped in when stdin is not a terminal). Adding with an existing --id changes that adapter. Pando loads adapters at startup: restart it afterwards, except after a source connection or an image registry, which are used from the moment they are saved.

With a kind named, --help lists its settings and their defaults, the advanced ones under their own heading. Advanced settings take --set like any other.

pando adapter add ai/anthropic --set model=claude-sonnet-5

Flags

Global flags

pando adapter kinds

Show the kinds of adapter this build can run, and their settings

Global flags

pando adapter list

Show the adapters configured here

Global flags

pando admin

Administer this installation from the host

Commands that work against the database directly, for when nobody can sign in.

Running these needs shell access on the host and the configuration that names the database. That is the whole of the authorization, and it is the same access that could change the row by hand.

Global flags

Commands

• pando admin enable-password-sign-in
• pando admin reset-password
• pando admin reset-two-factor
• pando admin setup-token

pando admin enable-password-sign-in

Turn password sign-in back on when no identity provider works

Clears disable_password_sign_in in host policy, so local accounts can sign in with a password again.

For when password sign-in is off and nobody can sign in through an identity provider. Follow it with pando admin reset-password if you also need a password for an account.

Global flags

pando admin reset-password

Set a local account's password when nobody can sign in

Sets a new password for a local account, ends every session it has, revokes its API tokens, and lifts any limit its wrong passwords put on signing in.

The account must change the password again at its next sign-in: this hands a way back in to somebody, which is not the same as choosing their credential.

Accounts that sign in through an external identity provider are changed where they live, not here.

Flags

Global flags

pando admin reset-two-factor

Remove a local account's two-factor authentication when nobody can sign in

Removes a local account's authenticator and recovery codes, ends every session it has, revokes its API tokens, and lifts any limit its wrong codes put on signing in. It then signs in with its password alone, and sets two-factor authentication up again there if host policy requires it.

Accounts that sign in through an external identity provider get their second factor from the provider, not here.

Global flags

pando admin setup-token

Make a new setup token for an installation that is not set up yet

Prints a new one-time setup token and retires the one Pando printed to its log at startup.

A new installation is set up in the console, and the setup form asks for this token, so that reaching the console first is not enough to become its administrator. Refused once the installation has an account.

Global flags

pando ai

Assign AI functions to adapters, and ask the AI functions

Each AI function is handled by at most one AI adapter, optionally on a model of its own. A function with no adapter is off. The draft commands propose and never apply: create what they draft with pando group and pando policy, or in the console.

Flags

Global flags

Commands

• pando ai ask
• pando ai assign
• pando ai audit
• pando ai draft-access
• pando ai draft-policy
• pando ai functions
• pando ai unassign

pando ai ask

Ask how to do something, answered from the API, CLI and MCP reference

Global flags

pando ai assign

Have an AI adapter handle a function, optionally on its own model

Refused while another adapter handles the function: unassign it there first. --model needs an adapter that can choose its model.

Flags

Global flags

pando ai audit

Search the audit log with a question, and summarize what matched

Prints the summary and the filters it used. Run pando audit with those filters to see the records.

Global flags

pando ai draft-access

Draft a custom role and a group from a description

Global flags

pando ai draft-policy

Propose host policy from a description

Prints the proposed document; save it with pando policy set.

Global flags

pando ai functions

List each AI function, the adapter that handles it, and on which model

Global flags

pando ai unassign

Turn an AI function off

Global flags

pando app

Work with apps

Flags

Global flags

Commands

• pando app add
• pando app address
• pando app auto-deploy
• pando app delete
• pando app detection
• pando app favorite
• pando app icon
• pando app idle
• pando app image-update
• pando app list
• pando app notices
• pando app registry-credential
• pando app rename
• pando app restart
• pando app show
• pando app spec
• pando app start
• pando app status
• pando app stop
• pando app unfavorite
• pando app usage
• pando app webhook-route

pando app add

Create an app from a repository, or from an image that is already built

Flags

Global flags

pando app address

Show or change where an app is reached

With no flags, shows the app's routing and address, where it moves at the next deploy if a change is saved, and the routing adapters it could use with the domains each serves.

With flags, changes it. A flag left out keeps what the app has, or takes the adapter's default when moving to another adapter. --domain puts the app in another of the adapter's domains, such as a second Cloudflare zone: alone it makes <app>.<domain>, and with --hostname docs it makes docs.<domain>.

A change is saved as a spec revision and takes effect at the next deploy, when the old address stops working. Without --confirm nothing is changed and Pando says what would move.

Examples

Flags

Global flags

pando app auto-deploy

Deploy an app automatically when its branch or releases change

Pando checks the app's repository every few minutes and deploys what it finds. Off by default. A change here is saved as a new configuration revision and takes effect at the app's next deploy.

Global flags

Commands

• pando app auto-deploy off
• pando app auto-deploy set
• pando app auto-deploy show
• pando app auto-deploy webhook-secret

pando app auto-deploy off

Turn automatic deploys off

Global flags

pando app auto-deploy set

Turn automatic deploys on, following a branch or new releases

With --trigger branch (the default), each new commit on the branch deploys. Without --branch, that is the branch the app was deployed from.

With --trigger release, each new release tag deploys. A release is a tag such as v1.2.3, or one matching --tag-pattern, a pattern such as release-* where * matches any characters.

Flags

Global flags

pando app auto-deploy show

Show the settings, the last check and the webhook

Global flags

pando app auto-deploy webhook-secret

Make the app a new webhook secret, and print it with the webhook URL

A webhook lets the git host tell Pando about a push or a release as it happens, instead of Pando finding out at its next check. It needs Pando to be reachable from the git host. Paste the URL and secret into the repository's webhook settings, with content type application/json. The secret is printed this once; making a new one replaces it.

Flags

Global flags

pando app delete

Delete an app, keeping a final backup of its data

Deletes an app. Its storage is backed up first and the backup is kept until you discard it — not aged out.

If the backup fails the app is not deleted, because a failed backup means the data is not safe. Pass --discard-data to delete without one.

Flags

Global flags

pando app detection

Show how far detection has got, and what to do next

Shows where an app's detection stands: running and at which stage, or how it finished — ready, waiting on answers, blocked or failed — and what to do next. Questions are printed exactly as Pando wrote them, to paste into whatever wrote the app.

With --wait, waits for detection to finish, printing each stage as it is reached. It then exits 0 when the app is ready to accept, 2 when there are questions to answer, and 1 when detection failed or was blocked.

Flags

Global flags

Commands

• pando app detection accept
• pando app detection answer
• pando app detection diff
• pando app detection rerun
• pando app detection revise

pando app detection accept

Accept detection's proposal as the app's configuration

Accepts what detection worked out and pins it as the app's configuration. This does not deploy: pando deploy <app> does that.

--env and --secret set variables in the same step; a secret is stored by the install's secrets adapter. --optional names a dependency the app runs without.

Accepting over an app that is already configured replaces how it is built and what it runs, and needs --confirm. Variables you set, how each dependency is filled, and storage you added are carried over. pando app detection diff <app> shows what would change.

Flags

Global flags

pando app detection answer

Answer one of detection's questions

Answers a question detection asked. The key is the one printed with the question by pando app detection <app>.

An answer that changes what is built, such as a build argument, has Pando build and scan the image again, so the plan shows the score of what will run. This waits for that, printing each stage, then exits as pando app detection --wait does: 0 when the app is ready to accept, 2 when there are questions left, and 1 when detection failed or was blocked.

Flags

Global flags

pando app detection diff

Show what accepting the proposal would change

Compares detection's proposal with the configuration the app is pinned to, and lists each change with what applying it takes: benign, restart, rebuild or destructive. A destructive change loses data, such as removing a volume.

Global flags

pando app detection rerun

Run detection again, against the source as it is now

Works out again how to run an app, from its source as it is now: after the repository changed, after uploading new files, or after fixing what blocked it. Nothing about the app changes until the new proposal is accepted.

With --wait, waits for it and exits as pando app detection --wait does.

Flags

Global flags

pando app detection revise

Tell the AI adapter what is wrong with the plan

Tells the install's AI adapter what is wrong with the plan, in your own words, for example "The app serves on port 8080." It checks the repository, changes what it can show, and replies. Prints the reply, what it changed and what Pando refused, then where detection stands. Needs an AI adapter.

Global flags

pando app favorite

Pin an app to the top of your launcher

Global flags

pando app icon

Set the image on an app's launcher tile

Global flags

Commands

• pando app icon clear
• pando app icon set

pando app icon clear

Remove an app's image, so its tile shows the map generated for it

Global flags

pando app icon set

Set an app's image from a PNG, JPEG, WebP or GIF file

Sets the image shown on the app's tile in everyone's launcher.

PNG, JPEG, WebP or GIF, at most 256 KB. SVG is not accepted. A square image a few hundred pixels across is plenty.

Global flags

pando app idle

Show or set when Pando stops or deletes an app nobody uses

With no flags, shows the app's idle settings: its own, the installation's, the ones in force, when it was last used, and when Pando would stop or delete it.

--stop-days and --delete-days take a number of days, never, or default for the installation's setting. A flag left out keeps what the app has. Both count from the app's last use, deploy or start, so deleting has to come later than stopping. These are app settings, not spec: nothing is deployed.

Flags

Global flags

pando app image-update

Check whether an image app's tag names a newer build, and upgrade to it

Asks the registry which build the app's image tag names now and compares it with the build the app runs. Nothing changes unless --upgrade is given, which writes a revision running that build and deploys it.

Flags

Global flags

pando app list

List the apps you can manage

Global flags

pando app notices

See what an app asks of you, and ignore a notice until it changes

Global flags

Commands

• pando app notices ignore
• pando app notices list
• pando app notices restore

pando app notices ignore

Ignore a notice until what it says changes

Hides a notice from you until what it says changes. Only you: everyone else still sees it. A deploy the notice warned about is still refused for the same reason.

Global flags

pando app notices list

List an app's notices

Lists what the app's Overview asks of somebody: a configuration not yet deployed, variables with no value, a backup that was not taken, a security score below this installation's minimum, the spec's warnings. Notices you have ignored are left out unless --all is given.

Flags

Global flags

pando app notices restore

Show a notice you ignored again

Global flags

pando app registry-credential

Manage the credential an app's private image is pulled with

Global flags

Commands

• pando app registry-credential remove
• pando app registry-credential set
• pando app registry-credential show

pando app registry-credential remove

Remove the credential, so the image is pulled anonymously

Global flags

pando app registry-credential set

Set the credential, replacing any the app had

Flags

Global flags

pando app registry-credential show

Say whether the app has a credential, and of which kind, without its secret

Global flags

pando app rename

Change an app's display name

Changes the name shown for the app in the console and on everyone's launcher.

The app's ID and address do not change.

Global flags

pando app restart

Restart an app's workloads, changing nothing

Restarts the workloads in place.

Nothing is rebuilt and nothing is re-read: this is the same version, started again. To ship a change, deploy.

Global flags

pando app show

Show an app

Global flags

pando app spec

Read and write an app's spec revisions

Global flags

Commands

• pando app spec create
• pando app spec diff
• pando app spec list
• pando app spec pin
• pando app spec show

pando app spec create

Write a new spec revision from a JSON file

Writes a whole spec, read as JSON from --file or stdin, as a new revision. pando export <app> prints the pinned spec to start from. This does not pin or deploy: pando app spec pin <app> <revision> and pando deploy <app> do. --dry-run checks the spec and writes nothing.

Flags

Global flags

pando app spec diff

Compare two spec revisions

Global flags

pando app spec list

List spec revisions, and which one is pinned

Global flags

pando app spec pin

Pin a spec revision as what the app runs

Pins a revision: what the app converges to, and what the next deploy ships. This does not deploy: pando deploy <app> does that.

On an app that has been deployed, pinning changes what it runs, so it needs app.deploy, and a revision whose deploy needs approval is refused: deploy it instead.

Global flags

pando app spec show

Print one spec revision

Global flags

pando app start

Start an app that was stopped

Global flags

pando app status

What each part of an app is doing right now

What each part of an app is doing right now.

An app can be made of several parts, and "degraded" is the app's answer for all of them together. This is the per-part answer: which are running, which are restarting and how many times, and which health check is failing. The names are also what pando logs --workload takes.

Global flags

pando app stop

Stop an app without deleting it

Stops an app.

Nothing is removed: its storage, its configuration and its address are kept, and pando app start brings back the version that was running. A stopped app stays stopped — it is the app's desired state, not a one-off act, so it survives Pando itself restarting.

Global flags

pando app unfavorite

Unpin an app from your launcher

Global flags

pando app usage

What each part of an app is using right now: CPU, memory and disk

What each part of an app is using right now, beside its limits.

CPU is in cores; a part with no limit may use what the host has. A reading, not a history.

Global flags

pando app webhook-route

Let verified webhook deliveries reach one path of an app

A route lets a delivery with no Pando credential through to one method and path, once it is verified. The rest of a private app stays private. A change is saved as a new configuration revision and takes effect at the app's next deploy.

Global flags

Commands

• pando app webhook-route add
• pando app webhook-route list
• pando app webhook-route remove
• pando app webhook-route secret

pando app webhook-route add

Add a route, and print its secret if Pando generated one

With --verify hmac_sha256 (the default), --header holds the hex HMAC-SHA256 of the body, after any --prefix. With --verify header, --header holds the secret itself.

Without --paste-secret, Pando generates one and prints it this once.

Flags

Global flags

pando app webhook-route list

List an app's webhook routes

Global flags

pando app webhook-route remove

Remove a route

The route's secret goes at once, so deliveries are refused from now on.

Global flags

pando app webhook-route secret

Replace a route's secret, and print it if Pando generated it

The old secret stops working at once.

Flags

Global flags

pando approvals

See and decide deploys waiting for approval

Flags

Global flags

Commands

• pando approvals approve
• pando approvals list
• pando approvals reject

pando approvals approve

Approve a deploy waiting for approval; the last approval it needs starts it

Flags

Global flags

pando approvals list

Deploys waiting for approval on the apps you can see

Flags

Global flags

pando approvals reject

Reject a deploy waiting for approval, which ends the request

Flags

Global flags

pando audit

Read the audit log

Lists what was done on this installation, newest first. The filters combine.

--since and --until take a time (2026-09-21T09:00:00Z) or a duration back from now (24h, 30m), so --since 24h is the last day.

Flags

Global flags

Commands

• pando audit archives
• pando audit export
• pando audit sinks
• pando audit tail

pando audit archives

List the months of the audit log archived past retention

Months older than host policy's audit_retention_months are archived, checked, and removed from the live log, so pando audit no longer finds them. This lists the archives; download one with pando audit archives download <id>.

Global flags

Commands

• pando audit archives download

pando audit archives download

Download one archived month, checking it against its digest

Saves the archive — gzipped JSON lines, one audit event per line — to --output, or to audit-<month>.jsonl.gz in the current directory. The SHA-256 is checked against the archive's manifest as it arrives, and a file that does not match is removed rather than kept.

Flags

Global flags

pando audit export

Export a range of the audit log as gzipped JSON lines

Writes the audit events between --since and --until, in commit order, as gzipped JSON lines: to --output, or to standard output when that is not a terminal. --since and --until take a time (2026-09-21T09:00:00Z) or a duration back from now (24h); left out, the range is open at that end.

The export covers the live log only. When the range reaches back before it, a note on standard error says where the live log starts; pando audit archives has the months before that.

Examples

Flags

Global flags

pando audit sinks

List where the audit log is sent, and how far each destination has got

An audit sink is a destination, such as a SIEM's syslog or HTTPS collector, that Pando pushes the audit log to as it is written. This lists each one with what it sends where, the events waiting to go (BACKLOG), when it last delivered, and its last error. Below the table, each sink's line says exactly what leaves the installation, and any range of events it missed.

Audit sinks are adapters: add one with pando adapter add audit_sink/<kind>.

Examples

Global flags

pando audit tail

Print the audit log in commit order, one JSON event per line

Prints audit events oldest first, one JSON object per line, from --after: a cursor a previous run printed, or now for only what happens from here on. Without --after it starts at the oldest event in the live log. Without --follow it stops once it has caught up; with --follow it keeps waiting for new events until interrupted.

When it stops, for any reason, it prints the last cursor to standard error as cursor: c1.…. Pass that back as --after to carry on where it left off. Delivery is at least once: an event can be printed again after a resume, and its id is the key to drop it by.

Examples

Flags

Global flags

pando backup

Back up and restore this installation

Flags

Global flags

Commands

• pando backup create
• pando backup list
• pando backup restore
• pando backup verify

pando backup create

Take a backup of the whole installation

Global flags

pando backup list

List backups

Global flags

pando backup restore

Replace this installation from a backup

Flags

Global flags

pando backup verify

Check a backup is complete, without restoring it

Global flags

pando cluster

The hosts this installation runs on, and joining new ones

Flags

Global flags

Commands

• pando cluster hosts
• pando cluster tokens

pando cluster hosts

The cluster's hosts

Global flags

Commands

• pando cluster hosts list
• pando cluster hosts lost
• pando cluster hosts remove

pando cluster hosts list

List the cluster's hosts

Global flags

pando cluster hosts lost

Say a host is gone, and start its apps' standbys

Marks the host lost and starts the standby of each app homed on it. With three or more hosts Pando does this itself when most of them cannot reach the host; with fewer it never does. Refused while the host answers. A failed app is not failed over.

Global flags

pando cluster hosts remove

Remove a host from the cluster

Global flags

pando cluster tokens

Tokens new hosts join with

Global flags

Commands

• pando cluster tokens create
• pando cluster tokens list
• pando cluster tokens revoke

pando cluster tokens create

Create a join token. It is shown once

Flags

Global flags

pando cluster tokens list

List join tokens

Global flags

pando cluster tokens revoke

Revoke a join token

Global flags

pando grant

Share an app, or stop sharing it

Flags

Global flags

Commands

• pando grant add
• pando grant list
• pando grant passcode
• pando grant remove
• pando grant role

pando grant add

Give someone access to an app

Flags

Global flags

pando grant list

Show who an app is shared with

Global flags

pando grant passcode

Change the passcode on an app shared with everyone, or remove it

Sets a new passcode on the app's grant to everyone; everyone let in by the old one is asked again. With no passcode, removes it: the app is then open to anyone.

Global flags

pando grant remove

Take a grant away

Global flags

pando grant role

Change the role a grant for managing an app carries

Global flags

pando group

Work with groups and what they hold

Flags

Global flags

Commands

• pando group add-member
• pando group app-limit
• pando group apps
• pando group list
• pando group remove-member
• pando group rename
• pando group role

pando group add-member

Add an account to a group; it then holds what the group holds

Global flags

pando group app-limit

Show or set how many apps each person in a group may own

With only the group, shows its limit. With a number, sets it; 0 is unlimited. --clear removes it. Somebody in several groups gets the most generous, and a limit on their own account replaces every group's.

Flags

Global flags

pando group apps

Show the apps a group has access to, and its role on each

Global flags

pando group list

Show every group, how many people are in it, and its installation role

Global flags

pando group remove-member

Remove an account from a group

Global flags

pando group rename

Rename a group made in Pando

Global flags

pando group role

Give a group an installation role, or take it away with --clear

Flags

Global flags

pando host-agent

The forwarding agent on each host of a multi-host Docker install

Each app host of a multi-host Docker install runs a forwarding agent, which carries connections from Pando's proxy, and only from it, to app containers on that host. The Docker hosts runtime starts and replaces the agents itself; the one command here an operator runs is new-authority.

Global flags

Commands

• pando host-agent new-authority

pando host-agent new-authority

Print a new certificate authority for the host agents

Prints a certificate authority, certificate and private key, as PEM. Paste it into the Docker hosts runtime's agent_authority credential, which Pando stores encrypted. Pando issues its own client certificate and each agent's certificate from it. To replace it, put a new one before the old one in the credential, wait for the agents to be replaced, then remove the old one.

Global flags

pando identity-provider

Connect identity providers: OpenID Connect, SAML and SCIM

Also: idp

Flags

Global flags

Commands

• pando identity-provider add
• pando identity-provider check
• pando identity-provider link
• pando identity-provider link-group
• pando identity-provider list
• pando identity-provider remove
• pando identity-provider scim-token
• pando identity-provider set
• pando identity-provider test
• pando identity-provider unlink

pando identity-provider add

Add an identity provider

Adds an identity provider, turned off until you test it and turn it on. --preset fills in what a known provider needs (okta, entra, google, keycloak, authentik); --set KEY=VALUE sets the rest. A client secret is asked for without echoing it.

pando idp add oidc --preset okta --name Okta --set issuer=https://example.okta.com --set client_id=0oa… pando idp add saml --preset entra --name Entra --set idp_metadata_url=https://login.microsoftonline.com/…

Flags

Global flags

pando identity-provider check

Check that Pando can reach the provider

Global flags

pando identity-provider link

Link a provider's identity to an account

Whoever signs in with that identity signs in to that account. Nothing is merged: with --replace, an account the identity already reaches is kept, suspended, as an alias. When that account is the last active owner of an app, --confirm is needed too.

Flags

Global flags

pando identity-provider link-group

Make a provider's group count as members of a Pando group

Flags

Global flags

pando identity-provider list

Show the identity providers, what to register with each, and how soon each can revoke

Global flags

pando identity-provider remove

Remove an identity provider nobody has signed in through

Global flags

pando identity-provider scim-token

Turn SCIM on for a provider and print its token, or replace it

Prints the SCIM base URL and a new token. The token is shown once; running this again replaces it.

Flags

Global flags

pando identity-provider set

Change an identity provider

Changes a provider. --set KEY=VALUE changes one setting and keeps the rest; --secret asks for a new client secret; --enable and --disable turn it on and off.

Flags

Global flags

pando identity-provider test

Print the address that starts a test sign-in in your browser

Global flags

pando identity-provider unlink

Unlink a provider's identity from an account

Global flags

pando instructions

Read and set the instructions every agent is given

Agents connecting over MCP are given Pando's guidance for building apps here, then the company's own instructions, which win where the two differ.

Flags

Global flags

Commands

• pando instructions set
• pando instructions show

pando instructions set

Replace the company's instructions with text read from stdin

Reads the company's instructions as text on stdin, at most 32 KB, and replaces the current ones. Empty input clears them. Needs install.policy.manage.

pando instructions set < instructions.md

Global flags

pando instructions show

Print the instructions agents are given

Flags

Global flags

pando notifications

Choose which of Pando's notifications reach you, and where

Flags

Global flags

Commands

• pando notifications list
• pando notifications preferences
• pando notifications read
• pando notifications unread

pando notifications list

Your notifications, newest first

Flags

Global flags

pando notifications preferences

Show your notification preferences, or change them with --set

Show which of Pando's own notifications reach you on each channel.

--set kind:channel=on|off changes one, and may be repeated, for example:

pando notifications preferences --set app_shared:ntf_smtp=on --set deploy_approval:ntf_console=off

Flags

Global flags

pando notifications read

Mark a notification read, or every one with --all

Flags

Global flags

pando notifications unread

How many of your notifications are unread

Global flags

pando notify

Connect notification adapters such as Slack, and list their channels

A Slack adapter posts as Pando's own Slack app, which connecting creates. Add the adapter with pando adapter add notify/slack, connect it with pando notify connect, then subscribe with pando subscriptions create --adapter <id> --channel <channel>.

Flags

Global flags

Commands

• pando notify channels
• pando notify connect
• pando notify list

pando notify channels

List the channels a subscription to the adapter can post to

Flags

Global flags

pando notify connect

Connect a notification adapter, such as Slack, to its provider

Asks for a Slack configuration token: in Slack's app settings, under Your App Configuration Tokens, choose Generate Token. Pando uses it once to create its app, and prints Slack's approval page to open in a browser signed in to Pando. Slack returns only to an https address; without one, --manual prints a link that creates the app in Slack, and --bot-token asks for the bot token it shows once installed. A token is read from the terminal, never from the command line.

Flags

Global flags

pando notify list

Show the notification adapters and whether each can send

Global flags

pando policy

Read and set host policy

Flags

Global flags

Commands

• pando policy set
• pando policy show

pando policy set

Replace the policy with a document read from stdin

Reads a whole policy document as JSON on stdin and replaces the current one. Replaces rather than merges: a merge would make it impossible to remove a rule.

Global flags

pando policy show

Print the installation's policy

Global flags

pando role

Work with roles and who holds them

Flags

Global flags

Commands

• pando role edit
• pando role holders

pando role edit

Rename a custom role, or replace its permissions

Flags

Global flags

pando role holders

Show the groups and accounts holding a role, directly or through a group

Global flags

pando secret

Manage an app's secrets

Flags

Global flags

Commands

• pando secret delete
• pando secret list
• pando secret set

pando secret delete

Remove a secret

Global flags

pando secret list

List which secrets are set, without their values

Global flags

pando secret set

Set a secret value, read from the terminal

Global flags

pando section

Group the apps in your launcher into sections

Flags

Global flags

Commands

• pando section add
• pando section create
• pando section delete
• pando section list
• pando section remove
• pando section rename

pando section add

Move an app into a section

Global flags

pando section create

Make a section

Global flags

pando section delete

Delete a section. Its apps go back to Your apps

Global flags

pando section list

The apps you can open, by section

Global flags

pando section remove

Move an app out of a section, back to Your apps

Global flags

pando section rename

Rename a section

Global flags

pando slot

Fill an app's service slots

Flags

Global flags

Commands

• pando slot set

pando slot set

Say how a slot is filled

Flags

Global flags

pando source

See and authorize the connections private repositories are read with

A source connection is how Pando reads private repositories on GitHub, GitLab, Azure DevOps, Bitbucket, Gitea or any git host. Add one with pando adapter add source/<kind> — pando adapter kinds lists the kinds — and every app whose repository it covers is read with it.

Flags

Global flags

Commands

• pando source authorize
• pando source branches
• pando source list
• pando source remove
• pando source repos

pando source authorize

Sign a connection in with OAuth

Shows a code to enter on the provider's site, then waits until you have. Nothing needs to be able to reach this Pando, so it works on a laptop. --web prints an address to open in a browser instead, which returns to Pando's own address. A GitHub App connection is always authorized in a browser: the address creates the App on GitHub, then installs it.

Flags

Global flags

pando source branches

List a repository's branches through a connection

Global flags

pando source list

Show the source connections and whether each is ready

Global flags

pando source remove

Disconnect a source connection and delete its stored credential

Apps read with the connection keep running. Their next deploy fails, saying the connection is gone, until another connection covers their repository.

Global flags

pando source repos

List the repositories a connection can read

Flags