Command reference

{/_ GENERATED by tools/help/generate-cli-reference.mjs — do not edit by hand. _/}

This page is generated from the command line parser itself, so it cannot disagree with the program. tcc <command> --help prints the same information at the terminal.

180 commands, 89 flags. Angle brackets are required, square brackets optional.

Flags that work everywhere

These may be given on any command.

--account — Act as another account on this desktop, for this command only
--dry-run — Preview without making changes (mutating commands only)
--db, -e, --env — Which backend to talk to (local/dev/prod)
--json, -j — Output as JSON (machine-readable)
--quiet, -q — Suppress non-essential output
--server — Override remote tcc daemon URL for this invocation. Mirrors the TCC_REMOTE_URL env var. Useful in shell pipelines / CI where exporting env vars is awkward. Pair with --token
--token — API token (tc_live_* / tc_test_*) for the remote daemon. Mirrors the TCC_API_TOKEN env var. Required whenever --server is set (or the env equivalent)
--verbose, -v — Include full API response in output

Commands

`tcc account`

Accounts on this desktop, and this account’s lifecycle

`tcc account delete`

Delete this account and everything in it. IRREVERSIBLE

`tcc account forget`

Remove an account from this desktop

Arguments

<id_or_email> — Account id, or the address it signs in with

`tcc account list`

List the accounts signed in on this desktop (default)

`tcc account manage`

Open a page of the account portal, signed in (prints a one-time link)

Arguments

[target] — The portal page, e.g. account or emails — Default account

`tcc account switch`

Switch which account this desktop acts as

Arguments

<id_or_email> — Account id, or the address it signs in with

`tcc api-token`

Manage server-side API tokens (for programmatic platform access)

`tcc api-token generate`

Generate a new server-side API token

Arguments

<name> — Descriptive name (e.g. ‘CI pipeline’)

Flags

--scopes — Comma-separated scopes (optional)

`tcc api-token list`

List all server-side API tokens

`tcc api-token revoke`

Revoke a server-side API token by ID

Arguments

<id> — Token ID (from list output)

`tcc ask`

Ask the assistant one question

Arguments

[message] — What to ask, e.g. “what is Mark’s code”

Flags

--answer — Answer a question from a previous —json run with this value (a choice’s value, or free text); needs —envelope
--envelope — The data.ask JSON the previous run printed — a file, or - for stdin

`tcc ask-rate`

Rate an answer the assistant gave

Arguments

<chat_log_id> — The id the answer carried in data.chatLogId
<rating> — helpful | not_helpful

`tcc auth`

Authentication (login, logout, status)

`tcc auth adopt`

Adopt a session from stdin, without a browser

`tcc auth login`

Flags

--code — Sign in with the code from the sign-in mail instead of the browser
--email — The address to send the code to (asked for when absent)

`tcc auth logout`

Clear keychain tokens

`tcc auth status`

Show auth state

`tcc auth token`

Print access token (pipe-friendly)

`tcc code`

TOTP code operations

`tcc code list`

List all connections’ codes

`tcc code next`

Show rotation timing

`tcc code show`

Show the current 3-word code for a name — a connection or a guest code

Arguments

<name> — Connection name or guest-code label (partial match works)

Flags

--kind — Only one kind: connection or guest
--lang — Language override

`tcc config`

Configuration

`tcc config clear-remote`

Remove the persisted remote daemon — subsequent CLI calls run against the local daemon (if up) or in standalone mode

`tcc config create-api-token`

Create an API token for HTTP server access

Flags

--label — Label for the token (e.g., “claude-ai”, “chatgpt”)
--scope — Token scope: read, write, or full
--ttl-hours — TTL in hours (omit for no expiry — localhost only)

`tcc config list-api-tokens`

List all API tokens (masked)

`tcc config reset-device`

Reset device — clear all user data and re-register on next use

`tcc config revoke-api-token`

Revoke an API token by label

Arguments

<label> — Token label

`tcc config set-remote`

Persist a remote tcc daemon as the default routing target. Writes to ~/.config/tcc/config.toml; reads on every CLI invocation unless overridden by --server flag or TCC_REMOTE_URL env var. Symmetric with git config / kubectl config use-context

Arguments

<url> — Remote daemon URL (e.g. https://tcc-prod.example.com)

Flags

--token — API token (tc_live_* / tc_test_*) to pair with this URL — required

`tcc config shortcut`

Get or set the global keyboard shortcut for signing Examples: tcc config shortcut “CmdOrCtrl+Shift+S”

Arguments

[value] — New shortcut (e.g. “CmdOrCtrl+Shift+S”). Omit to show current

`tcc config show`

Show current configuration

`tcc config show-api-token`

Show a specific API token by label (full value)

Arguments

<label> — Token label

`tcc config show-remote`

Print the currently persisted remote daemon URL (token masked)

`tcc connect`

Connect via open link

Arguments

<slug> — Open link slug (e.g., “stefan/my-link”)

`tcc connection`

Manage existing connections

`tcc connection add-member`

Add a member

Arguments

<email> — Email of person to add
<id> — Connection ID

`tcc connection avatar`

Set connection avatar from a local image file

Arguments

<id> — Connection ID
<path> — Path to a JPEG, PNG, WEBP or GIF file

`tcc connection code-mode`

Change how identity codes work for this connection

Arguments

<id> — Connection ID
<mode> — Mode: dedicated (words that belong to this connection only) or shared (everyone in it says the same words)

`tcc connection delete`

Delete a connection

Arguments

<id> — Connection ID

`tcc connection favorite`

Toggle favorite

Arguments

<id> — Connection ID

`tcc connection list`

List connections with tags

`tcc connection members`

Show members

Arguments

<id> — Connection ID

`tcc connection remove-avatar`

Remove connection avatar

Arguments

<id> — Connection ID

`tcc connection remove-member`

Remove a member

Arguments

<id> — Connection ID
<member_id> — Member ID (from members)

`tcc connection transfer`

Transfer ownership to another member

Arguments

<id> — Connection ID
<new_owner_id> — New owner’s member ID (from members)

`tcc connection update`

Update connection settings (name, language, rotation, description)

Arguments

<id> — Connection ID

Flags

--description — Description
--lang — New language
--name — New name
--rotation-hours — Rotation period in hours (e.g. 1, 6, 24, 168 for weekly)

`tcc daemon`

Headless background daemon (Linux servers / CI)

`tcc daemon install-service`

Install and enable as a systemd user service (Linux only)

`tcc daemon start`

Start the headless daemon (HTTP + MCP server + background sync)

`tcc daemon status`

Show daemon status

`tcc daemon stop`

Stop the running daemon

`tcc device`

Device management (register, recover, status)

`tcc device list`

Every device signed in to this ACCOUNT — not just this one

`tcc device recover`

Enter recovery code to bootstrap E2EE

`tcc device regenerate-recovery`

Regenerate recovery words (new words, same key)

Flags

--lang — Language for recovery words (en, de, es, fr, it, nl)

`tcc device register`

Generate keypair and register with server

`tcc device remove`

Sign a device out of this account

Arguments

<device_id> — Device ID (from tcc device list)

Flags

--confirm-last-key-holder — Remove it even when it is the last device that holds the account key

`tcc device setup-recovery`

Create recovery words (first/only device)

Flags

--lang — Language for recovery words (en, de, es, fr, it, nl)

`tcc device status`

Show device registration state

`tcc email`

Email addresses on this account

`tcc email delete`

Remove an address

Arguments

<id> — Email ID (from tcc email list)

`tcc email list`

List every address on this account

`tcc email send`

Send a verification code to an address

Arguments

<address> — The address to verify

`tcc email set-display`

Make an address the one shown to connections

Arguments

<id> — Email ID (from tcc email list)

`tcc email set-primary`

Make an address the primary one

Arguments

<id> — Email ID (from tcc email list)

`tcc email verify`

Enter the code that was emailed to an address

Arguments

<address> — The address
<code> — The code from the email

`tcc export`

Data export — ask for a copy of everything this account holds

`tcc export delete-all`

Remove every export this account has asked for

`tcc export download`

Get a signed, expiring link to one finished export

Arguments

<export_id> — Export ID (from tcc export list)

`tcc export list`

The exports this account has asked for, ready or not

`tcc export request`

Ask the server to build an export

`tcc external`

External members (PWA for non-app users)

`tcc external add`

Add an external member (non-app user)

Arguments

<email> — Email address
<name> — Person’s name

Flags

--lang — Code language
--tag — Custom connection name

`tcc external list`

List all external members

`tcc external revoke`

Revoke an external member’s access

Arguments

<member_id> — Member ID

`tcc feedback`

Send feedback to the team. Emails them, so it is CLI-only

Arguments

<category> — bug | feature | general
<message> — What you want to say (10-2000 characters)

Flags

--rating — Optional satisfaction score, 1-5

`tcc guest`

Guest codes (for non-app users)

`tcc guest create`

Create a guest code

Arguments

<name> — Person’s name

Flags

--expires — Hours until expiry
--lang — Code language

`tcc guest list`

List all guest codes

`tcc guest qr`

Generate a QR code for a guest code

Arguments

<id> — Guest code ID (from list/create)

`tcc guest revoke`

Revoke a guest code

Arguments

<id> — Guest code ID (from list)

`tcc guest search`

Search guest codes by name

Arguments

<query> — Search query

`tcc guest send`

Send a guest code by email

Arguments

<id> — Guest code ID (from list/create)

Flags

--to — Recipient email — required

`tcc install-cli`

Put tcc on your PATH so the application and the command line are one program

Flags

--force — Replace an existing tcc that points somewhere else

`tcc invite`

Create connections and manage invitations

`tcc invite accept`

Accept an invitation addressed to you

Arguments

<id> — Invitation ID

Flags

--force — Accept although the invitation names a different address

`tcc invite accept-federated`

Accept a federated invitation (a row pushed here by another node)

Arguments

<id> — Pending invitation ID

`tcc invite approve`

Approve someone else’s request to join a connection you own

Arguments

<id> — Invitation ID

`tcc invite decline`

Decline an invitation

Arguments

<id> — Invitation ID

`tcc invite decline-federated`

Decline a federated invitation

Arguments

<id> — Pending invitation ID

`tcc invite federated-pending`

List federated invitations waiting for this account

`tcc invite list`

List all invitations

`tcc invite pending`

List pending approval requests

`tcc invite renew`

Extend a pending invitation’s expiry

Arguments

<id> — Invitation ID

`tcc invite send`

Create a connection and send invitations

Arguments

<name> — Connection name

Flags

--duration — Auto-delete after hours (-1 = never)
--lang — Code language
--message — Personal message in invitation email
--tags — Tags (comma-separated)
--to — Email address(es) — comma-separated for multiple

`tcc invite withdraw`

Withdraw a sent invitation

Arguments

<id> — Invitation ID

`tcc link`

Manage shareable open links

`tcc link approve`

Approve a request

Arguments

<id> — Request ID

`tcc link change-slug`

Change link address

Arguments

<id> — Link ID
<slug> — New slug

`tcc link create`

Create an open link

Flags

--approval — Approval mode: auto or manual
--slug — Custom slug

`tcc link decline`

Decline a request

Arguments

<id> — Request ID

`tcc link delete`

Delete a link

Arguments

<id> — Link ID

`tcc link list`

List all open links

`tcc link pause`

Pause a link

Arguments

<id> — Link ID

`tcc link requests`

List pending connection requests

`tcc link resume`

Resume a link

Arguments

<id> — Link ID

`tcc link suggest-slugs`

Suggest available link names

`tcc lookup`

Check if an email is on Trusted Codes

Arguments

<email> — Email address to check

`tcc mcp`

MCP integration with AI apps

`tcc mcp configure`

Add Trusted Codes to an AI app

Arguments

[app] — AI app to configure (claude-desktop, claude-code, cursor)

`tcc mcp remove`

Remove Trusted Codes from an AI app

Arguments

<app> — AI app to remove from (claude-desktop, claude-code, cursor)

`tcc mcp status`

Show which AI apps have Trusted Codes configured

`tcc notify`

View and manage notifications

`tcc notify delete`

Delete notifications

Arguments

[ids] — Notification IDs

`tcc notify list`

List recent notifications

Flags

--limit — Max number to show
--unread — Only show unread

`tcc notify read`

Mark notifications as read

Arguments

[ids] — Notification IDs

`tcc org`

Which organisation you act in, and switching between them

`tcc org current`

Which organisation is active for this session, and what it allows

`tcc org use`

Act in an organisation, or return to personal context

Arguments

[organization_id] — Organisation id. Omit with —personal to clear the choice

Flags

--personal — Act as yourself rather than in any organisation

`tcc otp`

One-time codes: three words, valid for one hour, one use

Flags

--lang — Code language: en | de | es | fr | it | nl
--wait <value> — A new computer is trusted by the server after about 3 minutes: keep trying for up to this many seconds (bare --wait = 240)

`tcc otp allow`

Allow the page that claimed your generator words

Arguments

<id> — The pairing id (from tcc otp devices)

`tcc otp deny`

Deny the page that claimed your generator words

Arguments

<id> — The pairing id (from tcc otp devices)

`tcc otp devices`

List the devices that make your codes, and a page waiting for your decision

`tcc otp generator`

Make the words for a code generator page

Flags

--lang — Language of the three words

`tcc otp list`

List your codes

`tcc otp new`

Make a one-time code (the default): prints the three words and the link

Flags

--lang — Code language: en | de | es | fr | it | nl
--wait <value> — Keep trying for up to this many seconds while the server starts to trust this computer (bare --wait = 240)

`tcc otp remove-device`

Remove a device (its open codes stop working)

Arguments

<id> — The device’s install id (from tcc otp devices)

`tcc otp withdraw`

Withdraw a code that is not used yet

Arguments

<id> — The code’s id (from tcc otp list --json)

`tcc plan`

What this account’s plan allows — features, limits and choices

Flags

--refresh — Ask the server rather than answering from the local database

`tcc prefs`

View/change notification preferences

`tcc prefs reset`

Reset to defaults

`tcc prefs set`

Toggle a notification channel

Arguments

<channel> — Channel: email, push, or in_app
<topic> — Topic (e.g., invitation_received, security_alert)

Flags

--enabled — On or off

`tcc prefs show`

Show notification preferences

`tcc preset`

Manage connection presets (templates)

`tcc preset create`

Create a preset

Arguments

<name> — Preset name

Flags

--duration — Auto-delete hours
--lang — Default language

`tcc preset delete`

Delete a preset

Arguments

<id> — Preset ID

`tcc preset list`

List presets

`tcc preset set-default`

Set default preset (omit ID to clear)

Arguments

[id] — Preset ID (omit to clear default)

`tcc preset update`

Change a preset

Arguments

<id> — Preset ID

Flags

--duration — New auto-delete hours
--lang — New default language
--name — New name

`tcc profile`

View or update user profile

`tcc profile get`

Show profile (default when no subcommand given)

`tcc profile set-language`

Update preferred language

Arguments

<language> — Language code (en, de, es, fr, it, nl)

`tcc profile set-name`

Update display name

Arguments

<name> — New display name

`tcc provider`

Provider stamp codes — mint one-time provenance codes from this device

`tcc provider history`

List the codes you’ve created from this account

`tcc provider mint`

Mint a one-time code: prints the three words and copies them to the clipboard

Flags

--lang — Code language: en | de | es | fr | it | nl. Defaults to en

`tcc provider provision`

Set up THIS device to mint stamps (sign in with tcc auth login first). On the first device use the invite token from your invitation link

Flags

--invite — Invite token from your provider invitation link (first device only)
--lang — Code language: en | de | es | fr | it | nl. Defaults to en

`tcc repl`

Interactive REPL — a persistent session where commands are typed without the tcc prefix

`tcc seal`

Seal content (prove it’s from you)

`tcc seal clipboard`

Seal the clipboard contents

Flags

--description — Owner-only description (1–120 characters), shown in your own seal list. Encrypted to your account key; nobody else sees it
--max-checks — End the seal after about this many checks by others (1–1000; 0 = no limit). Omitted: the suggestion of your plan
--require-approval — Require phone approval before signing (Pro plan)
--show-my-name — Ignored: every seal shows your name and email address. Accepted for one release so existing scripts keep working
--valid-days — End the seal after this many days (1–3650; 0 = no limit). Omitted: the suggestion of your plan

`tcc seal export`

Export a portable proof document for a seal

Arguments

<id> — Seal ID (from list output)

`tcc seal list`

List what this account has sealed

`tcc seal revoke`

Revoke a seal

Arguments

<id> — Content ID (from list)

`tcc seal text`

Seal text given on the command line

Arguments

<content> — The text to seal

Flags

--description — Owner-only description (1–120 characters), shown in your own seal list. Encrypted to your account key; nobody else sees it
--file — Path to file to include (hashed locally, never uploaded). Its name is encrypted with the text
--label — Title of the seal. Encrypted with the text (never sent in clear), and shown on the phone approval screen
--language — Language for code words (en, de, fr, es, it, nl)
--max-checks — End the seal after about this many checks by others (1–1000; 0 = no limit). Omitted: the suggestion of your plan
--ref, -r — Reference slug (repeatable)
--require-approval — Require phone approval before signing (Pro plan)
--show-my-name — Ignored: every seal shows your name and email address. Accepted for one release so existing scripts keep working
--valid-days — End the seal after this many days (1–3650; 0 = no limit). Omitted: the suggestion of your plan

`tcc session`

Active sessions — what else is signed in as you

`tcc session list`

Every session signed in as you

`tcc session revoke`

End one session

Arguments

<session_id> — Session ID (from tcc session list)

`tcc setup`

Set up or switch account (login, register device, sync — all in one)

`tcc switch`

Switch to a different account (logout, login as new user, re-setup)

`tcc sync`

Sync vault secrets to local cache

`tcc sync clear`

Clear cached secrets

`tcc sync status`

Show sync state

`tcc tag`

Organize connections with tags

`tcc tag assign`

Assign a tag to a connection

Arguments

<connection_id> — Connection ID
<tag_id> — Tag ID

`tcc tag create`

Create a tag

Arguments

<name> — Tag name

`tcc tag delete`

Delete a tag

Arguments

<id> — Tag ID

`tcc tag list`

List all tags

`tcc tag rename`

Rename a tag

Arguments

<id> — Tag ID
<name> — New name

`tcc tag unassign`

Remove a tag from a connection

Arguments

<connection_id> — Connection ID
<tag_id> — Tag ID

`tcc trust`

Trust — the people you follow, your own score, and the verification log

`tcc trust cards`

The people you follow

`tcc trust follow`

Follow someone

Arguments

<ticket> — The subscribeTicket printed by tcc verify --public

Flags

--description — Your own note
--label — Your own name for this person
--source — Where the follow came from

`tcc trust history`

The verification history of someone you follow

Arguments

<watched_user_id> — The id of the person you follow (from tcc trust cards)

`tcc trust log`

The verification log

Flags

--direction — Filter by direction
--limit — How many entries to return
--offset — Skip this many entries

`tcc trust rename`

Change your name or note for someone you follow

Arguments

<watched_user_id> — The id of the person you follow (from tcc trust cards)

Flags

--description — New note
--label — New label

`tcc trust score`

Your own trust score and the numbers behind it

`tcc trust unfollow`

Stop following someone

Arguments

<watched_user_id> — The id of the person you follow (from tcc trust cards)

`tcc uninstall`

Remove Trusted Codes from this computer completely

Flags

--confirm-last-key-holder — Remove this computer’s device even when it is the last device that holds the account key. Without it a terminal asks; with no terminal the run stops before anything on this computer is deleted
--delete-env-file — Also delete the operator’s env file (tcc.env) without asking
--keep-device-on-server — Leave this computer’s device active on the server
--server-step — One account’s server step (internal: one child per account)
--yes — Do not ask; needed when there is no terminal. Keeps the env file

`tcc uninstall-cli`

Remove the tcc entry point created by install-cli

`tcc verify`

Verify 3 words against cached connections

Arguments

<word1> — First word
<word2> — Second word
<word3> — Third word

Flags

--country — Country hint for the public lookup (ISO 3166-1 alpha-2)
--public — Also ask the SERVER (public lookup). The two answers are printed separately and never merged: the local check knows only the vault secrets this device holds, and saying “no match” when the honest answer is “I cannot tell” is the fault conclusive exists to stop