CLI reference

The CLI is SSH. Run a command with ssh turm.dev <command>, or run ssh turm.dev for an interactive prompt and type commands there. help prints the full list.

Tip

Add --json to any command for machine-readable output. The same commands work over HTTPS and MCP.

VMs

new

Create and boot a VM.

Flag	Meaning
--name=<name>	VM name. Picked for you if left out.
--image=<image>	Image to boot. Default agentuntu.
--pool=<pool>	Pool to run in.
--setup-script=<script>	Script to run once on first boot. Use /dev/stdin to pipe a file. See Setup scripts.
--no-setup-script	Don’t run your default setup script on this VM.
--env KEY=VALUE	Variable for the setup script. Repeat for more.
--with=<add-ons>	Comma-separated add-ons to install on first boot. Names include chrome, codex, claude-code, opencode, pi, desktop, dev, gemini, and aider. browser is chrome. claude is claude-code.
--browser	Headless Chromium. Same as --with=chrome.
--desktop	XFCE at the VM’s HTTPS URL. Basic. Not a 60 fps desktop.
--example=<name>	Named first-boot example. web serves a page at the VM's HTTPS URL. agent installs pi, which uses the LLM gateway. examples lists them.

ssh turm.dev new --name=demo
ssh turm.dev new --name=agent --with=codex,chrome
cat setup.sh | ssh turm.dev new --name=api --setup-script /dev/stdin --env PORT=8080

ls

List your VMs with their state and, if they had a setup script, its result (setup: pending, ok or failed).

ssh turm.dev ls
ssh turm.dev ls --json

stop, start, restart

ssh turm.dev stop demo
ssh turm.dev start demo
ssh turm.dev restart demo

rm

Delete a VM and its disk. This cannot be undone.

ssh turm.dev rm demo

cp

Copy a VM, disk included, to a new name.

ssh turm.dev cp demo demo-copy

resize

Change a VM’s CPU count, memory, or disk size. --disk is a whole number of GiB. It only grows the disk, and only up to the plan’s disk allowance. A running VM grows immediately, including its root filesystem. If this host cannot grow a running disk, stop the VM, run the command, start the VM, and run it again.

ssh turm.dev resize demo --cpu=2 --memory=4096
ssh turm.dev resize demo --disk=20

Add-ons

See Optional add-ons.

Command	Effect
addons list	The catalog: name, pinned version, how it reaches the LLM gateway.
addons ls <vm>	A VM’s add-ons: desired, state, installed version.
addons add <vm> <name>[,<name>...]	Install on a running VM. Applied within a minute. If the VM’s agentcloud-addon heartbeat is older than the add-on needs, the command is refused and names that version. Nothing is changed. Create a new VM with new --with, or replace /usr/local/bin/agentcloud-addon on that VM. The next sync reports the new version within a minute, and then the same command works.
addons rm <vm> <name>[,<name>...]	Remove.

ssh turm.dev addons add demo opencode,chrome
ssh turm.dev addons ls demo

Provider keys and agent mode

Keys are per account, one per provider, and shared by every VM. The key stays on the server. A subscription login stays inside the VM. See the FAQ.

Command	Effect
llm keys add <provider> -	Store a key. - and --key=- read stdin, so the secret is not in shell history. --key=VALUE passes it as one argument. Providers: openai, anthropic, groq, xai, openrouter, mistral, deepseek.
llm keys ls	List providers and the last 4 characters.
llm keys rm <provider>	Remove that key.
llm keys default <provider>|none	Which key apikey mode uses when you have more than one.
llm keys test <provider> [--vm=name]	Ask that provider’s models list with the stored key.
llm source set <provider> gateway|apikey|disabled [--vm=name]	Account default, or one VM. gateway is the included route. There are no VM tags.
llm source ls [--vm=name]	Show the saved sources.
llm custom add <id> --url=https://... --model=<id> --bearer|--header=Name --key=- [--vm=name]	An OpenAI-compatible HTTPS endpoint. The VM still calls the gateway.
llm custom rm <id> [--vm=name]	Remove that endpoint.
auth <vm> <agent> gateway|apikey|subscription|both	Set the mode. Agents: claude-code, codex, opencode, pi. both is only for pi and OpenCode.
auth ls <vm>	Show each agent’s mode. A missing row is gateway.

ssh turm.dev llm keys add openai -
ssh turm.dev auth demo claude-code gateway
ssh turm.dev auth demo pi both

Inside the VM, agentcloud-addon auth <agent> <mode> stores the same mode and applies it immediately. agentcloud-addon sync applies it within a minute.

Sharing

See HTTPS and sharing.

Command	Effect
share set-public <vm>	Anyone can open the VM’s HTTPS URL.
share set-private <vm>	Only you and people you shared with.
share add <vm> <email> [--root]	Share with one person. --root also gives them SSH access.
share remove <vm> <email>	Stop sharing with them.
share add-link <vm>	Create a share link.
share remove-link <vm> <token>	Revoke a share link.
share show <vm>	Show who has access.
share port <vm> <port>	Serve a different port in the VM. Default 80.

ssh turm.dev share add demo friend@example.com
ssh turm.dev share port demo 3000

Custom domains

See Custom domains.

Command	What it does
domain add <vm> <domain>	Bind a domain to a VM. Verified by a CNAME to <vm>.turm.dev or a TXT record. A domain another account bound before needs the TXT record.
domain add --wildcard <domain>	Claim *.<domain>: <vm>.<domain> routes to your VM <vm>. Verified by a TXT record on <domain>; pending until it is. domain add '*.<domain>' works too.
domain verify <domain>	Check a wildcard’s TXT record again and route it once it is there.
domain ls [--json]	Your domains. Wildcards are listed as *.<domain> with status verified or pending.
domain rm <domain> / domain rm '*.<domain>'	Remove a binding or a wildcard.

ssh turm.dev domain add demo www.example.com
ssh turm.dev domain add --wildcard example.com
ssh turm.dev domain verify example.com
ssh turm.dev domain ls
ssh turm.dev domain rm '*.example.com'

Pools

See Shared CPU and RAM pools.

ssh turm.dev pool list
ssh turm.dev pool new build --cpus=4 --region=fsn1
ssh turm.dev pool resize build --cpus=8
ssh turm.dev pool delete build

Account

whoami

Your email, user ID and SSH keys, including pending ones.

ssh turm.dev whoami

email

An account you made with ssh turm.dev has no email address. To add one, so that web sign-in reaches the same account, run this over SSH:

ssh turm.dev email set you@example.com

You get a mail with a link. Your email changes only when you open the link and press Continue. If the address already belongs to an email-only account with no VMs, plan or keys, that account is merged into this one, and its web sessions stay signed in. If that account has VMs, a plan or keys, nothing changes and the page tells you why.

ssh-key

See SSH keys.

Command	Effect
ssh-key list	List your keys.
ssh-key add <public key>	Add a key, or pipe it on stdin. It stays pending until activated.
ssh-key activate <code>	Run from the new key’s computer to activate it.
ssh-key remove <fingerprint|label>	Remove a key. You can’t remove your last active SSH key.
ssh-key generate-api-key [--label=x] [--cmds=ls,new] [--exp=30d]	Make a token for the HTTPS API.

cat ~/.ssh/laptop.pub | ssh turm.dev ssh-key add
ssh turm.dev ssh-key generate-api-key --label=ci --cmds=ls,new --exp=30d

team

ssh turm.dev team create acme
ssh turm.dev team members

billing

See Billing and plans.

ssh turm.dev billing plans
ssh turm.dev billing subscribe personal-4
ssh turm.dev billing usage

traffic

Your egress this month, your plan’s traffic allowance, and the bandwidth your VMs get. Each VM is guaranteed its plan rate and can burst higher when the server’s link has room. Over the allowance, your VMs slow down until the next month; they stay reachable.

ssh turm.dev traffic

Field	Meaning
period	The month, UTC (2026-10).
used_bytes / allowance_bytes	Egress so far and the allowance (0: none).
state	ok, throttled (over the allowance) or overage (over it, still full speed, billed).
rate_mbps / ceil_mbps	Guaranteed rate and burst limit per VM.
overage_bytes	Traffic past the allowance this month that is billed (Work plan with overage).
overage_price_cents_per_gib	Price per whole GiB of overage in euro cents (5); 0 if your plan slows down instead.
overage_cents / projected_overage_cents	Charge so far, and at the end of the month if this month’s average rate holds.
disk	allocated_gb (your VMs’ disks together) and allowance_gb (the plan’s); overage_gib_hours, overage_price_cents_per_gib_month (8; 0 if creates past the allowance are refused instead), overage_cents and projected_overage_cents (if the allocation stays as it is).
charges	Past months’ overage invoice lines (traffic and disk): period, kind (egress or disk), units (GiB or GiB-months), amount_cents, sent (on your invoice).

defaults

Store default values for your account.

ssh turm.dev defaults read <key>
ssh turm.dev defaults write <key> <value>
ssh turm.dev defaults delete <key>

Key	Meaning
new.setup-script	Setup script for every new VM, up to 64 KiB. Write /dev/stdin to pipe a file. new --setup-script replaces it for one VM and new --no-setup-script skips it. defaults read prints it unchanged.

cat setup.sh | ssh turm.dev defaults write new.setup-script /dev/stdin
ssh turm.dev defaults read new.setup-script
ssh turm.dev defaults delete new.setup-script

integrations

See GitHub integration.

ssh turm.dev integrations list
ssh turm.dev integrations add github --name=gh --token=- --repos=acme/* --read-only
ssh turm.dev integrations add http-proxy --name=api --target=https://api.example.com --header='Authorization: Bearer ...'
ssh turm.dev integrations remove gh

set-region

ssh turm.dev set-region fsn1

In the VM

Command	Effect
agentcloud-addon list|install|remove|update <name>	Manage add-ons from inside the VM.