Manage remote query targets

hyp remote <subcommand> [args...]

Use hyp remote --help to list remote operations:

hyp remote --help

hyp remote add

hyp remote add <name> <url>

Registers a named Model Context Protocol (MCP) query target in local configuration. It doesn't authenticate. Give the server's base URL; HypAware appends /v1/mcp itself, and a URL that already ends in /v1/mcp is used as given.

hyp remote add team https://hyp.example.com

hyp remote login

hyp remote login [name] [--token-file <path>] [--org <org>] [--host <label>] [--browser] [--no-browser] [--no-forward] [--no-daemon] [--force]

Signs in through a browser by default, or reads a static token from --token-file or standard input. It stores the credential with mode 0600. Omit name to sign in to the default target. Unless you set --no-forward, login can enroll this host, set up sync, and install the daemon.

• --org <org> selects an organization.
• --browser forces browser sign-in when stdin is piped, unless an explicit --token-file is supplied.
• --no-browser prints the sign-in URL instead of opening a browser.
• --host <label> overrides the host label this host syncs under, which defaults to the hostname.
• --no-forward signs in for queries only, with no organization enrollment.
• --no-daemon sets up sync without installing the service.
• --force allows the existing CLI path if global installation fails.

hyp remote login
hyp remote login team --no-forward

hyp remote mint

hyp remote mint [name] [--scope query] [--label <label>] [--expires-days <n>]

Mints a long-lived CI enrollment token from your logged-in session and prints it once, for pasting into CI secrets. It requires a session stored by hyp remote login. Omit name to mint against the default target. --label names the host the token is bound to, and --expires-days overrides the 365-day default. Every CI run that joins with the token shares that one host record, and the token itself never rotates. Mint prints its id on standard error, shown as gateway in the current CLI output; this is the host record.

hyp remote mint team --label repo-ci --expires-days 90

The token is written to standard output on its own; the summary line, the warning, and the recipe go to standard error, so hyp remote mint > ci.token stores exactly the secret.

For the complete join, capture, and flush workflow, see CI and headless deployment.

With --scope query, it mints a personal agent token instead, for a headless agent or CI job that queries and publishes as you. The token reads your organization's recorded history and can mark recommendations, publish reports, and delete reports, as you, until it expires or you revoke it. --label names it, and --expires-days sets its lifetime; without it, the server's default applies. As with the CI token, only the token goes to standard output, and HypAware keeps no copy. At your own computer you don't need one: hyp mcp serve --remote already uses your session.

hyp remote mint team --scope query --label nightly-agent

hyp remote tokens

hyp remote tokens [name] [--json]

Lists your agent tokens on a target: the token ID (jti), label, creation time, expiry, and whether it's revoked. It never prints a token value. You can hold at most ten live agent tokens at a time.

It then lists your live MCP connections on that target, the ones a client such as Claude made when you signed in through its connector: the connection ID, the client, the org, creation time, and expiry. With --json it prints {"tokens": [...], "connections": [...]}.

Both lists need a hyp remote login session on this computer. If you connected only through Claude, sign in with hyp remote login first, or remove HypAware from Claude's connectors to cut the connection there.

hyp remote tokens team

hyp remote tokens revoke

hyp remote tokens revoke <jti> [--remote <name>]

Revokes one of your agent tokens or MCP connections by its ID, on the default target unless --remote names another. The connection's client loses access at its next request and has to sign in again.

hyp remote tokens revoke rt-0123456789abcdef --remote team
hyp remote tokens revoke oauth-0123456789abcdef --remote team

hyp remote list

hyp remote list [--json]

Lists target URLs and credential status. It never prints credential values.

hyp remote list --json

hyp remote remove

hyp remote remove <name>

Removes the named target and its locally stored token. It doesn't leave HypAware Cloud enrollment; use hyp leave for that.

hyp remote remove team