# Manage remote query targets

Canonical: https://hypaware.ai/docs/cli-reference/manage-remote-query-targets

```text
hyp remote <subcommand> [args...]
```

Use `hyp remote --help` to list remote operations:

```sh
hyp remote --help
```

## `hyp remote add`

```text
hyp remote add <name> <url>
```

Registers a named Model Context Protocol (MCP) query target in local
configuration. It doesn't authenticate. Give the server's base URL; HypAware
appends `/v1/mcp` itself, and a URL that already ends in `/v1/mcp` is used as
given.

```sh
hyp remote add team https://hyp.example.com
```

## `hyp remote login`

```text
hyp remote login [name] [--token-file <path>] [--org <org>] [--host <label>] [--browser] [--no-browser] [--no-forward] [--no-daemon] [--force]
```

Signs in through a browser by default, or reads a static token from
`--token-file` or standard input. It stores the credential with mode `0600`.
Omit `name` to sign in to the default target. Unless you set `--no-forward`,
login can enroll this host, set up sync, and install the daemon.

- `--org <org>` selects an organization.
- `--browser` forces browser sign-in when stdin is piped, unless an explicit
  `--token-file` is supplied.
- `--no-browser` prints the sign-in URL instead of opening a browser.
- `--host <label>` overrides the host label this host syncs under, which defaults to the
  hostname.
- `--no-forward` signs in for queries only, with no organization enrollment.
- `--no-daemon` sets up sync without installing the service.
- `--force` allows the existing CLI path if global installation fails.

```sh
hyp remote login
hyp remote login team --no-forward
```

## `hyp remote mint`

```text
hyp remote mint [name] [--scope query] [--label <label>] [--expires-days <n>]
```

Mints a long-lived CI enrollment token from your logged-in session and prints
it once, for pasting into CI secrets. It requires a session stored by
`hyp remote login`. Omit `name` to mint against the default target.
`--label` names the host the token is bound to, and `--expires-days`
overrides the 365-day default. Every CI run that joins with the token shares
that one host record, and the token itself never rotates. Mint prints its
id on standard error, shown as gateway in the current CLI output; this is the
host record.

```sh
hyp remote mint team --label repo-ci --expires-days 90
```

The token is written to standard output on its own; the summary line, the
warning, and the recipe go to standard error, so `hyp remote mint > ci.token`
stores exactly the secret.

For the complete join, capture, and flush workflow, see
[CI and headless deployment](https://hypaware.ai/docs/integrations/ci-and-headless/index.md).

With `--scope query`, it mints a personal agent token instead, for a headless
agent or CI job that queries and publishes as you. The token reads your
organization's recorded history and can mark recommendations, publish reports,
and delete reports, as you, until it expires or you revoke it. `--label` names
it, and `--expires-days` sets its lifetime; without it, the server's default
applies. As with the CI token, only the token goes to standard output, and
HypAware keeps no copy. At your own computer you don't need one:
`hyp mcp serve --remote` already uses your session.

```sh
hyp remote mint team --scope query --label nightly-agent
```

## `hyp remote tokens`

```text
hyp remote tokens [name] [--json]
```

Lists your agent tokens on a target: the token ID (`jti`), label, creation
time, expiry, and whether it's revoked. It never prints a token value. You
can hold at most ten live agent tokens at a time.

It then lists your live MCP connections on that target, the ones a client
such as Claude made when you signed in through its connector: the
connection ID, the client, the org, creation time, and expiry. With
`--json` it prints `{"tokens": [...], "connections": [...]}`.

Both lists need a `hyp remote login` session on this computer. If you
connected only through Claude, sign in with `hyp remote login` first, or
remove HypAware from Claude's connectors to cut the connection there.

```sh
hyp remote tokens team
```

## `hyp remote tokens revoke`

```text
hyp remote tokens revoke <jti> [--remote <name>]
```

Revokes one of your agent tokens or MCP connections by its ID, on the
default target unless `--remote` names another. The connection's client
loses access at its next request and has to sign in again.

```sh
hyp remote tokens revoke rt-0123456789abcdef --remote team
hyp remote tokens revoke oauth-0123456789abcdef --remote team
```

## `hyp remote list`

```text
hyp remote list [--json]
```

Lists target URLs and credential status. It never prints credential values.

```sh
hyp remote list --json
```

## `hyp remote remove`

```text
hyp remote remove <name>
```

Removes the named target and its locally stored token. It doesn't leave
HypAware Cloud enrollment; use `hyp leave` for that.

```sh
hyp remote remove team
```