> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kombify.io/llms.txt
> Use this file to discover all available pages before exploring further.

# techstack api servers

> Generated reference for the techstack api servers commands

<Note>Generated from the Techstack v0.39.0 release (source `49677b729cb9`). For an installed version, `techstack api <command> --help` is authoritative.</Note>

## techstack api servers detach

Revoke and detach one exact customer-operated BYO server.

Retains the terminal canonical server receipt and performs no provider API call.

```bash theme={null}
techstack api servers detach <server-id> [flags]
```

<Warning>Requires confirmation: This operation revokes the server's credentials and removes it from management without touching the machine. Pass `--yes` or answer the prompt; a non-interactive run without `--yes` stops before any request with exit code 9.</Warning>

| | |
| - | - |
| HTTP | `POST /api/v1/servers/{serverId}/detach` |
| Changes state | Yes |
| MCP tool | `detach_self_owned_server` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |
| `--confirm-server-id` | string | **Required.** Must exactly equal the serverId path parameter. |
| `--body` | json | JSON request body (`application/json`) as a literal, `@path` or `-` for stdin. |

## techstack api servers get

Get canonical server lifecycle, connection, health, and channels.

```bash theme={null}
techstack api servers get <server-id> [flags]
```

| | |
| - | - |
| HTTP | `GET /api/v1/servers/{serverId}` |
| Changes state | No |
| MCP tool | `get_server_runtime` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |

## techstack api servers list

List canonical Node runtime state.

Returns owner-scoped Nodes with canonical `node_id` and
`kit_deployment_id` identities.

```bash theme={null}
techstack api servers list [flags]
```

| | |
| - | - |
| HTTP | `GET /api/v1/servers` |
| Changes state | No |
| MCP tool | `list_server_runtimes` |

| Argument | Type | Description |
| - | - | - |
| `--kit-deployment-id` | string | — |

## techstack api servers maintenance get

Read one maintenance job of an owned server.

Scoped like the POST: the Edge-signed `techstack.servers.maintenance` entitlement, the tenant, ownership of the server, and a job that belongs to this server and was requested by the caller. Anything else is 404. Maintenance jobs have their own ledger and are not served by `/api/v1/jobs/&#123;id&#125;`. There is no log endpoint: the job carries its outcome, and a failure carries its stable code with user guidance.

```bash theme={null}
techstack api servers maintenance get <server-id> <job-id> [flags]
```

| | |
| - | - |
| HTTP | `GET /api/v1/servers/{serverId}/actions/{jobId}` |
| Changes state | No |
| MCP tool | `get_server_maintenance_job` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |
| `<job-id>` | string | **Required.** |

## techstack api servers maintenance run

Queue an owned server OS update plan, OS update or reboot.

Requires the Edge-signed `techstack.servers.maintenance` entitlement, ownership of the server in the tenant, and current server-bound standing authority for delegated native MCP calls. These three ordinary actions require no fresh MFA or separate owner\_approved assertion. The body is decoded strictly: exact lowercase keys, no duplicates, no unknown fields. A replay with the same Idempotency-Key returns the stored receipt before target validation. One reboot or OS update and, separately, one update plan may be active per server; a job not finished by its deadline fails with `deadline_exceeded` and frees its slot. The action is offered in `allowed_actions` only when the server agent advertises `stackkit.host-maintenance.v1`, and `reboot` only when the server also reports `host_boot_id`. Refusals are client-error-envelope/v1 documents; 409 `reason_code` is one of control\_plane\_host, substrate\_node, protected\_demo\_server, service\_locked, maintenance\_active, node\_operation\_active, plan\_stale, agent\_capability\_missing, boot\_id\_unknown, agent\_not\_connected, heartbeat\_stale, inventory\_revision\_stale or idempotency\_key\_reused; 403 carries entitlement\_required or maintenance\_origin\_authority\_denied.

```bash theme={null}
techstack api servers maintenance run <server-id> [flags]
```

| | |
| - | - |
| HTTP | `POST /api/v1/servers/{serverId}/actions` |
| Changes state | Yes |
| MCP tool | `run_server_maintenance_action` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |
| `--action` | string | **Required.** One of `os_update_plan`, `os_update`, `reboot`. |
| `--expected-inventory-revision` | integer | **Required.** |
| `--expected-plan-digest` | string | os\_update only: the plan\_digest of a completed os\_update\_plan for this server that is at most 15 minutes old. |
| `--owner-approved` | boolean | Optional legacy field; it does not grant maintenance authority. |
| `--body` | json | JSON request body (`application/json`) as a literal, `@path` or `-` for stdin. |

## techstack api servers network get

Read the server's network facts and any recorded home network move.

The network the server's kombify Guard last observed (address, gateway, subnet, interface, WiFi network), the `network_move` record kombify wrote when the server turned up on a different network, and the state of the re-bind that followed. A moved server re-binds itself automatically; `can_rebind` says whether the owner can start one now.

```bash theme={null}
techstack api servers network get <server-id> [flags]
```

| | |
| - | - |
| HTTP | `GET /api/v1/servers/{serverId}/network` |
| Changes state | No |
| MCP tool | `get_server_network` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |

## techstack api servers network rebind

Re-bind a moved server to the network it is on now.

Runs `stackkit network rebind` on the server through its kombify Guard: the node re-detects its LAN address, re-issues the signed LAN DNS custody record and regenerates and re-applies the workspace. The request takes no body. Requires the owner, the Inventory operate grant and the `techstack.servers.maintenance` entitlement, and a connected Guard (409 `server_network_not_ready` otherwise). A rebind that is already queued or running answers with its job instead of queueing another.

```bash theme={null}
techstack api servers network rebind <server-id> [flags]
```

<Warning>Requires confirmation: This operation re-detects the server's address on the network it is on now, re-issues its signed local DNS record and re-applies its workspace. Pass `--yes` or answer the prompt; a non-interactive run without `--yes` stops before any request with exit code 9.</Warning>

| | |
| - | - |
| HTTP | `POST /api/v1/servers/{serverId}/network/rebind` |
| Changes state | Yes |
| MCP tool | `rebind_server_network` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |

## techstack api servers ports

Get the authenticated owner's port inventory for one canonical server.

Server-detail UI projection over the same central port authority as the Inventory/MCP surface, authorized through the canonical owner-scoped server read boundary.

```bash theme={null}
techstack api servers ports <server-id> [flags]
```

| | |
| - | - |
| HTTP | `GET /api/v1/servers/{serverId}/ports` |
| Changes state | No |
| MCP tool | `get_server_runtime_ports` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |

## techstack api servers reach set

Publish the server at a kombify.me address, or stop publishing it.

Nothing is published by default: a paired server has no public route and the relay carries no traffic. The owner enables it per server with an explicit `service` name and `target_port` (the origin is always the Guard host's loopback, never another machine) and may withdraw it at any time. The relay authenticates the Guard, not the visitor, so what answers on that port must protect itself. Enabling requires the owner, the `techstack.servers.maintenance` entitlement and a fresh multi-factor sign-in (reason `server_reach_step_up_required`); withdrawing is never gated. Responds with the reach section of the server read model; the reconciler then creates or withdraws the route.

```bash theme={null}
techstack api servers reach set <server-id> [flags]
```

<Warning>Requires confirmation: This operation publishes a service of the server at a public kombify.me address that anyone on the internet can open. Pass `--yes` or answer the prompt; a non-interactive run without `--yes` stops before any request with exit code 9.</Warning>

| | |
| - | - |
| HTTP | `PUT /api/v1/servers/{serverId}/reach` |
| Changes state | Yes |
| MCP tool | None |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |
| `--enabled` | boolean | **Required.** |
| `--service` | string | Required when enabling. The route label; the kombify.me route is \<base>-\<service>-\<server suffix>. |
| `--target-port` | integer | Required when enabling. The port the service listens on, on the Guard host's loopback (the host is fixed). |
| `--target-scheme` | string | One of `http`, `https`. Default `"http"`. |
| `--body` | json | JSON request body (`application/json`) as a literal, `@path` or `-` for stdin. |

## techstack api servers security auto-repair get

Read the owner's approval of automatic security repair.

A server without an approval, or with an expired one, is observe-only.

```bash theme={null}
techstack api servers security auto-repair get <server-id> [flags]
```

| | |
| - | - |
| HTTP | `GET /api/v1/servers/{serverId}/security/auto-repair` |
| Changes state | No |
| MCP tool | `get_server_security_auto_repair` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |

## techstack api servers security auto-repair set

Approve or withdraw automatic repair of a small safe set of controls.

Off by default. An approval names controls from the safe set (`allowed_controls`: brute-force protection, the firewall policy, kernel parameters and automatic security updates; never the ssh controls), expires within 90 days and never renews itself. While it is in force the control plane repairs a named control that fresh evidence reports drifted, inside the same bounds as an operator repair. Requires the owner, the `techstack.servers.maintenance` entitlement and a fresh multi-factor sign-in. `enabled: false` withdraws the approval.

```bash theme={null}
techstack api servers security auto-repair set <server-id> [flags]
```

<Warning>Requires confirmation: This operation lets the kombify Guard repair the named host security controls without asking each time, until the approval expires. Pass `--yes` or answer the prompt; a non-interactive run without `--yes` stops before any request with exit code 9.</Warning>

| | |
| - | - |
| HTTP | `PUT /api/v1/servers/{serverId}/security/auto-repair` |
| Changes state | Yes |
| MCP tool | None |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |
| `--controls` | string\[] | — |
| `--enabled` | boolean | **Required.** |
| `--expires-at` | string | — |
| `--body` | json | JSON request body (`application/json`) as a literal, `@path` or `-` for stdin. |

## techstack api servers security findings

List the open findings and recent findings history of one server.

The findings ledger behind the server's `security`, `recovery` and Guard alerts. One finding is one episode: opened when a fact is first observed wrong, resolved when it is observed right again, with at most one alert (`alerted_at`) and one resolution. History is kept 90 days.

```bash theme={null}
techstack api servers security findings <server-id> [flags]
```

| | |
| - | - |
| HTTP | `GET /api/v1/servers/{serverId}/security/findings` |
| Changes state | No |
| MCP tool | `list_server_security_findings` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |

## techstack api servers security repairs list

List the recent security repairs of one server.

```bash theme={null}
techstack api servers security repairs list <server-id> [flags]
```

| | |
| - | - |
| HTTP | `GET /api/v1/servers/{serverId}/security/repairs` |
| Changes state | No |
| MCP tool | `list_server_security_repairs` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |

## techstack api servers security repairs request

Repair named drifted host security controls.

Requests a bounded repair of controls the fresh host security evidence reports as drifted and automatically repairable. Requires the server's owner, the Edge-signed `techstack.servers.maintenance` entitlement and a fresh multi-factor sign-in (at most 300 seconds old). The repair travels as a typed, journaled Guard command that runs `stackkit host security repair --apply` for exactly the named controls; StackKits refuses, before changing anything, a change that would cut the management path or lock the owner out. Bounds: one repair per server at a time (409 `repair_in_progress`), a per-control cooldown (429 `repair_cooldown`), a daily attempt budget per control (429 `repair_attempts_exhausted`) and a circuit breaker after consecutive failures (429 `repair_circuit_open`); the 429 answers carry `retry_after`. A control that is compliant (409 `control_not_drifted`), under an approved exception (`control_has_exception`), manual (`control_not_repairable`), blocked on an authorized SSH key (`needs_authorized_key`) or not observed is refused. The body is decoded strictly.

```bash theme={null}
techstack api servers security repairs request <server-id> [flags]
```

<Warning>Requires confirmation: This operation restores the named host security controls (firewall, ssh, brute-force protection, automatic updates) on the server through its kombify Guard. Pass `--yes` or answer the prompt; a non-interactive run without `--yes` stops before any request with exit code 9.</Warning>

| | |
| - | - |
| HTTP | `POST /api/v1/servers/{serverId}/security/repairs` |
| Changes state | Yes |
| MCP tool | None |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |
| `--controls` | string\[] | **Required.** |
| `--body` | json | JSON request body (`application/json`) as a literal, `@path` or `-` for stdin. |

## techstack api servers security verify

Ask the kombify Guard for a fresh host security observation.

Records that a fresh observation of the host baseline is wanted. The Guard answers at its next check-in (within about a minute) with a new report; nothing on the host changes. The server's `security` read model is updated only by that report, never by this request. Another tenant's or owner's server is 404; a server without a Guard is 409 `guard_not_connected`.

```bash theme={null}
techstack api servers security verify <server-id> [flags]
```

| | |
| - | - |
| HTTP | `POST /api/v1/servers/{serverId}/security/verify` |
| Changes state | Yes |
| MCP tool | None |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |

## techstack api servers summary

Read the authenticated owner's server-presence summary.

Returns only a count and presence flag under the same tenant and owner policy scope as the canonical inventory list. The optional tenant query exists for Gateway compatibility and must exactly match the tenant in the authenticated identity; a mismatch is rejected before any store read. No server, tenant, or subject identifiers are returned.

```bash theme={null}
techstack api servers summary [flags]
```

| | |
| - | - |
| HTTP | `GET /api/v1/servers/summary` |
| Changes state | No |
| MCP tool | None |

| Argument | Type | Description |
| - | - | - |
| `--tenant` | string | — |

## techstack api servers transitions

List the persisted server state timeline.

```bash theme={null}
techstack api servers transitions <server-id> [flags]
```

| | |
| - | - |
| HTTP | `GET /api/v1/servers/{serverId}/transitions` |
| Changes state | No |
| MCP tool | `list_server_runtime_transitions` |

| Argument | Type | Description |
| - | - | - |
| `<server-id>` | string | **Required.** Canonical server runtime ID. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.