Remote servers (local ↔ remote)

The merido CLI normally operates on the local instance (the SQLite store under ~/.merido). You can also point it at a remote merido server's control plane and switch back and forth.

Connect

1. In the remote server's dashboard, create a Management token (mdm_…).

2. Add the server and validate the token:

   merido server add prod --url https://gw.merido.dev --token mdm_xxxxxxxx
   # omit --token to be prompted

3. Switch to it:

   merido server use prod
   merido keys list        # now lists the remote server's keys
   merido server use local # back to this machine

Run a single command against a context without switching:

merido --context prod providers list

What runs remotely

Read commands work against the active context: keys list, providers list, accounts list, gain. Other mutating commands (keys create, providers add, accounts remove) and start always run locally for now.

Connect a subscription provider account to the cloud

login <provider> is the exception among mutating commands: it follows the active context too, so once a server is added there's no separate dashboard trip for a gateway key.

merido server use prod
merido login claude   # mints (or reuses/rotates) a gateway key from prod's
                       # mdm_ token, completes the OAuth flow locally, uploads
                       # the tokens to prod

The OAuth authorize/device-code flow always runs on your machine (the provider's redirect can only land on a loopback address); only the resulting tokens travel to the remote gateway, scoped to your org. The key is visible under Keys in the dashboard (labeled cli-login-<provider>) if you want to audit or revoke it later. Running login again for the same provider/context reuses that key (rotating in a fresh secret) instead of minting a new one each time, so repeat logins don't pile up extra keys in the dashboard.

To target a server you have not saved as a context, bypass --context entirely:

merido login claude --server https://your-gateway.example --token <gateway-key>

Where the config lives

Servers are stored in ~/.merido/cli.toml (mode 0600). The mdm_ token is stored in plaintext — treat that file like an SSH key, especially on shared machines.