GreenCLI by ChoateLabs

Help topics

The same help as in the app. In GreenCLI, press F1, or click Help (the ?) at the bottom of the bar on the left.

Show the keys for:
On this page

Getting started#

What this app is and the first thing to do.

On a Mac

One cockpit for Aruba · Juniper · Mist: a terminal/SSH client, config editor, REST API explorer, an MCP-powered AI assistant, and a network-intent (desired-state) layer.

  1. Press ⌘T (or click Quick Connect) to open a connection.
  2. Pick a protocol (SSH / Telnet / Serial / Local) and enter the host.
  3. Optionally check Save to sidebar to keep the session (never the password).

Secrets are never kept in the browser: AI keys and MCP logins go in the system password store (Keychain on a Mac, Credential Manager on Windows), SSH passwords in the encrypted vault.

On Windows

One cockpit for Aruba · Juniper · Mist: a terminal/SSH client, config editor, REST API explorer, an MCP-powered AI assistant, and a network-intent (desired-state) layer.

  1. Press Ctrl+Shift+T (or click Quick Connect) to open a connection.
  2. Pick a protocol (SSH / Telnet / Serial / Local) and enter the host.
  3. Optionally check Save to sidebar to keep the session (never the password).

Secrets are never kept in the browser: AI keys and MCP logins go in the system password store (Keychain on a Mac, Credential Manager on Windows), SSH passwords in the encrypted vault.

Connecting to devices#

SSH/Telnet/Serial/Local, auth methods, jump host, startup commands.

On a Mac

Open Quick Connect (⌘T) or double-click a saved host in the sidebar.

Double-clicking a host that already has a tab brings that tab back. For another session to the same device, ⇧-double-click it, right-click it → Open new session, or right-click its tab → Duplicate tab. Extra tabs are numbered: core-sw-01 (2).

  • SSH auth: password, private key (Browse… to load a key file), or ssh-agent.
  • If password auth is refused it falls back to keyboard-interactive (TACACS+/RADIUS); only the first prompt gets the password, so an OTP prompt is left for you.
  • Jump host / ProxyJump: set a bastion and how to log in to it — a password (kept in the vault for saved hosts), a shared login, or your key / agent. Bastions that ask for a one-time code (MFA) are not supported yet.
  • Startup commands: per-host commands run automatically once the shell is ready (e.g. terminal length 0).

On Windows

Open Quick Connect (Ctrl+Shift+T) or double-click a saved host in the sidebar.

Double-clicking a host that already has a tab brings that tab back. For another session to the same device, Shift+double-click it, right-click it → Open new session, or right-click its tab → Duplicate tab. Extra tabs are numbered: core-sw-01 (2).

  • SSH auth: password, private key (Browse… to load a key file), or ssh-agent.
  • If password auth is refused it falls back to keyboard-interactive (TACACS+/RADIUS); only the first prompt gets the password, so an OTP prompt is left for you.
  • Jump host / ProxyJump: set a bastion and how to log in to it — a password (kept in the vault for saved hosts), a shared login, or your key / agent. Bastions that ask for a one-time code (MFA) are not supported yet.
  • Startup commands: per-host commands run automatically once the shell is ready (e.g. terminal length 0).

Importing hosts#

Bring saved hosts in from a CSV file, SecureCRT, Aruba Central, Juniper Mist or ~/.ssh/config.

Open Import hosts from the activity bar on the left, the sidebar (download icon), the command palette, or Settings → Connections & Security. Every source shows a preview first: hosts you already have (same host, port and user) are greyed out, and nothing is saved until you press Import.

  • CSV: columns name, host, port, user, type, folder, tags, jump (only host is required; tags separated by ;). Download template CSV gives you a starting file.
  • SecureCRT: choose the Sessions folder — macOS ~/Library/Application Support/VanDyke/SecureCRT/Config/Sessions, Windows %APPDATA%\VanDyke\Config\Sessions. SSH, Telnet and Serial sessions come across with their folders. An XML export (File ▸ Export Settings) works too.
  • Aruba Central / Juniper Mist: loads devices with an IP address from the account set up in Settings → Integrations; the site becomes the folder.
  • Folders: keep the source folders, or put everything in one folder. Existing folders with the same name are reused.

Passwords are never imported. SecureCRT firewall / jump settings aren't either — add a jump host with Edit… after importing.

Credential vault#

Encrypted store for SSH passwords (AES-256-GCM + Argon2).

Unlock the vault with a master password; saved SSH passwords are encrypted (AES-256-GCM, Argon2id key) and offered automatically on the next connect.

Aruba Central / Mist secrets are also stored in the vault (encrypted) once it is unlocked, so they survive a restart. While the vault is locked they live in memory for the session only.

A corrupt/incompatible vault.enc is never auto-overwritten — it errors and is preserved so nothing is silently lost.

Shared logins#

One TACACS/RADIUS password for many devices — change it once.

Create a shared login (name, username, password) in Settings → Connections & Security → Shared Logins. Make it a folder's default (right-click the folder → Default login…) or pick it for one host in Edit….

  • A host uses its own login if it has one, else its folder's. Per-host password keeps a host on its own saved password.
  • The login's username is used when the host has none of its own.
  • When the password rotates, change it once in Settings — or, when a device rejects it, choose Update this login's password in the password dialog.

Only the name and username are stored in settings; the password is kept in the encrypted vault.

AI assistant#

Provider-neutral assistant (Anthropic, OpenRouter, Moonshot, Ollama, Local CLI, Casper).

Settings → AI Assistant. The assistant works with any provider — keys are kept in the system password store (Keychain, Credential Manager), never in the browser.

  1. Pick a provider (Anthropic / OpenRouter / Moonshot need a key; Ollama is local; Local CLI shells out to an installed agent; Casper (no key) uses Casper on your computer).
  2. Enter the API key and choose a model.
  3. Enable the opt-in Assistant tools you want (run CLI commands, device REST, MCP tools, evaluate intents).

Responses stream token-by-token; Stop actually aborts the provider request, not just the UI. Local CLI and Casper answer all at once, and Stop ends the CLI.

Casper: each question gets a fresh folder (or one you pick with Choose…; Check Casper tests it). GreenCLI never turns Casper’s sandbox off, and won’t start Casper while a port forward or a local MCP server is open. Casper can’t use device tools or MCP servers. Its own file tools can read files outside its folder, including GreenCLI’s session logs and archived configs, and ai_keys.json and mcp_creds.json when no system password store is found, so only ask it about text you trust.

Device secrets (passwords, keys, SNMP communities, private keys) are hidden before the AI sees any tool output: they show as <secret hidden>, and the tool row shows how many were hidden. The AI can’t send the marker back to a device. Text you type into the chat is sent as you typed it.

AI agents (per-session)#

Attach a saved persona — instructions + provider/model — to a session.

An agent is a saved persona: custom instructions plus an optional provider/model override. Attach one to a session and the AI assistant uses it whenever that session is active.

  1. Settings → AI Agents → New agent: name it, write instructions, and (optionally) pick a provider + model.
  2. In the sidebar, right-click a host → AI Agent… and choose the agent (or pick the chip under the host).
  3. Open the AI assistant on that session — the bar above the chat shows the active agent, and the instructions/model are applied.
  • Starter agents ship ready: Read-only Auditor, Junos Expert, Aruba CX Expert.
  • The Read-only Auditor is enforced: only plain read commands (show, display, ping with a count …) and read-only MCP tools run; anything else is refused. Type show, not sh.
  • Provider/model are optional — leave on Default to inherit the global AI settings.

The agent’s instructions are appended to the system prompt for that session only — different tabs can run different agents.

MCP servers#

Connect external MCP servers and expose their tools to the AI.

The app is an MCP client: it connects to external MCP servers — stdio (launches a command) or Streamable HTTP (points at one already running) — and exposes their tools to the AI for every API provider (not Local CLI or Casper).

  1. Settings → AI & MCP → MCP Servers (or MCP Servers in the command palette) → Add server.
  2. Click Paste config JSON instead to auto-fill from a setup wizard snippet, or fill in by hand.
  3. Stdio: set the command, args (one per line), and any env. HTTP: set the server URL.
  4. Stdio only — for secrets, set a credentials env var + paste the content. It is kept in the system password store; while the server runs it is written to a private (0600) file that the env var points at.
  5. Click Connect; the tool count appears in the AI panel.
  • Approval box: a tool that might change something asks first: No, Yes, this once, or (for plain reads only) Yes, until GreenCLI closes. Router calls and calls where the AI set confirm itself always ask.
  • Allow writes (per server, off by default): with writes off, tools that change or delete things are hidden and blocked, and known servers start with their own read-only settings.
  • Junos: Run plain show commands without asking skips the box for show … with safe pipes.
  • Export for Casper / Claude… saves a .mcp.json with every secret turned into a ${NAME} variable, and lists the names to set. It also adds greencli-mcp as greencli.
  • Login file: it exists only while its server runs, in mcp_creds/, and is deleted when the server stops, exits or fails to connect. Files a crash left are deleted at the next start.
  • Removing a server removes its saved login too. If the password store can’t be reached, nothing is removed.

Example: the centralmcp server (Aruba Central / GLP / monitoring / NAC / ops / RAG) routes hundreds of backend tools through a compact set exposed to the AI. Tool names are namespaced mcp__<server>__<tool>. Supports stdio (launch command) or Streamable HTTP (point at a URL).

greencli-mcp (for Casper / Claude Code)#

A read-only MCP server that lets Casper or Claude Code read your GreenCLI data.

greencli-mcp lets Casper or Claude Code read your GreenCLI data. It can’t change anything: it only reads GreenCLI’s data folder, and never writes a file, opens a network connection or starts a program. It sits next to the app. The one exception is its show commands (below): they ask the GreenCLI app on this computer, and nothing else.

  1. Settings → AI & MCP → MCP Servers: copy its path, or copy the claude mcp add --scope user greencli -- "<path>" --data-dir "<data folder>" command and run it in a terminal. --scope user makes it available in every folder; without it Claude Code only adds it for the folder you run the command in. --data-dir is GreenCLI’s data folder, so greencli-mcp reads the same one as the app.
  2. Or use Export for Casper / Claude…, which adds it as greencli.
  3. On a Mac, move GreenCLI to Applications first, or the path changes every time it starts.
  • It shows your devices (no passwords, user names, notes or startup commands), config history, configs and diffs with secrets hidden, and intent results.
  • Config history stays under the name a device had when it was captured. After you rename or delete a saved device, or for a Quick Connect you never saved, the AI finds that history with list_archive_devices.
  • Configs come only from hidden copies made when a config is captured. If a tool says a snapshot has no hidden copy, or that it is out of date, open Config Archive (activity bar or command palette) and click Make hidden copies. If it says the copy was made by a newer GreenCLI, restart Claude Code or Casper so they use the updated greencli-mcp.
  • A diff can’t show a changed password: both sides show it hidden.
  • Show commands (macOS, Linux and Windows): list_connected_devices lists the device tabs connected in GreenCLI now, and device_show runs one show line on one of them. GreenCLI must be open with the device connected.
  • GreenCLI asks you first, in a box with three buttons: No, Yes, this once, or Yes, show commands on <device> until GreenCLI closes (with the device’s name; it stops asking for that device until GreenCLI closes). The box shows the exact line it will type, and names the asker as a program on this computer, with its process number.
  • Casper asks first too (it treats device_show as a check on a device), so you answer two boxes: Casper’s, then GreenCLI’s.
  • Only plain show lines run, with filters after | (include, exclude, begin, section, match, count …; on Junos display set, but not trim, xml or json). The text of include, exclude, begin, section, match, except or find may be a pattern with ^ $ * . ( ) [ ] +; a | always starts a new filter. Never ? (it shows help on the device and leaves the line half-typed), quotes, a backtick, a backslash or ; & < >. Never config mode, never on Linux or Windows host tabs, and never while something is half-typed in the tab. show running-config and show tech work; secrets are hidden and the output stops at 16 KB (you get the start).
  • Secrets are hidden, but a filter still sees them: whether a line comes back can give a secret away one guess at a time. Pick Yes, show commands on this device only for a program you trust.
  • GreenCLI waits 40 seconds for your answer, then closes the box as a No (nothing runs), so a Yes always has time to run before the AI tool stops waiting at 60 seconds. To turn this off, clear Let AI tools outside GreenCLI ask to run show commands in MCP Servers; that also forgets every Yes for a device, and anything already asked is refused.

Aruba Central#

OAuth client-credentials or token auth; multi-account.

Settings → Integrations → Aruba Central: enter a Base URL + Client ID/Secret (OAuth), or paste an access token (SSO).

  • Save/load/delete named accounts (loading then Save updates in place, no duplicate).
  • Reach Central data via the API Explorer (target = Central) or via centralmcp.

Device REST security (TLS)#

Control certificate verification for device REST.

Settings → Connections & Security → Device REST security → Verify device TLS certificates. On by default for new installs — untrusted certs are rejected across AOS-CX/AOS-8/AOS-S.

Turn it off only for self-signed lab gear; the toggle warns that credentials can be intercepted on untrusted networks while verification is off. The API Explorer’s per-login Verify-TLS checkbox defaults from this setting.

Updates#

GreenCLI updates itself from its GitHub releases (macOS and Windows).

On a Mac

Settings → Updates shows the version, Check for updates and Check once a day (on by default).

  • A check downloads a newer version and checks its signature, but never installs it. When it is ready you see “GreenCLI X is ready.” with Restart to update.
  • Restart to update asks first, says how many open sessions will close, and warns about unsaved Config Editor edits or a password change still waiting for the vault to unlock (it would be lost). It says when an AI answer is still running, and won’t restart while a Change Job, bulk run, Config Editor send or SFTP upload or download is going.
  • Updates come only from GreenCLI releases on GitHub. Each release build signs its own files, and the app checks the signature before it installs.
  • Run GreenCLI from Applications. From the disk image (or straight from Downloads) it offers no update. After an update, restart Claude Code and Casper so they use the new greencli-mcp.

Coming from 1.9 or older? It has no updater: install 2.0 by hand once.

On Windows

Settings → Updates shows the version, Check for updates and Check once a day (on by default).

  • A check downloads a newer version and checks its signature, but never installs it. When it is ready you see “GreenCLI X is ready.” with Restart to update.
  • Restart to update asks first, says how many open sessions will close, and warns about unsaved Config Editor edits or a password change still waiting for the vault to unlock (it would be lost). It says when an AI answer is still running, and won’t restart while a Change Job, bulk run, Config Editor send or SFTP upload or download is going.
  • Updates come only from GreenCLI releases on GitHub. Each release build signs its own files, and the app checks the signature before it installs.
  • Close Claude Code and Casper before you update (the Restart to update box reminds you). GreenCLI closes when the installer starts. If the installer then shows “Error opening file for writing”, close Claude Code and Casper and click Retry. After Abort, open GreenCLI again.

Coming from 1.9 or older? It has no updater: install 2.0 by hand once.

Network Intent (assurance)#

Declare desired state and check live compliance.

Network Intent in the activity bar on the left (the target icon — a red badge counts intents that failed their last check). Declare what should be true and check live compliance.

  1. Add an intent: name, kind (config/operational), a command, a matcher (contains / not-contains / regex / regex-absent) + expected value, severity, and scope (all / tags / device types).
  2. Click Evaluate all — each command runs against in-scope connected sessions and a per-device result is recorded.
  3. Results: ok / violation / unknown (empty output is unknown, never a false pass). The AI tool evaluate_network_intents summarizes compliance.

Tunnels, SFTP & tools#

Port forwarding, file transfer, triggers, config editor, bulk runner.

On a Mac

  • SSH Tunnels (activity bar on the left): local (-L) and dynamic SOCKS5 (-D) forwards over any SSH session.
  • SFTP: browse/upload/download; uploads confirm before overwriting a remote file.
  • Output triggers (Settings): toast/beep on a keyword/regex in any terminal.
  • Bulk Runner: run one command across many sessions; export CSV.
  • Config Editor problems: risky lines, blanks to fill in, terminal junk and a Junos edit with no commit are underlined and counted in the toolbar. Click the count (or ⌘⇧M) for the Problems panel; F8 jumps to the next one. A line the switch rejected shows in red.
  • Go to Symbol: press ⌘⇧O (or click Outline) and type to jump to an interface, VLAN or section.
  • Quick fixes: on a problem press ⌘. (or click the light bulb) to strip terminal junk, comment out a risky line, add commit confirmed 5, or swap a plain-text password for a blank.
  • Hover cards: hover an Aruba CX or Junos line to see what it does and how the other vendor writes it.
  • Secrets in code files: a password, token or key written into a YAML, JSON, Python, shell or .env file gets a warning.
  • Copy with secrets hidden: the eye button next to Copy copies the tab with passwords, keys and SNMP communities hidden, safe for a ticket or chat.
  • Editor status line: where Send goes, the device's CLI, CONFIG MODE, and when you pulled its config. It warns in red when the tab is for another vendor than the device.
  • After a Send: bars beside the lines show what reached the switch (green), what it rejected (red) and what was never sent (grey).
  • Config Editor smarts: ⌘/ comments a line (! Aruba, # Junos); a double-click picks 1/1/5 or ge-0/0/0.100 whole.
  • Snippets: type cx-access, cx-ospf, aoss-radius, junos-bgp, iap-wlan, … at the start of a line, or pick from Snippets (your tab's vendor is listed first); Tab moves to the next blank. A blank you skip stays ${name} and shows red in Problems.
  • Templates: a whole starter config opens in its own tab. Fill its ${name} blanks, or leave them: in Send safely they become per-device values.
  • Diff: compare the editor with the running-config you pulled, or with a file. Edit your tab on the right; the arrow beside a change takes the left side.
  • Folder view: the folder button opens a folder as a file tree beside the editor; click a file to open it.
  • Send selected lines: select lines, then the arrow next to Send (or right-click). Only those lines go out.
  • Send safely: the arrow next to Send opens Change Jobs with the tab and this device filled in: a dry run, then the switch's own rollback timer.
  • Ask AI (editor toolbar or right-click): explain, check, fix, or convert Aruba ↔ Junos the selected lines. Secrets are hidden first. Mark mistakes with Casper has Casper mark what it finds as squiggles and Problems rows named Casper, and says what it cost.
  • Review in Editor: an AI answer's code opens as a diff against the lines you asked about. Apply or Discard; ⌘Z undoes an Apply.

On Windows

  • SSH Tunnels (activity bar on the left): local (-L) and dynamic SOCKS5 (-D) forwards over any SSH session.
  • SFTP: browse/upload/download; uploads confirm before overwriting a remote file.
  • Output triggers (Settings): toast/beep on a keyword/regex in any terminal.
  • Bulk Runner: run one command across many sessions; export CSV.
  • Config Editor problems: risky lines, blanks to fill in, terminal junk and a Junos edit with no commit are underlined and counted in the toolbar. Click the count (or Ctrl+Shift+M) for the Problems panel; F8 jumps to the next one. A line the switch rejected shows in red.
  • Go to Symbol: press Ctrl+Shift+O (or click Outline) and type to jump to an interface, VLAN or section.
  • Quick fixes: on a problem press Ctrl+. (or click the light bulb) to strip terminal junk, comment out a risky line, add commit confirmed 5, or swap a plain-text password for a blank.
  • Hover cards: hover an Aruba CX or Junos line to see what it does and how the other vendor writes it.
  • Secrets in code files: a password, token or key written into a YAML, JSON, Python, shell or .env file gets a warning.
  • Copy with secrets hidden: the eye button next to Copy copies the tab with passwords, keys and SNMP communities hidden, safe for a ticket or chat.
  • Editor status line: where Send goes, the device's CLI, CONFIG MODE, and when you pulled its config. It warns in red when the tab is for another vendor than the device.
  • After a Send: bars beside the lines show what reached the switch (green), what it rejected (red) and what was never sent (grey).
  • Config Editor smarts: Ctrl+/ comments a line (! Aruba, # Junos); a double-click picks 1/1/5 or ge-0/0/0.100 whole.
  • Snippets: type cx-access, cx-ospf, aoss-radius, junos-bgp, iap-wlan, … at the start of a line, or pick from Snippets (your tab's vendor is listed first); Tab moves to the next blank. A blank you skip stays ${name} and shows red in Problems.
  • Templates: a whole starter config opens in its own tab. Fill its ${name} blanks, or leave them: in Send safely they become per-device values.
  • Diff: compare the editor with the running-config you pulled, or with a file. Edit your tab on the right; the arrow beside a change takes the left side.
  • Folder view: the folder button opens a folder as a file tree beside the editor; click a file to open it.
  • Send selected lines: select lines, then the arrow next to Send (or right-click). Only those lines go out.
  • Send safely: the arrow next to Send opens Change Jobs with the tab and this device filled in: a dry run, then the switch's own rollback timer.
  • Ask AI (editor toolbar or right-click): explain, check, fix, or convert Aruba ↔ Junos the selected lines. Secrets are hidden first. Mark mistakes with Casper has Casper mark what it finds as squiggles and Problems rows named Casper, and says what it cost.
  • Review in Editor: an AI answer's code opens as a diff against the lines you asked about. Apply or Discard; Ctrl+Z undoes an Apply.

Security & your data#

What is encrypted, where keys are kept, where data lives.

  • AI keys and MCP logins are kept in the system password store: macOS Keychain, Windows Credential Manager, or the Secret Service on Linux. Settings says where.
  • The vault (vault.enc) and the other secret files are owner-only (0600), written atomically.
  • SSH uses TOFU host-key pinning — a changed key is rejected.
  • No secrets in browser storage; no telemetry. GreenCLI calls only the providers and devices you configure, plus GitHub for the update check on macOS and Windows (turn off Check once a day in Settings → Updates).

Copying the GreenCLI folder to another computer does not copy the AI keys and MCP logins in the password store. On a Linux computer with no keyring, delete secret_store.json from the copy while GreenCLI is closed, then enter the keys again. 1.9 can’t read the password store, so if you go back to 1.9, enter your AI keys and MCP logins again there. When you start 2.0 again, any key or login in 1.9’s files (typed there, or copied back from a backup) replaces the one in the password store, and the files are deleted. The others stay as they were. If you go back to 2.0.0, enter again there any MCP login it shows as not saved (on Windows, one for a server whose name has a capital letter or a character other than a-z, 0-9 and -_.: , such as “Central”) or that reaches the server as a short GCS1 … line (a very long login). On Windows, enter the first kind once more after you update again.

Data lives in the OS app-data dir for com.choatelabs.greencli (sessions.json, vault.enc, secret_store.json, mcp_servers.json, known_hosts.json, intents.json, config_archive/, logs/). secret_store.json only says the keys are in the password store. ai_keys.json and mcp_creds.json are there only when no password store is found, or when an old 1.9 file is left in this folder: Settings shows the path of one it can’t read as keys, or says some keys were not moved yet.

Keyboard shortcuts#

The essentials.

On a Mac

  • ⌘T — Quick Connect
  • ⌘W — Close the active tab (asks first while it is connected)
  • ⌘F — Find in terminal · ⌘G / ⌘⇧G — next / previous match (F3 / Shift+F3 work too)
  • ⌘K — Command palette
  • ⌃Tab / ⌃⇧Tab — Next / previous tab (also ⌘⇧] / ⌘⇧[)
  • ⌘1…9 — Jump to tab 1–9
  • ⌘, — Settings · F1 — Help
  • ⌘⇧E / ⌘⇧A / ⌘⇧I — Editor / API / AI tab of the side panel (again closes it)
  • ⌘B — Toggle sidebar
  • ⌘= / ⌘- / ⌘0 — Zoom terminal + config-editor font (⌘+wheel inside the editor)

On Windows

  • Ctrl+Shift+T — Quick Connect
  • Ctrl+Shift+W — Close the active tab (asks first while it is connected)
  • Ctrl+Shift+F — Find in terminal · F3 / Shift+F3 — next / previous match
  • Ctrl+Shift+P — Command palette
  • Ctrl+Tab / Ctrl+Shift+Tab — Next / previous tab (also Ctrl+PgDn / Ctrl+PgUp)
  • Alt+1…9 — Jump to tab 1–9
  • Ctrl+, — Settings · F1 — Help
  • Ctrl+Shift+E / Ctrl+Shift+A / Ctrl+Shift+I — Editor / API / AI tab of the side panel (again closes it)
  • Ctrl+B — Toggle sidebar
  • Ctrl+= / Ctrl+- / Ctrl+0 — Zoom terminal + config-editor font (Ctrl+wheel inside the editor)

Inside a session, plain Ctrl+T, Ctrl+F, Ctrl+K and Ctrl+W belong to the device shell (transpose, forward, kill-line, delete-word) — that is why the app uses the Ctrl+Shift versions. The plain ones still work when the focus is outside the terminal.

Working in the terminal#

Copy & paste, selecting, right-click, paste guard, logging, split view, pop-out, tabs, reconnect.

On a Mac

  • Copy / paste: select text, then ⌘C; paste with ⌘V. Ctrl+C always goes to the device (interrupt).
  • Selecting inside full-screen apps (vim, tmux, htop, AI CLIs): when the app uses the mouse a plain drag goes to the app — hold Option while dragging to select text anyway.
  • Keyboard selection: Shift+Arrow, Shift+Home / Shift+End extend a selection from the cursor; Esc clears it (at the normal prompt — full-screen apps keep those keys).
  • Copy an address: ⌘-click an IP address, MAC address, interface name or path in the output to copy it (Settings → Terminal → Smart Links).
  • Open a web address: ⌘-click an http/https link in the output to open it in your browser. A plain click does nothing, so clicking to focus the pane or clear a selection doesn't open a page.
  • Right-click opens a menu: Copy, Paste, Copy & Paste (types the selection at the prompt), Find Selection, Open in Editor (the selection in a new Config Editor tab, in the device's language), Select All, Save Scrollback… (the whole buffer to a text file) and Clear. Esc closes it. Settings → Terminal → Right-Click in Terminal can make it paste straight away (PuTTY) or copy-if-selected-else-paste (Windows Terminal).
  • Paste guard: pasting two or more lines asks first, because every line runs as a command on the device. Change the threshold or turn it off in Settings → Terminal.
  • Logging: click Log in the status bar to record the session to a file (it shows REC while recording). Click again to stop.
  • Drop a file on the window to type its path at the cursor (quoted when needed) — handy for scp, copy or AI CLIs. While the SFTP browser is open a drop uploads instead.
  • Tabs: ⌃Tab / ⌃⇧Tab move between tabs, ⌘1…9 jumps to tab 1–9 — also while typing in a session.
  • Right-click a tab for Duplicate tab, Reconnect, Disconnect, Rename tab (double-clicking the tab works too — only the tab is renamed, not the saved host), Pop out, Close other tabs and Close disconnected tabs.
  • Config mode: GreenCLI reads the device prompt. While a device is in configuration mode — switch(config)#, (host) [mynode] (config) #, Junos user@host# — its tab turns amber with a CONFIG badge and the status bar says Config mode. A tab named only by its IP address shows the hostname from the prompt.
  • Split view (the split button at the right end of the tab strip, next to Snippets and Multi-send): up to four sessions side by side. Click a pane to work in it — its header gets the accent bar, and Close, Find, snippets, logging and file drops all act on that pane. Each pane header has a session picker, an add-pane + and a close × (the session stays open as a tab).
  • Pop-out: the tab’s pop-out button moves a session into its own window. Its header shows the live status, Find, Reconnect when the session drops, and Dock to put it back in its tab.
  • Dropped session: press Enter in the terminal (or click Reconnect) to connect again.
  • Closing a still-connected tab (× or ⌘W) asks first. Turn that off in Settings → Terminal → Confirm Before Closing a Connected Tab.

On non-US keyboards, if Option won’t type | [ ] { } @ \ ~ in the terminal, turn off Settings → Terminal → Option Key as Meta. (Leave it on to use Option+B / Option+F word jumps at the prompt.)

On Windows

  • Copy / paste: select text, then Ctrl+C (or Ctrl+Shift+C / Ctrl+Insert) — with nothing selected, Ctrl+C interrupts as usual. Paste with Ctrl+V, Ctrl+Shift+V or Shift+Insert.
  • Selecting inside full-screen apps (vim, tmux, htop, AI CLIs): when the app uses the mouse a plain drag goes to the app — hold Shift while dragging to select text anyway.
  • Keyboard selection: Shift+Arrow, Shift+Home / Shift+End extend a selection from the cursor; Esc clears it (at the normal prompt — full-screen apps keep those keys).
  • Copy an address: Ctrl-click an IP address, MAC address, interface name or path in the output to copy it (Settings → Terminal → Smart Links).
  • Open a web address: Ctrl-click an http/https link in the output to open it in your browser. A plain click does nothing, so clicking to focus the pane or clear a selection doesn't open a page.
  • Right-click opens a menu: Copy, Paste, Copy & Paste (types the selection at the prompt), Find Selection, Open in Editor (the selection in a new Config Editor tab, in the device's language), Select All, Save Scrollback… (the whole buffer to a text file) and Clear. Esc closes it. Settings → Terminal → Right-Click in Terminal can make it paste straight away (PuTTY) or copy-if-selected-else-paste (Windows Terminal).
  • Paste guard: pasting two or more lines asks first, because every line runs as a command on the device. Change the threshold or turn it off in Settings → Terminal.
  • Logging: click Log in the status bar to record the session to a file (it shows REC while recording). Click again to stop.
  • Drop a file on the window to type its path at the cursor (quoted when needed) — handy for scp, copy or AI CLIs. While the SFTP browser is open a drop uploads instead.
  • Tabs: Ctrl+Tab / Ctrl+Shift+Tab move between tabs, Alt+1…9 jumps to tab 1–9 — also while typing in a session. (Ctrl+digit is left for the device.)
  • Right-click a tab for Duplicate tab, Reconnect, Disconnect, Rename tab (double-clicking the tab works too — only the tab is renamed, not the saved host), Pop out, Close other tabs and Close disconnected tabs.
  • Config mode: GreenCLI reads the device prompt. While a device is in configuration mode — switch(config)#, (host) [mynode] (config) #, Junos user@host# — its tab turns amber with a CONFIG badge and the status bar says Config mode. A tab named only by its IP address shows the hostname from the prompt.
  • Split view (the split button at the right end of the tab strip, next to Snippets and Multi-send): up to four sessions side by side. Click a pane to work in it — its header gets the accent bar, and Close, Find, snippets, logging and file drops all act on that pane. Each pane header has a session picker, an add-pane + and a close × (the session stays open as a tab).
  • Pop-out: the tab’s pop-out button moves a session into its own window. Its header shows the live status, Find, Reconnect when the session drops, and Dock to put it back in its tab.
  • Dropped session: press Enter in the terminal (or click Reconnect) to connect again.
  • Closing a still-connected tab (× or Ctrl+Shift+W) asks first. Turn that off in Settings → Terminal → Confirm Before Closing a Connected Tab.

Troubleshooting#

Common issues and fixes.

  • AI “is Ollama running?” — start it with ollama serve and check the URL in Settings.
  • Local CLI not found — the app adds ~/.local/bin, ~/.cargo/bin, and Homebrew to PATH; install your CLI there.
  • Device REST cert error — verification is on by default; for self-signed lab gear turn Verify device TLS off in Settings → Connections & Security (heed the interception warning).
  • Connected tab but no shell — a restricted account/appliance refused a PTY/shell; this now surfaces as a connect error.
  • “Can’t reach the system password store” — keys saved on this computer are still there. Log in to the desktop (on Linux, start a keyring such as GNOME Keyring), then try again. On a Mac after an update, macOS may ask to let GreenCLI use its Keychain items: enter your login password and choose Always Allow (Allow alone asks again later). If you chose Deny, open Settings or the AI panel again and allow it. If you copied the GreenCLI folder from another computer, the keys aren’t on this one: start a keyring, or quit GreenCLI and delete secret_store.json to keep keys in private files, then enter them again.
  • greencli-mcp says a snapshot has no hidden copy, or it is out of date — open Config Archive (activity bar or command palette) and click Make hidden copies.
  • greencli-mcp says a hidden copy was made by a newer GreenCLI — GreenCLI was updated while Claude Code or Casper kept running the old greencli-mcp. Restart Claude Code or Casper. After you update GreenCLI, restart them so they use the new greencli-mcp.

Made from src/data/helpContent.ts in the GreenCLI repo.