Agent binary (mzagent)

The on-VPS component is mzagent, a single static Go binary. It connects back to the control plane over WebSocket and runs all operations natively (its own embedded Go engine).

No mz site CLI

The old Bash mz CLI is gone — it was removed from servers when the engine moved to native Go (docs/72). There is no mz site create and no customer-facing management CLI anymore. Day-to-day operations are done from the dashboard (and, on the Max plan, the API). mzagent is a low-level / diagnostic binary, not a tool you drive by hand for routine work.

How it’s installed and run

mzagent is placed by the install one-liner (see Getting started) and runs as a systemd service, mzagent.service. You don’t normally invoke it directly:

# Service status / logs
systemctl status mzagent
journalctl -u mzagent -f

The agent’s config (server ID and long-lived agent token) lives at /etc/mzagent/config.json (mode 0600, root-owned). The on-VPS registry — the source of truth for sites, jobs, and other on-box state — lives under /etc/mz and is read and written by the agent’s native engine.

Subcommands

mzagent exposes a small set of operational subcommands. The ones you might touch are below; the rest are used internally by the daemon and by on-box self-heal jobs.

Subcommand	Purpose
mzagent register	Exchange a one-time install token for a long-lived agent token and write the config. Run by the install one-liner.
mzagent run	Start the daemon loop: dial WSS, send hello, then heartbeat. This is what mzagent.service runs.
mzagent self-update	Download, verify (SHA256 + signature), and atomically swap the running binary, then optionally restart. The manual counterpart to the control-plane-commanded update.
mzagent version	Print version and build info.

mzagent version
mzagent self-update --url <https-asset> --sha256 <hex> --restart

Note

Updates are normally pushed and staged automatically by the control plane (signed releases, canary → 100%). self-update is for ops / manual rollout. See docs/74.

The binary also has a couple of internal entrypoints — mzagent engine <kind> (print an inventory collector’s JSON for debugging) and mzagent x … / mzagent cron-exec … (used by the box’s own cron/systemd self-heal jobs so they keep running even if the control plane is unreachable). These are implementation details, not a user-facing CLI surface.

See also

• Architecture — the dial-out connection model.
• Security model — agent tokens and the three auth layers.
• Control plane API — the programmatic surface (Max plan).