The mz CLI

MZPanel is dashboard-first, but every server also ships a command-line front-end: mz. SSH into a box and you can drive it directly — mz site list, mz php list, mz cron add … — the same way the dashboard does. This is the “power-user” half of MZPanel’s two operating modes: click in the panel, or type on the box.

What mz is

mz is a symlink to the mzagent binary. Invoked as mz, it routes your arguments straight into the same native Go engine the web panel uses — no separate implementation, no Bash. That has one big consequence:

Coverage equals the panel, by construction

Because mz reuses the panel’s exact command dispatch, it reaches everything the panel can do — 306 commands across 46 domains. New features appear in mz automatically the moment they ship in the panel. There is no “CLI feature gap.”

Run mz --help to list the live domains and read commands, generated from the engine itself.

The invocation contract

A few rules make mz predictable — the same ones the panel follows internally:

• Always pass a sub-action. mz php errors; mz php list works. Every domain needs a verb.
• Output is JSON. Most commands accept --json (the panel always passes it); parse stdout as JSON. Streaming commands (deploys, cron run, updates) instead emit plain log lines followed by an exit code.
• It runs as root, with local trust. On the box there is no license-tier check, no per-action RBAC, and no audit log on the local path — unlike the panel. Treat mz as “you already have root on this machine.”

mz site list --json
mz php list --json
mz cron add --schedule "0 3 * * *" --command "…" --user www-data
mz cron run <id>            # streams output, then exits with the job's code

For AI agents

mz was revived largely for AI: the on-box ClaudeCode assistant calls mz <domain> <action> --json as its native toolset, and the MCP surface exposes the same operations. An on-box agent should read mz --help, then the command catalog, and prefer --json for every call. See For AI agents for the machine-readable entry points (llms.txt, MCP).

Known limits

• Offsite backups and shared-cert install need sealed credentials that the panel injects over the WebSocket link. A bare local mz doesn’t have them — drive those from the dashboard, or export the credentials into the environment first. Local backups (mz backup full|db|all) work standalone.
• A few actions are panel-deferred stubs and not yet native anywhere (e.g. waf install) — they’ll surface as mz commands when they ship.
• Human pretty-printing was dropped — always pass --json.

Related

• mz command catalog — every command, by domain.
• Agent binary (mzagent) — the daemon side of the same binary.
• Architecture — the two operating modes.