The Pantech CLI

pantech drives your organization from the terminal, through the public API. It runs on macOS (Apple silicon and Intel) and Linux (x86-64 and arm64).

#Install

$ curl -fsSL https://pantechdynamics.com/install | bash✓  Installed pantech v0.1.5 to ~/.pantech/bin/pantech

The script downloads the build for your machine, checks it against the release's checksums, installs it in ~/.pantech/bin and adds that to your PATH. Open a new terminal, or run the export line it prints, then check it worked:

$ pantech --versionpantech v0.1.5

To install a particular version, pass it to the script: curl -fsSL https://pantechdynamics.com/install | bash -s -- v0.1.5.

#Sign in

$ pantech auth loginOpened your browser to approve the CLI.Waiting for approval…✓  Signed in to Acme (read, write), profile "default".

Your browser opens the console's Sign in the CLI page. Choose the access, Read and write or Read only, and when the key expires, then press Approve. The console creates an API key for the CLI, named after your machine, like CLI on mac-mini, and hands it to the CLI directly: it is never shown on screen. The tab then says you're signed in, and you can close it.

If the CLI can't open a browser, such as over SSH, pantech auth login --no-browser prints the link to open on another device instead.

As with any API key:

• You need to be an owner or admin of the organization.
• Two-factor authentication must be on for your account.
• You can revoke it any time under Organization → API keys.

The key is kept in your system's keychain: the macOS Keychain, or the Secret Service on Linux. On a machine without one, such as a server, it goes in ~/.config/pantech/credentials.json, readable only by you.

pantech auth status shows which organization and key the CLI is using. pantech auth logout forgets the key on this machine, then revokes it, so it stops working everywhere straight away. To forget it here but keep the key working until it expires, pass --keep-key. A key in PANTECH_API_KEY is never revoked: unset it yourself.

#Without a browser

On a server or in CI, create a key in the console and give it to the CLI instead:

$ pantech auth login --with-token < key.txt

Or store nothing, and set the key in the environment. It takes precedence over a stored key:

$ export PANTECH_API_KEY=PAN_…$ pantech vm list

#Create your first machine

Find a plan and an image, add your SSH key, then create the machine:

$ pantech plans$ pantech images$ pantech ssh-keys add ~/.ssh/id_ed25519.pub✓  Added me@laptop (sshk_…).$ pantech vm create --name web-1 --plan starter --image ubuntu-24-04 --ssh-key me@laptopCreate web-1 (starter, ubuntu-24-04) for about NGN 17,000.00 a month? [y/N] y  ✓ Ordered web-1                 NGN 15,040.00  ✓ Payment taken                 2s  ✓ Provisioned                   1:12web-1 is ready at 102.211.122.80Connect: pantech vm ssh web-1$ pantech vm ssh web-1

The first payment is taken from your credit, or else your organization's default card. Images have no password login, so --ssh-key is required: it is how you log in. If you don't have a key, pantech ssh-keys add --name deploy > deploy_key generates a pair, registers the public half, and prints the private half once: save it, because it is never shown again.

To place the machine in a VPC subnet instead of giving it its own public address, pass --subnet. A standard machine gets your default security group unless you pass --security-group. --tags env=prod,team=web labels it.

#SSH access

Port 22 is closed by default. pantech vm ssh asks the platform to open it to your address for 15 minutes, waits until it is open, then connects with your own ssh and keys. The port closes again after the 15 minutes; pass --revoke to close it as soon as your session ends, even if you end it with Ctrl+C.

If the platform won't open access (the machine shares its security group with another, or your key is read-only), the CLI says why and connects to the machine's address directly. That works if the security group already allows port 22 from you.

It logs in as the image's usual user (ubuntu, debian or rocky, otherwise root). Pass --user to choose another, and anything after -- goes to ssh:

$ pantech vm ssh web-1 --revoke$ pantech vm ssh web-1 -- -i ~/.ssh/deploy -L 8080:localhost:80

#Commands

Resources, subnets included, can be named by their name or their id. Most commands answer to shorter names too: pantech vm is also pantech instances, networks is vpc, security-groups is sg, public-ips is ips, load-balancers is lb, kubernetes is k8s, volumes is vol, list is ls, get is show and delete is rm. Every command explains itself with --help.

Changes like stop and delete are asynchronous: the CLI waits for them to finish and shows how they went. Pass --no-wait to get the operation's id straight away instead.

#Networks, IPs and firewalls

A machine in a VPC has no public address of its own: create a network and a subnet, create the machine in the subnet, then point a public IP at it:

$ pantech networks create --name prod --cidr 10.0.0.0/16$ pantech networks subnets create prod --name web --cidr 10.0.1.0/24$ pantech networks subnets list prod$ pantech vm create --name web-1 --plan starter --image ubuntu-24-04 --ssh-key deploy --subnet web$ pantech public-ips create --network prod --vm web-1

A standard machine is protected by its security group instead. A rule is written DIRECTION:PROTOCOL:PORTS:CIDR, with no ports for icmp and all. rules add and rules remove change some rules and keep the rest; a rule to remove must match one exactly, as pantech security-groups get lists it. rules set replaces every rule the group has, so list them all:

$ pantech security-groups create --name web --rule ingress:tcp:80:0.0.0.0/0 --rule ingress:tcp:443:0.0.0.0/0$ pantech security-groups rules add web --rule ingress:tcp:22:203.0.113.4/32$ pantech security-groups rules remove web --rule ingress:tcp:80:0.0.0.0/0$ pantech security-groups rules set web --rule ingress:tcp:443:0.0.0.0/0 --rule ingress:tcp:8000-8100:203.0.113.4/32

add and remove read the rules and write them back, so run one change to a group at a time.

#Static IPs

A static IP that points at one machine can move. attach points it at another machine in its VPC, keeping the same address; detach takes it off its machine and keeps it yours. create without --vm reserves one detached, to attach later:

$ pantech public-ips create --network prod$ pantech public-ips attach 102.211.122.80 --vm web-2$ pantech public-ips detach 102.211.122.80$ pantech public-ips list

Name an address by its IP or its id. list shows detached for an address held without a machine, and (applying) while a change has not reached it yet. A held address is billed whether it is attached or not; see static IPs. A machine a static IP points at cannot be deleted: detach the address, or delete it, first.

#Load balancers

A load balancer needs a static IP reserved for load balancing. Name the subnet by its id:

$ pantech public-ips create --network prod --purpose load_balancer$ pantech load-balancers create --name web --public-ip 102.211.122.91 --subnet snet_… \    --port 443 --private-port 8443 --algorithm leastconn --target web-1,web-2$ pantech load-balancers update web --targets web-1,web-2,web-3$ pantech load-balancers list# In a standard zone, an appliance load balancer brings its own address:$ pantech load-balancers create --name app --zone af-abj-1 --port 80 --target web-1,web-2

--allow limits which source ranges may connect (anywhere if you leave it out). update changes the name, --algorithm or the targets; --targets is the whole new set, and --no-targets removes them all. The address, subnet, ports and allowed ranges are fixed: to change them, create a new load balancer and delete the old one.

#Volumes and snapshots

$ pantech api GET /disk-offerings$ pantech volumes create --name data --offering small-5gb --vm web-1 --mount-point /data$ pantech snapshots create --volume data --name nightly$ pantech snapshots create --vm web-1 --name before-upgrade

A custom-size offering also needs --size, in GB. A volume attaches only to a running machine in its zone.

#Anything else

For what the CLI has no command for yet (usage, snapshot schedules, firewall and port forwarding rules, and disk offerings), pantech api calls the API with your key and prints the answer. --data takes JSON, @file or @- for stdin, and -f adds a query parameter:

$ pantech api GET /usage/by-resource -f period=month$ pantech api POST /networks --data '{"name": "prod", "cidr": "10.0.0.0/16"}'

#Databases

pantech db manages managed databases:

$ pantech db engines$ pantech db create --name orders-db --engine postgresql --version 18 --plan starter \    --zone af-abj-2 --subnet web --storage-gb 100$ pantech db storage resize orders-db --storage-gb 200$ pantech db snapshots create orders-db --name before-migration$ pantech db snapshots list orders-db

--storage-gb sets the data disk's size at create: the plan's own size if you leave it out, otherwise a multiple of 10 GB up to 2,000 (today's limits). db storage resize grows it later without a restart. pantech db engines shows each zone's limits and price per GB, and both commands check the size against them before asking you anything, so a size the zone does not allow, or one that is not larger, is refused straight away. See storage and snapshots.

In af-abj-1, a standard VPS reaches a database through a private interface. Narrow its security group first (no inbound rule may cover 10.250.0.0/20, ICMP included; pantech regions shows each zone's range under PRIVATE NETWORK), then:

$ pantech vm private-network attach web-1$ pantech db access-rules add orders-db 10.250.4.23/32

attach prints the VPS's new address and the command to allow it. access-rules add and remove change some ranges and keep the rest; access-rules set replaces the whole list. Connect a standard VPS to a database has every step, including the netplan file.

--admin-username names the admin login (dbadmin if you leave it out): 3 to 32 lowercase letters, digits or underscores, starting with a letter, and not a reserved name. The CLI checks it before sending.

A database password never goes on the command line. Without --password-stdin, one is generated and printed once, alone on stdout: save it there and then. With --password-stdin, the CLI reads the one you choose from a hidden prompt or a pipe. pantech db password reset prints a new one the same way.

#Kubernetes

pantech kubernetes, or pantech k8s, manages managed Kubernetes clusters:

$ pantech kubernetes versions --zone af-abj-2$ pantech kubernetes create --name prod --zone af-abj-2 --version 1.31.2 \    --subnet snet_… --node-plan s-2vcpu-4gb --workers 2 --api-allow 203.0.113.0/24$ pantech kubernetes kubeconfig prod -o ~/.kube/prod.yaml$ KUBECONFIG=~/.kube/prod.yaml kubectl get nodes$ pantech kubernetes configure prod --autoscale 2:5$ pantech kubernetes upgrade prod --version 1.32.0$ pantech kubernetes apply prod -f app.yaml$ pantech kubernetes workloads prod$ pantech kubernetes expose prod web --port 80

Give create a fixed --workers count, or --autoscale MIN:MAX for the autoscaler to manage. --control-nodes 3 asks for a highly available control plane where the zone offers it. Every node is billed as a machine of --node-plan, so create, and configure when it adds workers, ask first.

configure takes --workers N, --autoscale MIN:MAX or --no-autoscale, and --api-allow with the whole new list of ranges, or --api-allow-any to let any address reach the API server again. Limiting API server access works in a VPC zone only.

A kubeconfig grants cluster-admin: treat it like a password. kubeconfig writes it to the file you give with -o, readable only by you, or to stdout only if you pass --stdout; without either it refuses.

#AI apps

pantech mcp sets up an AI app to use Pantech's MCP server. It writes the app's config file for you, keeps any other servers in it, and saves the old file as <file>.bak.

$ pantech mcp install cursor$ pantech mcp install claude-code --local$ pantech mcp install vscode --print$ pantech mcp list-clients$ pantech mcp status

• install <client> takes claude-code, claude, cursor, vscode, windsurf, codex, gemini, chatgpt or grok. For Claude Code and Gemini CLI it runs their own mcp add command when they are installed. For claude it prints the connector steps, or with --local writes Claude Desktop's claude_desktop_config.json. For chatgpt and grok it prints instructions only, and they take no --local.
• It connects to the hosted server, https://mcp.pantechdynamics.com/mcp, by default; --url uses another. The app asks you to approve it in the browser the first time.
• --local runs pantech-mcp stdio on your machine instead, which uses the key you signed in with. The config gets the full path to pantech-mcp, so apps started outside your shell find it. If pantech-mcp is not on your PATH, it warns you.
• --print shows the config and changes nothing.
• list-clients lists the ids. status shows the hosted URL, whether pantech-mcp is installed, and which apps already have Pantech.

#Scripts and CI

Every command takes:

• --json: print the API's own JSON instead of a table.
• --quiet: print only ids, one per line.
• --yes: don't ask before deleting something or spending money. Without a terminal to ask in, the CLI refuses to do either unless you pass it.

$ pantech vm list --quiet | xargs -n1 pantech vm stop --yes

Every change carries an Idempotency-Key, and the CLI retries network errors, rate limits and server errors with the same one, so a retried change never happens twice.

The exit code says how a command ended:

pantech vm ssh exits with ssh's own code, and a command you stop with Ctrl+C exits with 130.

#More than one organization

Profiles keep separate sign-ins. Sign in to each under a name, then pick one per command with --profile, or for a whole session with PANTECH_PROFILE:

$ pantech --profile acme auth login$ pantech --profile acme vm list

#Update and uninstall

To update, run pantech upgrade. It downloads the latest version, checks it against the release's checksums, and installs it in place of the one you have. Pass a version to install that one instead, or --check to only see what the latest is:

$ pantech upgrade$ pantech upgrade --check$ pantech upgrade v0.1.5

At most once a day, the CLI also says when a newer version is out. It stays quiet with --json or --quiet, in CI, and when its output is not a terminal; set PANTECH_NO_UPDATE_NOTIFIER=1 to turn it off. Versions before v0.1.5 have no upgrade: run the install command again instead.

To uninstall, sign out first, which revokes the key and removes it from your keychain, then remove the CLI and its settings:

$ pantech auth logout$ rm -rf ~/.pantech ~/.config/pantech

Then delete the # Pantech CLI lines the installer added to your shell's startup file (~/.zshrc, ~/.bash_profile, ~/.bashrc or fish's config.fish).