Internal admin CLIs

The cli package for flags and subcommands, one binary to scp, and mock mode for dry-run paths that still execute real validation logic.

The problem

Every company accumulates bash scripts that wrap curl and jq. They break when someone upgrades macOS, they have no tests, and the dangerous ones - "run this against prod" - have no guard rails beyond a comment.

Why Ecko

cli package: Typed flags, options, positionals, and generated usage text. Pure - no capabilities - so parsing never touches the network by surprise.
Single artefact: Build once, copy to the bastion. No "install Python 3.11 first" step in the runbook.
Dry-run in mock mode: A --dry-run path can call ai without a key and still produce schema-valid output, so operators see the shape of the change before spending tokens.

In practice

admin.ecko

import cli

spec = cli.parser("acme-admin", "internal ops")
spec = cli.flag(spec, "dry-run", "mock AI, no writes")
spec = cli.arg(spec, "tenant_id")

Related cases

MCP servers for internal systems The mcp package does client and server, and the capability model is exactly what you want when exposing internal tools to an agent.

All 9 use cases →

Try it on your workload.

Install Ecko Open the playground