# cs tie (/docs/cli/tie) `cs tie` makes the machine you run it on a CoreSpeed connection. A small daemon, `tied`, holds one outbound link to CoreSpeed and serves the machine's tools; they appear on `/mcp` as `device____` for you, and for your organization once you share the device from the dashboard. Every call passes the same approval gate as any other write. Tie is in preview and is turned on per organization. ## Usage \[#usage] ```bash cs tie [--slug ] [--name ] [--pair-again] cs tie status [--json] cs tie pause cs tie resume cs tie provider > on|off [--root ]… cs tie mcp add [--env KEY=VALUE]… [--cwd ] -- [args…] cs tie mcp remove cs untie [--forget] ``` ## Tie this machine \[#tie-this-machine] ```bash cs login cs tie --name "Hao's MacBook" ``` ```text title="Output" Tied this machine as Hao's MacBook (hao-s-macbook). device dev_0199a8c4e1f27b3c9d4e5f60718293a4, private to you credential stored in the macOS login Keychain settings ~/.config/cs/tie.json Every provider is off, so the device publishes no tools yet. Turn one on, e.g. `cs tie provider shell on --root ~/code`. tied started (pid 48213); log: ~/.config/cs/tied.log ``` `cs tie` registers the machine with your signed-in session, stores the device's credential, writes the device into `~/.config/cs/tie.json`, and starts `tied`. The credential opens this device's link and nothing else; it is kept in the macOS Keychain, the Linux Secret Service, or, where neither exists, a file only you can read. When `tied` is not installed, the command says how to get it: ```bash npm i -g @corespeed/tied && tied serve --background # or, without installing npx @corespeed/tied serve --background ``` ### --name \[#--name] The display name agents and teammates see. Defaults to the machine's host name. ### --slug \[#--slug] The device's segment in tool names, unique in your organization: lowercase letters, digits and hyphens, at most 32. Derived from the name when omitted. ### --pair-again \[#--pair-again] On a machine that is already tied, issue a new credential. The old one stops working at once, and a link opened with it is closed. Use it when the credential on this machine was lost, or may have been copied. Run on a tied machine without `--pair-again`, `cs tie` reports the device and makes sure `tied` is running. If the device was revoked from the dashboard, `cs tie` ties the machine again as a new device. ## Choose what it shares \[#choose-what-it-shares] Every provider starts off; a provider that is off publishes nothing, and no setting in the cloud can turn it on. ```bash cs tie provider shell on --root ~/code --root ~/notes cs tie provider shell off ``` * `shell` — run commands and read, write and search files. File tools stay inside the `--root` directories (each `--root` is added to the list); commands start in one. The device's deny list refuses common destructive commands, but a command runs as you and can reach whatever your account can. * `browser`, `screen` — reserved for the browser and screen providers. * `mcp:` — an MCP server added with `cs tie mcp add`. `cs tie mcp add` hosts a local stdio MCP server; its tools are published as `_`. Everything after `--` is the command that starts it. ```bash cs tie mcp add resolve --env RESOLVE_HOME=/opt/resolve -- npx -y resolve-mcp cs tie mcp remove resolve ``` Each change is written to `tie.json` and applied by `tied` at once; the command prints the provider's state as `tied` reports it. ## status \[#status] ```bash cs tie status ``` ```text title="Output" device Hao's MacBook (hao-s-macbook) · dev_0199a8c4… → https://api.corespeed.io CoreSpeed connected · private · 9 tools · linked now tied 0.1.0 · pid 48213 · link connected since 2026-10-06T09:14:02.511Z shell ready 9 tools browser disabled 0 tools screen disabled 0 tools ``` The first two lines are CoreSpeed's view of the device, the rest is the daemon on this machine. `--json` prints both as one document. ## pause and resume \[#pause-and-resume] ```bash cs tie pause cs tie resume ``` A paused device refuses every call before it runs, with `paused_by_owner`. The pause is set on CoreSpeed and on this machine; if CoreSpeed cannot be reached, the machine's pause still holds. ## untie \[#untie] ```bash cs untie ``` Revokes the device on CoreSpeed, deletes its credential from this machine and stops `tied`. Your provider settings stay in `tie.json` for the next `cs tie`. When CoreSpeed cannot be asked about the device — its credential here is gone and your session is in another organization than the device — `cs untie` stops and says so instead of guessing. `cs switch` to the device's organization and run it again, or `cs untie --forget` to remove the device from this machine only; revoke it from the dashboard then. ## Signed in to another environment \[#signed-in-to-another-environment] The device lives on the CoreSpeed it was tied to (`origin` in `tie.json`). `status`, `pause`, `resume` and `untie` use the device's own credential and work whichever organization `cs` is signed in to. Registering and `--pair-again` use your session, which must be for that same CoreSpeed.