# Commands

> The complete TailMux CLI surface. The core is headless and scriptable — the macOS app drives these same operations.

## Service

- `tailmux init` — Generate a starter config file.
- `tailmux config validate` — Validate the config, including suffix-overlap rejection.
- `tailmux up` — Start the router, PAC listener, and profiles in the foreground.
- `tailmux diag path <url> [--netcheck]` — Full route report: owner, peer visibility, direct vs. DERP, HTTP timing. Runs a tailnet ping, not ICMP.
- `tailmux diag fetch --modes … <url>` — Repeated timing samples across transport modes.

## License

- `tailmux license status` — Show activation status, the updates window, and devices used (e.g. 2/5).
- `tailmux license status -o json` — Machine-readable status for scripts and CI.
- `tailmux license activate <key>` — Activate TailMux and register this machine as a device (counts toward your device limit).
- `tailmux license deactivate` — Remove the key from this machine and free its device slot for another machine.
- `tailmux license purchase` — Open the page to buy a license.

## Profiles

- `tailmux profile list` — List configured profiles and their backends.
- `tailmux profile login <name>` — Authenticate a profile against its tailnet.
- `tailmux profile login --hostname <h>` — Log in with an explicit device hostname.
- `tailmux profile login <profile> --reset` — Reset and re-authenticate a tailscaled compatibility profile. The recommended tsnet backend does not support --reset.
- `tailmux profile logout <name>` — Log a profile out of its tailnet.
- `tailmux profile status <name>` — Show one profile's connection status.
- `tailmux status` — Show router and all profile status.

## Routing

- `tailmux test <host>` — Show which profile owns a hostname.
- `tailmux connect <host> <port>` — Open a raw TCP tunnel through the owning profile.
- `tailmux ssh [ssh args...] <host>` — Open an interactive SSH session routed through the profile that owns the host — wraps your system ssh with the right ProxyCommand.
- `tailmux dns query --profile <p> <host>` — Resolve a name through one selected profile.

## PAC & proxy

- `tailmux pac print` — Print the generated proxy auto-config.
- `tailmux pac serve` — Serve /proxy.pac on the PAC listener.
- `tailmux env` — Print shell proxy exports for the current profiles.

## Access

- `tailmux run <cmd> …` — Run a command with HTTP traffic routed by profile.
- `tailmux tunnel --profile <p> --listen <addr> <target>` — Loopback TCP forward to a profile/IP target (RDP, SMB).
- `tailmux tunnel --listen <addr> <host:port>` — Loopback TCP forward without --profile; the profile is chosen from the target's suffix.

## Publications

- `tailmux publish list` — List publications with their state, who can reach them (REACH: reachable (N), everyone, unreachable, unknown, or - when not listening), and tailnet address.
- `tailmux publish add <name> --profile <p> --target 127.0.0.1:<port> --port <tailnet-port> [--tls]` — Publish a loopback service on one tsnet profile's tailnet.
- `tailmux publish start <name>` — Start a stopped publication.
- `tailmux publish stop <name> | --all` — Close one publication's tailnet listener, or every one. Works without a licence.
- `tailmux publish rm <name>` — Remove a publication from the configuration.
- `tailmux publish policy <name> [-o json]` — Explain who the tailnet policy lets reach a listening publication and, if nobody, print the hosts entry and grant to add once for that profile.

## GUI & TUI

- `tailmux gui serve` — Start the local web GUI and JSON API.
- `tailmux tui --target <url> --watch` — Open the terminal dashboard for profiles and path reports.

---

_Canonical page: https://tailmux.app/docs/commands_