Run one enumerated admin command against a node. node is the home node (its name or key prefix) or a remote repeater (name / hex prefix). Pass dryRun: true to preview the intent without contacting the device. Each command carries a risk tier (surfaced in the result). Commands: Read: • ver [remote] — no params • board [remote] — no params • clock [remote] — no params • neighbors [remote] — no params • get-config [remote] — key: config key to read; prv.key is intentionally excluded (firmware blocks remote read for security)

Benign: • advert [home+remote] — mode: flood (mesh-wide) or zerohop (neighbours only) • sync-time [home+remote] — no params • log-start [remote] — no params • log-stop [remote] — no params • set-time [remote] — epochSecs: absolute time as epoch seconds (firmware rejects backwards clocks) • discover-neighbors [remote] — no params

Config: • set-tx-power [home+remote] — dbm: transmit power in dBm, 1–22 • set-radio [home+remote] — freqMhz: centre frequency in MHz (e.g. 910.525); kHz/Hz also accepted, bwKhz: bandwidth in kHz (sub-GHz: 62.5, 125, 250, 500; 2.4GHz/SX128x goes higher, up to 1000); Hz (62500) also accepted, sf: spreading factor, 5–12, cr: coding rate 5–8 (the 'n' in 4/n); '4/5' also accepted • set-name [home+remote] — name: advertised name, ≤32 bytes • set-location [home+remote] — lat: latitude in degrees, lon: longitude in degrees • set-repeat [remote] — enabled: true to enable packet repeating • set-dutycycle [remote] — percent: duty-cycle limit, 1–100 (percent) • set-path-hash-mode [remote] — mode: path-hash mode 0|1|2 (1-byte/2-byte/3-byte advertised prefixes; 64/32/21 flood cap respectively) • set-loop-detect [remote] — level: loop-detection aggressiveness • set-flood-max [remote] — hops: max flood hop count, 0–64 • set-radio-rxgain [remote] — enabled: true to enable boosted RX gain • tempradio [remote] — freqMhz: centre frequency in MHz (e.g. 910.525); kHz/Hz also accepted, bwKhz: bandwidth in kHz (sub-GHz: 62.5, 125, 250, 500; 2.4GHz/SX128x goes higher, up to 1000); Hz (62500) also accepted, sf: spreading factor, 5–12, cr: coding rate 5–8 (the 'n' in 4/n); '4/5' also accepted, timeoutMins: auto-revert timeout in minutes (≥1) • set-tx-delay [remote] — factor: TX delay factor 0–2 • set-direct-tx-delay [remote] — factor: direct TX delay factor 0–2 • set-rx-delay [remote] — secs: RX processing delay 0–20s • set-airtime-factor [remote] — factor: airtime factor 0–9 • set-interference-threshold [remote] — value: interference threshold (firmware-defined units) • set-agc-reset-interval [remote] — secs: AGC reset interval in seconds; firmware rounds to a multiple of 4 (0 disables) • set-multi-acks [remote] — enabled: true to enable multi-ack support • set-flood-advert-interval [remote] — hours: flood-advert interval in hours, 3–168 • set-advert-interval [remote] — minutes: zero-hop advert interval in minutes, 60–240; firmware stores it as /2 (use even values) • set-owner-info [remote] — text: owner info shown in adverts; '|' in the string becomes a newline • set-adc-multiplier [remote] — value: ADC multiplier 0.0–10.0 (0 = board default) • powersaving [remote] — enabled: true to enable sleep-between-TX power saving • region [remote] — sub: status | save | allowf (region: region name (prefix-matched)) | denyf (region: region name (prefix-matched)) | get (region: region name (prefix-matched)) | home-get | home-set (region: region name to set as home) | default-get | default-set (region: region name to set as default; use '' to clear) | put (name: new region name, parent: optional parent region; defaults to wildcard) | remove (region: region name (exact match)) | list-allowed | list-denied • gps [remote] — sub: status | on | off | sync | setloc | advert-get | advert-set (policy: none | share | prefs) • sensor [remote] — sub: get (key: sensor setting key to read) | set (key: sensor setting key to write, value: new value (string-typed; firmware parses per setting)) | list (startIndex: optional pagination start index (134-char chunks))

Sensitive (writes secrets / grants access): • set-admin-password [remote] — password: new admin password, ≤15 chars • set-permission [remote] — pubKey: hex public key, level: guest|read|readwrite|admin, or null to revoke (downgrade to guest — the firmware has no explicit removal, only a level-0 demotion) • set-allow-read-only [remote] — enabled: true to enable read-only mode • set-guest-password [remote] — password: new guest password, ≤15 chars

Destructive (data/identity loss or reboot): • reboot [home+remote] — no params • log-erase [remote] — no params • clear-stats [remote] — no params • remove-neighbor [remote] — pubKeyPrefix: hex public-key prefix • set-private-key [remote] — hex: new private key as 64 hex chars (32 bytes) • start-ota [remote] — no params • clkreboot [remote] — no params

Send an advert from a node — home or remote. mode selects between flood (mesh-wide) and zerohop (immediate neighbours only). Omit node to target home. Equivalent to admin <node> advert { mode }. Costs airtime; flood propagates mesh-wide.

Remove a channel slot on the connected node, addressed by index or by name. List channels via the meshcore://channels resource.

Broadcast a node-discovery request from a remote repeater. Replies populate its neighbour list — read it back with get_node_neighbors(node). Equivalent to admin <node> discover-neighbors. Required node.

Return the advert-packet bytes (hex) for a contact, suitable for another node's import_contact. Omit target to export the home node's own advert (useful for sharing identity off-mesh).

Remove the server's stored login password for node. Subsequent admin / remote get_node_health calls fall back to the env default credential (the guest password, unless MESHCORE_LOGIN_PASSWORD / MESHCORE_NODE_PASSWORDS is set). removed is false when no entry existed — the end state is the same either way. Marked destructive: the stored password is gone after this call.

Read a remote repeater's hardware board / model identifier. Equivalent to admin <node> board. Required node. For the home node, use get_node_health() (the firmware.manufacturerModel field) — that's the structured equivalent via the companion protocol, no admin call needed.

Read a remote repeater's current device clock (HH:MM - D/M/Y UTC). Equivalent to admin <node> clock. Required node. For the home node, use get_node_health() (the deviceTimeMs field) — that's the structured equivalent via the companion protocol, no admin call needed.

Read one of a remote repeater's configuration values by key (e.g. tx, radio, name, freq, flood.max, path.hash.mode). Equivalent to admin <node> get-config { key }. Required node. The reply is a single line of text the agent parses. For the home node's radio / identity config, use get_node_health() (structured fields cover the common ones — radio, firmware, location, autoAddContacts).

Consolidated health snapshot for a node: identity, radio, battery, uptime/queue, and packet/radio stats. Omit node for the connected home node; pass a contact name or hex public-key prefix for a remote repeater (logs in and reads its status).

List a remote repeater's recent neighbours (up to 8), each as {pk-prefix}:{ts}:{snr*4} in the reply text. The H15 topology data source. Equivalent to admin <node> neighbors. Required node. Pairs with discover_neighbors(node) to trigger an active probe first.

Read a remote repeater's firmware version + build date string. Equivalent to admin <node> ver. Required node — only repeater firmware implements the ver CLI verb. For the home node, use get_node_health() (the firmware field) — that's the structured equivalent via the companion protocol, no admin call needed.

Recent live mesh traffic from the rolling buffer, oldest→newest, each tagged with structural provenance (kind + decrypt-verified). Optional since windows it — prefer a relative duration ("10m", "1h", "30s"), which is the portable form; an ISO-8601 datetime or epoch-ms also work but are wall-clock instants. Omit for all buffered traffic.

Add a contact to the local node's roster from its advert-packet bytes (hex). Typically obtained from another node's export_contact, a QR scan, or another out-of-band channel. The contact appears in survey_mesh and the meshcore://contacts resource after this.

Reboot a node — the home companion or a remote repeater. Omit node to target home. Equivalent to admin <node> reboot; this top-level form carries the destructive-tier annotations directly. ⚠ The node is unreachable for ~30–60s while it restarts; any session ends.

Drop a contact from the local node's roster. Local-only — does not tell any other node. The contact may reappear if its advert is heard again under auto-add mode; combine with set_auto_add_contacts { autoAdd: false } for a sticky removal.

Clear the local cached forwarding path to a contact. The next direct send to that contact re-discovers the route. Useful when a known path has gone stale (a repeater rebooted, topology changed) and direct sends are failing or taking longer than expected.

Transmit a text message. target is a contact (name or hex public-key prefix) or a channel (#name, #index, or a bare channel index). A resend is a second transmission — not idempotent. Set confirm: true to wait for the delivery ack and report whether it arrived + the round-trip time. Confirmation applies to direct (contact) messages only: a channel/broadcast has no single recipient to ack, so a confirm: true channel send returns confirmationNotApplicable: true (and no delivered) rather than silently ignoring the request.

Set whether new contacts heard via adverts are added to the local roster automatically (autoAdd: true, the companion default) or only when explicitly imported (autoAdd: false). Manual mode pairs well with remove_contact for a curated contact list.

Configure a channel slot on the connected node. Omit secret to generate a random private channel; omit index to use the next free slot (so a plain add won't overwrite an existing channel). Returns the channel's key so you can share it. List channels via the meshcore://channels resource.

Set an explicit forwarding path (a sequence of repeater path-hash bytes, up to 64) to a contact. Advanced: only when you want to override automatic path discovery. Pass pathHex: "" to mark the contact as direct (no repeaters). Pair with trace_path to discover a working path first.

Persist the password the server will use to log into node for subsequent admin and remote get_node_health calls. Use this when you've learned a repeater's password out of band (e.g. via DM) and need the server to remember it across restarts. This is the server's local credential, not the node's password — it does not send anything over the mesh. The node must already be known (in the contact list) — a typo'd name is rejected so credentials don't silently land under a key that's never looked up. Overwrites any existing entry. The password (max 256 chars) is stored in the credentials file under MESHCORE_STATE_DIR with 0600 permissions, and is never echoed in the tool result. The password is opaque to the server: the device unlocks guest (read-only) or admin (full) depending on which it matches — store the admin password when you have it, since it covers reads too. If a later admin command comes back with ERR: in reply, the stored credential is likely guest-tier; overwrite via set_credential if you have the admin password. Separate from the set-admin-password admin command (which changes the node's own password).

Set a node's advertised lat/lon (decimal degrees). Omit node to target home. Equivalent to admin <node> set-location { lat, lon }.

Rename a node's advertised mesh name. Omit node to target home. Equivalent to admin <node> set-name { name }. Max 32 bytes (24 if a location is set).

Set frequency (MHz), bandwidth (kHz), spreading factor, and coding rate on a node. Omit node to target home. Equivalent to admin <node> set-radio { freqMhz, bwKhz, sf, cr }. ⚠ Applies after a reboot; if the new params no longer match the rest of the mesh, the node drops off the network.

Set the radio transmit power in dBm on a node. Omit node to target home. Equivalent to admin <node> set-tx-power { dbm }. ⚠ Confirm the value is legal for your band/region; some boards add a PA stage on top of the configured dBm.

Broadcast a contact's advert across the mesh. Other nodes that receive the advert can route to this contact without having heard its own transmissions. Costs airtime.

List the home node and every known contact, with each contact's advertised role and last-heard time — a roster for spotting quiet or missing nodes.

Set a node's clock to the controller's current time. Omit node to target home. Equivalent to admin <node> sync-time. No-op if already in sync. For an explicit epoch on a remote repeater, use admin <node> set-time { epochSecs } instead.

Trace a route through the mesh and report each repeater hop's SNR. Give an explicit path of repeater hops (comma-separated hex bytes, e.g. "23,5f,3a") or a node (a contact name / hex prefix) to trace along its known out-path. A path that doesn't respond returns a timeout.