| name | nerdio |
| description | The first non-PowerShell client for the Nerdio Manager for MSP API - cross-account AVD fleet audits, async-job plumbing, and offline search no other Nerdio tool has. Trigger phrases: `list nerdio accounts`, `audit autoscale across customers`, `which AVD hosts are running`, `nerdio billing rollup`, `wait for nerdio job`, `use nerdio`, `run nerdio-cli`. |
| author | Damien Stevens |
| license | Apache-2.0 |
| vendor | Nerdio Manager |
| argument-hint | <command> [args] | install cli|mcp |
| allowed-tools | Read Bash |
| metadata | {"openclaw":{"requires":{"bins":["nerdio-cli"]},"install":[{"kind":"go","bins":["nerdio-cli"],"module":"github.com/mvanhorn/printing-press-library/library/cloud/nerdio/cmd/nerdio-cli"}]}} |
Nerdio Manager - Printing Press CLI
Prerequisites: Install the CLI
This skill drives the nerdio-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:
- Install via the Printing Press installer. It defaults binaries to
$HOME/.local/bin on macOS/Linux and %LOCALAPPDATA%\Programs\PrintingPress\bin on Windows:
npx -y @mvanhorn/printing-press-library install nerdio --cli-only
- Verify:
nerdio-cli --version
- Ensure the reported install directory is on
$PATH for the agent/runtime that will invoke this skill.
If the npx install fails (no Node, offline, etc.), fall back to a direct Go install (requires Go 1.26.4 or newer). This installs into $GOPATH/bin (default $HOME/go/bin), so add that directory to $PATH instead:
go install github.com/mvanhorn/printing-press-library/library/cloud/nerdio/cmd/nerdio-cli@latest
If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.
Manage Azure Virtual Desktop fleets across every customer account from one terminal: audit autoscale posture fleet-wide with fleet autoscale-audit, sweep session-host power state with fleet host-estate, reconcile billing with fleet billing-rollup, and tame NMM's async job model with job wait. Includes a local SQLite store with full-text search over accounts, profiles, and scripted actions - the only offline Nerdio client in existence.
When to Use This CLI
Reach for this CLI when operating Azure Virtual Desktop estates through Nerdio Manager for MSP: listing customer accounts, auditing or changing host-pool autoscale, power-cycling session hosts, exporting invoices and usage for PSA reconciliation, executing scripted actions across accounts, and polling NMM's async jobs. It is the right tool for cross-account fleet questions ('which pools have autoscale off', 'what hosts are running', 'who spiked usage') that the web UI only answers one account at a time.
Anti-triggers
Do not use this CLI for:
- Do not use this CLI for Nerdio Manager for Enterprise (NME) - that product has a different API surface and help site
- Do not use this CLI for the Nerdio Distributor API (install registration/billing for distributors) - different auth and base path
- Do not use secure-variables list output in logs or shared context - values are stored secrets
- Do not use this CLI to create Entra ID app registrations or assign Azure roles - do that in the Azure portal first
Unique Capabilities
These capabilities aren't available in any other tool for this API.
Async job plumbing
-
job wait - Wait for any NMM async job to finish - polls until Completed/Failed/Cancelled and exits with a typed code reflecting the outcome.
Run this after any mutation (provisioning, scripted actions, backup) instead of hand-writing a polling loop.
nerdio-cli job wait 4821 --interval 10s --timeout 30m --agent
Cross-account fleet ops
-
fleet autoscale-audit - See every host pool across all customer accounts whose autoscale is disabled or diverges from your baseline - the Monday cost-control sweep as one command.
Use this for cross-customer autoscale posture instead of scripting foreach loops over per-account API calls.
nerdio-cli fleet autoscale-audit --accounts 101,102 --agent
-
fleet host-estate - One table of every session host across all customer accounts with pool, account, and power state - the weekend power-sweep view.
Use this to answer 'what is running right now across all customers' in one call.
nerdio-cli fleet host-estate --running-only --agent --select items.account,items.host,items.power_state
-
scripted-actions fan-run - Execute one scripted action across many customer accounts, collect every returned job ID, and optionally wait for all of them to finish.
Use this to push one operation fleet-wide instead of hand-looping account IDs in PowerShell.
nerdio-cli scripted-actions fan-run 42 --accounts 101,102,103 --wait
Billing intelligence
-
fleet billing-rollup - Per-account billed/paid/unpaid/usage rollup for a billing period, joined to account names - PSA-reconciliation-ready without Excel.
Use this for the weekly unpaid-invoice check and month-end reconciliation export.
nerdio-cli fleet billing-rollup --period 2026-05-01:2026-05-31 --unpaid-only --agent
-
usages drift - Flag customer accounts whose consumption grew or shrank beyond a threshold between two periods.
Use this before invoicing to catch consumption surprises early.
nerdio-cli usages drift --from 2026-04-01:2026-04-30 --to 2026-05-01:2026-05-31 --min-pct 20 --agent
Command Reference
accounts - MSP customer accounts managed by this NMM installation
nerdio-cli accounts - List all customer accounts
app-roles - NMM application roles and assignments
nerdio-cli app-roles assignments - List app role assignmentsnerdio-cli app-roles roles - List available app roles
autoscale-profiles - Reusable autoscale profiles
nerdio-cli autoscale-profiles account-get - Get an account autoscale profilenerdio-cli autoscale-profiles account-list - List autoscale profiles for an accountnerdio-cli autoscale-profiles get - Get an MSP-level autoscale profilenerdio-cli autoscale-profiles list - List MSP-level autoscale profiles
backup - Azure Backup operations for a customer account
nerdio-cli backup disable - Disable backup for a protected itemnerdio-cli backup enable - Enable backup for a resource with a policynerdio-cli backup protected-items - List protected items for an accountnerdio-cli backup recovery-points - List recovery points for a protected itemnerdio-cli backup restore - Restore a protected item from a recovery pointnerdio-cli backup run - Trigger an on-demand backup of a protected item
cost-estimator - Azure cost estimates built in NMM
nerdio-cli cost-estimator get - Get a cost estimate by IDnerdio-cli cost-estimator list - List saved cost estimates
desktop-images - Golden desktop images managed by NMM
nerdio-cli desktop-images changelog - Get desktop image change lognerdio-cli desktop-images get - Get desktop image detailsnerdio-cli desktop-images list - List desktop images for an accountnerdio-cli desktop-images schedules - Get desktop image schedule configurationsnerdio-cli desktop-images start - Start (power on) a desktop image VMnerdio-cli desktop-images stop - Stop (power off) a desktop image VM
devices - Intune-managed devices (v1-beta API)
nerdio-cli devices app-failures - List app installation failures on a devicenerdio-cli devices apps - List apps installed on a devicenerdio-cli devices bitlocker-keys - Get BitLocker recovery keys for a devicenerdio-cli devices compliance - Get compliance state for a devicenerdio-cli devices get - Get an Intune device by IDnerdio-cli devices hardware - Get hardware inventory for a devicenerdio-cli devices laps - Get local admin password (LAPS) for a devicenerdio-cli devices list - List Intune devices for an accountnerdio-cli devices sync - Trigger an Intune sync on a device
directories - Active Directory configurations
nerdio-cli directories account - List directory configurations for an accountnerdio-cli directories list - List MSP-level directory configurations
environment-variables - Environment variables for scripted actions
nerdio-cli environment-variables account - List environment variables for an accountnerdio-cli environment-variables list - List MSP-level environment variables
fslogix - FSLogix profile storage configurations
nerdio-cli fslogix <account_id> - List FSLogix configurations for an account
groups - Entra ID groups within a customer account
nerdio-cli groups <account_id> <group_id> - Get a group by ID
host-pools - AVD host pools within a customer account
nerdio-cli host-pools ad - Get host pool Active Directory settingsnerdio-cli host-pools assigned-users - List users assigned to a host poolnerdio-cli host-pools autoscale - Get host pool autoscale configurationnerdio-cli host-pools avd - Get host pool AVD settingsnerdio-cli host-pools create - Create a host pool in an accountnerdio-cli host-pools delete - Delete a host poolnerdio-cli host-pools fslogix - Get host pool FSLogix configurationnerdio-cli host-pools list - List host pools for an accountnerdio-cli host-pools rdp - Get host pool RDP settingsnerdio-cli host-pools schedules - Get host pool schedule configurationsnerdio-cli host-pools session-timeouts - Get host pool session timeout settingsnerdio-cli host-pools sessions - List active user sessions on a host poolnerdio-cli host-pools set-autoscale - Update host pool autoscale configuration (pass full config JSON via --stdin)nerdio-cli host-pools tags - Get host pool Azure tagsnerdio-cli host-pools vm-deployment - Get host pool VM deployment settings
hosts - Session hosts within a host pool
nerdio-cli hosts list - List session hosts in a host poolnerdio-cli hosts restart - Restart a session host VMnerdio-cli hosts schedules - Get schedule configurations for a session hostnerdio-cli hosts start - Start a session host VMnerdio-cli hosts stop - Stop (deallocate) a session host VM
invoices - MSP billing invoices
nerdio-cli invoices get - Get an invoice by IDnerdio-cli invoices list - List invoices in a billing period
job - Async jobs returned by NMM mutations
nerdio-cli job get - Get an async job by IDnerdio-cli job retry - Restart a failed jobnerdio-cli job tasks - List tasks of an async job
networks - Azure virtual networks for a customer account
nerdio-cli networks all - List all networks visible to an accountnerdio-cli networks link - Link an existing network to an accountnerdio-cli networks list - List networks managed by NMM for an account
provisioning - Customer account provisioning operations
nerdio-cli provisioning link-network - Link a network during account provisioningnerdio-cli provisioning link-tenant - Link an existing Entra tenant as a new NMM account (returns a job; poll jobs get)
recovery-vaults - Azure Recovery Services vaults for a customer account
nerdio-cli recovery-vaults all - List all recovery vaults visible to an accountnerdio-cli recovery-vaults create - Create a recovery vaultnerdio-cli recovery-vaults delete-policy - Delete a backup policynerdio-cli recovery-vaults link - Link an existing recovery vault to an accountnerdio-cli recovery-vaults linked - List recovery vaults linked to an accountnerdio-cli recovery-vaults policies - List backup policies in a recovery vaultnerdio-cli recovery-vaults policy - Get a backup policy by namenerdio-cli recovery-vaults region-policies - Get vault policy info for an Azure regionnerdio-cli recovery-vaults unlink - Unlink a recovery vault from an account
reservations - Azure VM reserved instances for a customer account
nerdio-cli reservations create - Create a reservationnerdio-cli reservations delete - Delete a reservationnerdio-cli reservations get - Get a reservation by IDnerdio-cli reservations list - List reservations for an accountnerdio-cli reservations resources - List resources attached to a reservationnerdio-cli reservations update - Update a reservation
resource-groups - Azure resource groups linked to NMM
nerdio-cli resource-groups account-link - Link a resource group to an accountnerdio-cli resource-groups account-list - List resource groups linked to an accountnerdio-cli resource-groups account-set-default - Set the default resource group for an accountnerdio-cli resource-groups account-unlink - Unlink a resource group from an accountnerdio-cli resource-groups link - Link a resource group at MSP levelnerdio-cli resource-groups list - List MSP-level linked resource groupsnerdio-cli resource-groups set-default - Set the default MSP-level resource groupnerdio-cli resource-groups unlink - Unlink an MSP-level resource group
schedules - Reusable schedules
nerdio-cli schedules account-configurations - Get configurations for an account schedulenerdio-cli schedules account-get - Get an account schedulenerdio-cli schedules account-list - List schedules for an accountnerdio-cli schedules configurations - Get configurations for an MSP-level schedulenerdio-cli schedules get - Get an MSP-level schedulenerdio-cli schedules list - List MSP-level schedules
scripted-actions - Scripted actions (MSP-level and per-account)
nerdio-cli scripted-actions account-list - List scripted actions for an accountnerdio-cli scripted-actions list - List MSP-level scripted actionsnerdio-cli scripted-actions run - Execute an MSP-level scripted action (returns a job)nerdio-cli scripted-actions run-account - Execute a scripted action in an account context (returns a job)nerdio-cli scripted-actions schedule - Get the schedule for an account scripted actionnerdio-cli scripted-actions unschedule - Remove the schedule from an account scripted action
secure-variables - Secure variables for scripted actions (values are secrets)
nerdio-cli secure-variables account-create - Create a secure variable in an accountnerdio-cli secure-variables account-delete - Delete a secure variable from an accountnerdio-cli secure-variables account-list - List secure variables for an account (may expose stored secret values)nerdio-cli secure-variables account-update - Update a secure variable in an accountnerdio-cli secure-variables create - Create an MSP-level secure variablenerdio-cli secure-variables delete - Delete an MSP-level secure variablenerdio-cli secure-variables list - List MSP-level secure variables (may expose stored secret values)nerdio-cli secure-variables update - Update an MSP-level secure variable
usages - Consumption/usage data
nerdio-cli usages account - Get usage for one customer account between datesnerdio-cli usages msp - Get MSP-level usage between dates
users - Entra ID users within a customer account
nerdio-cli users get - Get a user by IDnerdio-cli users mfa - Get MFA registration status for a usernerdio-cli users search - Search/list users in an account (paginated POST search)
workspaces - AVD workspaces for a customer account
nerdio-cli workspaces create - Create an AVD workspacenerdio-cli workspaces list - List AVD workspaces for an accountnerdio-cli workspaces sessions - List sessions in a workspace
Freshness Contract
This printed CLI owns bounded freshness only for registered store-backed read command paths. In --data-source auto mode, those paths check sync_state and may run a bounded refresh before reading local data. --data-source local never refreshes. --data-source live reads the API and does not mutate the local store. Set NERDIO_NO_AUTO_REFRESH=1 to skip the freshness hook without changing source selection.
Covered paths:
nerdio-cli accountsnerdio-cli autoscale-profilesnerdio-cli autoscale-profiles getnerdio-cli autoscale-profiles listnerdio-cli cost-estimatornerdio-cli cost-estimator getnerdio-cli cost-estimator listnerdio-cli directoriesnerdio-cli directories listnerdio-cli environment-variablesnerdio-cli environment-variables listnerdio-cli resource-groupsnerdio-cli resource-groups listnerdio-cli schedulesnerdio-cli schedules getnerdio-cli schedules listnerdio-cli scripted-actionsnerdio-cli scripted-actions listnerdio-cli secure-variablesnerdio-cli secure-variables list
When JSON output uses the generated provenance envelope, freshness metadata appears at meta.freshness. Treat it as current-cache freshness for the covered command path, not a guarantee of complete historical backfill or API-specific enrichment.
Finding the right command
When you know what you want to do but not which command does it, ask the CLI directly:
nerdio-cli which "<capability in your own words>"
which resolves a natural-language capability query to the best matching command from this CLI's curated feature index. Exit code 0 means at least one match; exit code 2 means no confident match - fall back to --help or use a narrower query.
Recipes
Monday autoscale sweep
nerdio-cli fleet autoscale-audit --agent
Fan out across every customer account and flag host pools with autoscale disabled or diverging from baseline, with failed accounts reported separately.
Weekend power check
nerdio-cli fleet host-estate --running-only --agent --select items.account,items.host,items.power_state
One narrow table of every session host still running across all customers - the deep response trimmed to three fields.
Unpaid invoice check
nerdio-cli fleet billing-rollup --period 2026-05-01:2026-05-31 --unpaid-only
Per-account unpaid balance for the period, joined to account names from the local store.
Fleet-wide scripted action
nerdio-cli scripted-actions fan-run 42 --accounts 101,102,103 --wait
Run one scripted action in three customer accounts and block until every returned job reaches a terminal state.
Find an account fast
nerdio-cli search "contoso" --type accounts
Full-text search the synced local store instead of paging the live API.
Auth Setup
The NMM Partner API is per-instance: every MSP hosts their own Nerdio Manager installation, so there is no vendor-global endpoint. Create an API client in your NMM portal (Settings -> Integrations -> REST API), then set five environment variables: NERDIO_BASE_URL (your instance root, e.g. https://nmm.contoso.com), NERDIO_TOKEN_URL (https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token), NERDIO_CLIENT_ID, NERDIO_CLIENT_SECRET, and NERDIO_OAUTH_SCOPE. The scope is the bare Application ID URI default - '/.default' with NO api:// prefix. Adding api:// triggers AADSTS500011; Nerdio's own docs got this wrong for years.
Run nerdio-cli doctor to verify setup.
Agent Mode
Add --agent to any command. Expands to: --json --compact --no-input --no-color --yes.
-
Pipeable - JSON on stdout, errors on stderr
-
Filterable - --select keeps a subset of fields. Dotted paths descend into nested structures; arrays traverse element-wise. Critical for keeping context small on verbose APIs:
nerdio-cli accounts --agent --select id,name,status
-
Previewable - --dry-run shows the request without sending
-
Offline-friendly - sync/search commands can use the local SQLite store when available
-
Non-interactive - never prompts, every input is a flag
-
Explicit retries - use --idempotent only when an already-existing create should count as success, and --ignore-missing only when a missing delete target should count as success
Response envelope
Commands that read from the local store or the API wrap output in a provenance envelope:
{
"meta": {"source": "live" | "local", "synced_at": "...", "reason": "..."},
"results": <data>
}
Parse .results for data and .meta.source to know whether it's live or local. A human-readable N results (live) summary is printed to stderr only when stdout is a terminal AND no machine-format flag (--json, --csv, --compact, --quiet, --plain, --select) is set - piped/agent consumers and explicit-format runs get pure JSON on stdout.
Agent Feedback
When you (or the agent) notice something off about this CLI, record it:
nerdio-cli feedback "the --since flag is inclusive but docs say exclusive"
nerdio-cli feedback --stdin < notes.txt
nerdio-cli feedback list --json --limit 10
Entries are stored locally at ~/.local/share/nerdio-cli/feedback.jsonl. They are never POSTed unless NERDIO_FEEDBACK_ENDPOINT is set AND either --send is passed or NERDIO_FEEDBACK_AUTO_SEND=true. Default behavior is local-only.
Write what surprised you, not a bug report. Short, specific, one line: that is the part that compounds.
Output Delivery
Every command accepts --deliver <sink>. The output goes to the named sink in addition to (or instead of) stdout, so agents can route command results without hand-piping. Three sinks are supported:
| Sink | Effect |
|---|
stdout | Default; write to stdout only |
file:<path> | Atomically write output to <path> (tmp + rename) |
webhook:<url> | POST the output body to the URL (application/json or application/x-ndjson when --compact) |
Unknown schemes are refused with a structured error naming the supported set. Webhook failures return non-zero and log the URL + HTTP status on stderr.
Named Profiles
A profile is a saved set of flag values, reused across invocations. Use it when a scheduled agent calls the same command every run with the same configuration - HeyGen's "Beacon" pattern.
nerdio-cli profile save briefing --json
nerdio-cli --profile briefing accounts
nerdio-cli profile list --json
nerdio-cli profile show briefing
nerdio-cli profile delete briefing --yes
Explicit flags always win over profile values; profile values win over defaults. agent-context lists all available profiles under available_profiles so introspecting agents discover them at runtime.
Exit Codes
| Code | Meaning |
|---|
| 0 | Success |
| 2 | Usage error (wrong arguments) |
| 3 | Resource not found |
| 4 | Authentication required |
| 5 | API error (upstream issue) |
| 7 | Rate limited (wait and retry) |
| 10 | Config error |
Argument Parsing
Parse $ARGUMENTS:
- Empty,
help, or --help → show nerdio-cli --help output
- Starts with
install → ends with mcp → MCP installation; otherwise → see Prerequisites above
- Anything else → Direct Use (execute as CLI command with
--agent)
MCP Server Installation
- Install the MCP server:
go install github.com/mvanhorn/printing-press-library/library/cloud/nerdio/cmd/nerdio-mcp@latest
- Register with Claude Code:
claude mcp add nerdio-mcp -- nerdio-mcp
- Verify:
claude mcp list
Direct Use
- Check if installed:
which nerdio-cli
If not found, offer to install (see Prerequisites at the top of this skill).
- Match the user query to the best command from the Unique Capabilities and Command Reference above.
- Execute with the
--agent flag:
nerdio-cli <command> [subcommand] [args] --agent
- If ambiguous, drill into subcommand help:
nerdio-cli <command> --help.
