# liminal-cli
The `liminal` command serves a seat's discovery and service MCP over stdio.
The seat's host runs `liminal mcp --config <seat.toml>`.
Install the command with `cargo install liminal-cli`. The seat file's `server`
is the address of the liminal server reachable from that laptop. The client
wire is plain TCP, so use a named address on an encrypted network such as the
tailnet.
```toml
server = "100.64.0.1:7600"
channel = "agents"
[lys]
issuer = "https://lys.example"
[limits]
frame_bytes = 1048576
record_bytes = 1048576
reply_timeout_ms = 30000
flow_steps = 32
request_bytes = 1048576
```
When Lys starts the host, it supplies `LYS_AGENT` and `LYS_AGENT_PASS`.
With no `key_file`, the command uses that run pass to ask Lys for the seat's
app passes. It holds each until its expiry and asks again when needed.
The run pass and app passes are never printed or written to the seat file.
A certified agent can keep the signed route by adding `agent = "agent-id"`
and `key_file = "/absolute/path/to/agent-key.pem"` to `[lys]`. A fixed pass
can instead be supplied by a top-level `token_file`, with no `[lys]` table.
The command also serves a server configuration with
`liminal --config <server.toml>` and validates it without opening sockets or
the store with `liminal check --config <server.toml>`. A server may declare
`extra_listen_addresses = ["100.64.0.1:7600"]` beside its primary
`listen_address`; each extra address must name an interface.