mcpg admin — the platform-operator CLI

The binary is mcpg-admin (apps/cloud/admin), reached as mcpg admin …. Two operator-only surfaces, grouped by target service so the split auth story stays legible.

cluster — the provisioner's fleet (CP admin API)

Auth: the OIDC id_token from mcpg admin login (same credentials.json as mcpg cloud login), attached as Bearer; the CP's MCPG_CP_PLATFORM_ADMIN_EMAILS allowlist decides who may call /v1/admin.

mcpg admin login | logout
mcpg admin cluster list
mcpg admin cluster health
mcpg admin cluster register --name --region --gateways-max
                            [--isolation-tier] [--cpu-millicores-total]
                            [--memory-bytes-total]
                            --kubeconfig <file> | (--sa-token --ca-pem --server-url)
mcpg admin cluster decommission <ID> [--force]

Credential material (--kubeconfig, --ca-pem) is read from disk so secrets never appear in argv. decommission refuses while gateways are running unless --force (which orphans them).

org — tenant seeding + plan control (federation admin API)

Auth: the federation's shared service token (--admin-token / MCPG_FED_ADMIN_TOKEN) — a machine credential for a different service, deliberately not conflated with user login. Base URL: --federation-url / MCPG_FED_URL.

mcpg admin org create --slug <S> | --tenant-claim <V>   --plan <P>
                      [--display-name] [--status] [--expires-at]
                      [--owner-email --owner-password [--owner-name]]
mcpg admin org get <SLUG>
mcpg admin org list
mcpg admin org add-owner <SLUG> --owner-email --owner-password [--owner-name]
mcpg admin org set-plan <SLUG> [--plan] [--status]
                        [--expires-at | --clear-expiry]

--tenant-claim derives the slug with the exact function the CP applies at login (mcpg_control_plane_core::ids::tenant_claim_slug), so the seeded org matches what that claim resolves to. After seeding, licensing flows automatically: the CP fetches the org's license at the tenant's next login, or within ~15 minutes via the license-refresh loop.

See docs/cloud/PLATFORM-RUNBOOK.md for the operational context.