Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.ultra.security/llms.txt

Use this file to discover all available pages before exploring further.

Detect installed MCP clients and configure them to use Ultra as their MCP server.

Usage

ultra install [flags]

Flags

FlagShortDefaultDescription
--client-cTarget client (claude, cursor, vscode, cline, claude_code, windsurf, goose, codex, opencode, gemini, roocode, amazonq, lmstudio, ona, hermes)
--allfalseInstall into all detected MCP clients (non-interactive)
--configPath to Ultra config file
--no-backupfalseSkip backup of existing client config
--yes-yfalseSkip confirmation prompt
--list-lfalseList detected clients without installing

Examples

# Interactive installation wizard
ultra install

# Install into Claude Desktop only
ultra install --client claude

# Install into Cursor only
ultra install --client cursor

# Install into Codex only
ultra install --client codex

# Install into Ona
ultra install --client ona

# Install into Hermes
ultra install --client hermes

# List detected clients without installing
ultra install --list

# Install into all detected clients (non-interactive, used by MDM)
ultra install --all

Supported Clients

ClientFlag ValueAliases
Claude Desktopclaudeclaude-desktop, claude_desktop
Cursorcursor
Codexcodexcodex-cli
VS Codevscode
Claude Codeclaude_codeclaude-code
Windsurfwindsurf
Goosegoose
OpenCodeopencode
Geminigemini
Roo Coderoocoderoo-code, roo_code
Amazon Qamazonqamazon-q, amazon_q
LM Studiolmstudiolm-studio, lm_studio
Onaona
Hermeshermes

What It Does

The install command writes Ultra as an MCP server entry in the client’s configuration. For example, Claude Desktop’s config becomes:
{
  "mcpServers": {
    "ultra": {
      "command": "/usr/local/bin/ultra",
      "args": ["start"]
    }
  }
}
For Codex, the TOML config at ~/.codex/config.toml becomes:
[mcp_servers.ultra]
command = "/usr/local/bin/ultra"
args = ["start"]
For Hermes, the YAML config at ~/.hermes/config.yaml becomes:
mcp_servers:
  ultra:
    command: /usr/local/bin/ultra
    args:
      - start
    enabled: true
Existing servers and any non-MCP top-level keys in the Hermes config are preserved. Servers with enabled: false are filtered out when discovering existing entries. If --config is specified, the args include --config <path>.

Auto-linking with deploy keys

Ultra auto-links the gateway to Hub at install time when invoked via:
  • ultra install --all — used by MDM deployments to configure every detected client in one shot
  • ultra install --client ona — used by the Ona devcontainer entry point, which needs the gateway named before any MCP client starts
After configuring clients, these paths check for a deploy key (via ULTRA_DEPLOY_KEY environment variable, config file, or managed preferences). If a deploy key is found, the gateway is linked immediately:
  • The gateway registers with the workspace scoped by the deploy key
  • Device identity (email, external ID) is resolved from available sources (MDM preferences, environment variables)
  • The gateway appears in the Hub dashboard before any MCP client launches
For all other install paths — the interactive wizard, plain ultra install --yes, and per-client installs other than Ona — the gateway links during the first ultra start instead. OAuth-authenticated users always link at ultra start, regardless of which install path was used.

Backups

By default, the existing client config is backed up before modification. Use --no-backup to skip.