> ## Documentation Index
> Fetch the complete documentation index at: https://docs.machine0.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Profiles

> CLI reference for profiles — named groups of integrations (Claude Code, GitHub, Linear, remote MCP servers), each with its own MCP endpoint.

<Warning>
  Profiles are an **experimental** feature. The `profiles` commands are hidden
  by default — set `USE_EXPERIMENTAL_FEATURES=true` in your environment to
  enable them.
</Warning>

A profile is a named group of integrations. Integrations connect your machine0 account to external services and store the resulting credentials encrypted — and because they live inside profiles, the same integration can be connected several times with different accounts (e.g. `github` as your work account in one profile and your personal account in another). Injecting a profile's credentials into your VMs is coming next.

Four integrations are available in every profile — `claude-code` (Claude Code OAuth credentials), `github` (a GitHub account for `gh` and `git push`/`clone`), `linear` (the Linear GraphQL API), and `machine0-cli` (a machine0 API key so the machine0 CLI works inside a VM) — and you can add any remote HTTP MCP server as a custom integration. Each is connected per profile.

The profile commands are dual-purpose: `get`, `new`, and `rm` act on a profile, or on one of its integrations when you name it as the second argument.

```bash theme={"theme":"css-variables"}
machine0 profiles new work
machine0 profiles new work deepwiki --url https://mcp.deepwiki.com/mcp
machine0 profiles integrations connect work github
machine0 profiles get work
```

Credentials are stored encrypted at rest. OAuth connections open your browser for the provider's consent screen; `claude-code` also asks you to paste the Claude callback URL or `code#state` back into the CLI, which exchanges the code with Anthropic locally before uploading the encrypted credential payload to machine0. `machine0-cli` connects instantly (it mints an API key server-side, visible in your account's token list as `machine0-cli-integration`).

***

## The profile MCP endpoint

Each profile aggregates its MCP integrations behind one endpoint:

```
https://app.machine0.io/profiles/<name>/mcp
```

Authenticate with your machine0 API key in the `x-api-key` header. The endpoint speaks stateless Streamable HTTP (JSON responses, no sessions, no SSE) and serves the combined tools of every MCP integration in the profile — system integrations hold provider credentials and are not part of the aggregation. Example MCP client configuration for Claude Code:

```bash theme={"theme":"css-variables"}
claude mcp add --transport http work-profile \
  https://app.machine0.io/profiles/work/mcp \
  --header "x-api-key: <your-api-key>"
```

Profiles are an organizational boundary, not a security boundary: any of your API keys can call any of your profiles' endpoints.

***

## profiles ls

List your profiles.

```bash theme={"theme":"css-variables"}
machine0 profiles ls
machine0 profiles ls --json
```

***

## profiles new

Create a profile — or, with an integration name and `--url`, add a remote HTTP MCP server to one.

Profile names follow the same rules as machine names (letters, digits, and dashes; max 63 characters) and are unique per account. Accounts are limited to 50 profiles.

```bash theme={"theme":"css-variables"}
machine0 profiles new <profile>
```

Integration names follow the same rules, and built-in names and close aliases (`claude-code`, `claude`, `anthropic`, `github`, `linear`, `machine0-cli`, and `machine0`) are reserved. Each profile holds up to 50 integrations, and the same name can exist in different profiles. Only HTTP(S) MCP servers are supported, and URLs must be public — private, loopback, and link-local addresses are rejected.

```bash theme={"theme":"css-variables"}
machine0 profiles new <profile> <integration> --url <url>
machine0 profiles new work deepwiki --url https://mcp.deepwiki.com/mcp
```

***

## profiles get

Show a profile's details — its MCP connection string and its integrations, built-in and custom, with their connection status — or one integration's details, including which external account is connected.

```bash theme={"theme":"css-variables"}
machine0 profiles get <profile>
machine0 profiles get <profile> <integration>
machine0 profiles get work github --json
```

| Status         | Meaning                                                                 |
| -------------- | ----------------------------------------------------------------------- |
| `connected`    | credentials are stored and ready                                        |
| `disconnected` | not connected in this profile yet — run `profiles integrations connect` |
| `unavailable`  | this server has no OAuth app configured for the provider                |

***

## profiles rm

Remove a profile — or a single custom integration from one.

Removing a profile deletes its integrations and their stored credentials (a connected `machine0-cli` key is revoked), and its MCP endpoint stops working. Removing an integration deletes its stored credentials; built-in integrations can't be removed — use `disconnect` instead.

```bash theme={"theme":"css-variables"}
machine0 profiles rm <profile>
machine0 profiles rm <profile> <integration>
machine0 profiles rm <profile> --yes   # skip the confirmation prompt
```

***

## profiles integrations connect

Connect (authenticate) an integration in a profile. OAuth providers open your browser for the consent screen; once you approve, the CLI reports success. `claude-code` requires one extra manual step: paste the callback URL or `code#state` shown by Claude back into the CLI; the CLI performs the Anthropic token exchange locally, then stores the resulting credentials with machine0. `machine0-cli` connects immediately without a browser, and so do custom MCP servers that don't require auth.

```bash theme={"theme":"css-variables"}
machine0 profiles integrations connect <profile> <integration>
machine0 profiles integrations connect <profile> <integration> --yes
```

```bash theme={"theme":"css-variables"}
machine0 profiles integrations connect work claude-code    # browser consent + paste code
machine0 profiles integrations connect work github        # browser consent
machine0 profiles integrations connect work machine0-cli  # instant
```

Re-running `connect` on an already-connected integration asks for confirmation, then replaces the stored credentials with a fresh grant. Connecting the same integration in another profile is independent — each profile holds its own credentials.

***

## profiles integrations disconnect

Disconnect an integration, deleting its stored credentials in that profile. Built-in providers also get best-effort revocation on the provider side; custom MCP credentials are simply deleted. The integration shows as `disconnected` until you reconnect. Other profiles' connections are unaffected.

```bash theme={"theme":"css-variables"}
machine0 profiles integrations disconnect <profile> <integration>
```

***

## profiles integrations test

Check that an integration's stored credentials actually work. Exits non-zero when the check fails, so it's scriptable.

```bash theme={"theme":"css-variables"}
machine0 profiles integrations test <profile> <integration>
machine0 profiles integrations test <profile> <integration> --json
```

What each integration tests:

| Integration    | Check                                                                                          |
| -------------- | ---------------------------------------------------------------------------------------------- |
| `claude-code`  | calls the Anthropic API with the stored Claude Code OAuth token, refreshing it first if needed |
| `github`       | calls the GitHub API and reports the authenticated login                                       |
| `linear`       | queries the Linear GraphQL viewer (refreshing the token if needed)                             |
| `machine0-cli` | verifies the API key against machine0                                                          |
| MCP servers    | connects and lists the server's tools                                                          |