Workforce CLI
The Workforce CLI (mfw) gives an employee their approved models and tools from the terminal. It signs them in through your identity provider and creates a Gateway key for that machine.
The first run signs the employee in, sets up the machine, and opens a chat.
Commands
In the chat, /model shows or pins the model, /tools lists available tools, /new starts a new conversation, and /help lists every command.
Use Claude Code or Codex with the key
mfw env sets the base URL and key variables for Claude Code, Codex, and OpenAI- or Anthropic-SDK tools. Their requests then follow the employee’s routing policy and budget.
Keep Claude Code’s key fresh
mfw gateway login --api-url https://wf-api.merge.dev signs the machine in and stores its Gateway key. mfw gateway key prints the key, replacing it before it expires, so set it as Claude Code’s apiKeyHelper. mfw gateway logout revokes the key.
Admin commands
Admins with the manage_workforce role can manage the organization from the terminal: mfw admin groups, mfw admin employees, mfw admin add-employee, mfw admin remove-employee, and mfw admin set-models to set a Group’s allowed models. Run mfw admin --help for options.
How the key works
Each machine gets its own key, so you can revoke one laptop without affecting the employee’s other machines. Spend from every machine is attributed to the employee. Deprovisioning the employee in your identity provider revokes all their keys.
If mfw setup says Gateway isn’t set up for the organization, the sign-in used the wrong account. Sign out of other Merge consoles in that browser, or use a separate browser profile, and run mfw login again.