Workforce CLI
The Workforce CLI (mfw) is the terminal path to the same governed model access the desktop client sets up. An employee signs in once, and the CLI mints a Gateway credential scoped to that one machine.
Reach for it when you want employees configured without deploying anything through your MDM: a pilot on a handful of machines, contractors on hardware you do not manage, or engineers who would rather run a command than wait for a device policy. When you do manage the fleet, the desktop client is the better default, because it configures machines with no employee action and can enforce policy locally, which the CLI cannot.
mfw is for employees getting governed access to models and tools. The Merge CLI (merge) is for developers building agents against Agent Handler. They authenticate separately and can be installed side by side on one machine.
Signing in
This runs an OAuth authorization-code flow with PKCE against your identity provider. A browser opens, the employee signs in, and the CLI receives the code on a loopback listener. There is no client secret to distribute and no key for an employee to copy out of a dashboard.
The listener binds a port in the range 9410 to 9419, which is deliberately separate from the range the Merge CLI uses, so an engineer running both does not hit a collision.
An employee who is signed into the Agent Handler console in the same browser can end up authenticating as that account instead. The two consoles hold separate sessions. If mfw setup reports that Merge Gateway is not set up for the organization, the login resolved to the wrong identity: sign out of the Agent Handler console, or use a separate browser profile, and run mfw login again.
Setting up the machine
Setup mints the employee’s Gateway credential for this machine.
The credential is per device, which is the property that matters for governance. Every machine an employee signs in on gets its own credential rather than sharing one, so you can revoke a single laptop without touching the employee’s other machines, and spend from that machine is attributed to the employee. It is the same credential model the desktop client uses, so a fleet running both is one population in your logs rather than two.
Access stays bound to identity. Deprovision the employee in your identity provider and the credential goes with the account.
What you configure first
The CLI does not change what an employee is allowed to reach. That comes from the same configuration as every other Workforce surface: identity through SCIM, models through AI Gateway, and tools through tool access. An employee whose organization has no Gateway configured cannot complete setup, which is the error described above.
Next
Deploy to a managed fleet instead with the Workforce desktop client.