Imported from Servosity/msp-skills (skills/cove/SKILL.md). Install upstream with npx skills add Servosity/msp-skills --skill cove. Copyright stays with the author (Apache-2.0).

Cove Data Protection - Printing Press CLI

Prerequisites: Install the CLI

This skill drives the cove-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:

1. macOS / Linux:

   bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/cove/install.sh)

2. Windows (PowerShell):

   iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/cove/install.ps1 | iex

3. Verify: cove-cli --version
4. Ensure ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows) is on $PATH.

The installer downloads the cove-cli and cove-mcp binaries into ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows). It does not register the skill with your agent and writes no MCP client config - see mcp-install.md for that wire-up.

If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.

Cove's console scopes to one customer at a time and forgets yesterday. cove-cli speaks the whole JSON-RPC API: one command sweeps every partner for failed or stale backups with column codes decoded to human names, snapshot keeps timestamped SQLite history so storage growth and devices changes can answer trend questions nothing else can, and call reaches all 251 documented methods.

When to Use This CLI

Use cove-cli when a task touches N-able Cove Data Protection fleet state: which backups failed or went stale, per-customer health rollups, storage growth, month-end SKU/seat billing, partner/device/user/audit enumeration, or any of the 251 JSON-RPC methods via call. It is the right tool for cross-customer questions the backup.management console can only answer one partner at a time, and for trend questions that need the local snapshot history.

Anti-triggers

Do not use this CLI for:

• Restoring files or browsing backed-up data - restores run through the Backup Manager client or console, and per-device session detail lives on storage-node Reporting Service endpoints this CLI does not cover
• Installing or controlling the Backup Manager agent on endpoints - use deployment tooling (RMM) for that
• N-able N-central or RMM administration - this CLI only speaks the Cove (backup.management) API
• Accounts that only have interactive 2FA logins - the JSON-RPC API needs an API-enabled service account

Unique Capabilities

These capabilities aren't available in any other tool for this API.

Local history that compounds

• storage growth - See which devices and customers are growing their backup storage fastest, from timestamped local snapshots.

  Reach for this when capacity planning or quota questions need a trend, not a point-in-time number.

  cove-cli storage growth --since 7d --agent

• devices changes - Devices whose backup status flipped between the two latest snapshots - regressions and recoveries without re-sweeping the fleet.

  Answers 'what broke since last week' and 'did Friday's failures clear' in one command.

  cove-cli devices changes --since 7d --json

Fleet triage

• devices failures - Every device across all customers whose last backup session failed, aborted, errored, or never started - decoded to status names.

  The MSP morning ritual: run this first to build the day's ticket queue.

  cove-cli devices failures --since 24h --agent

• devices stale - Devices with no successful backup in N days, ranked by staleness and grouped by customer.

  Catches silent gaps: a device can report a fine last status while not having succeeded for days.

  cove-cli devices stale --days 3 --json

• fleet health - One-screen rollup: total devices, healthy, failed, stale, never-run - with a per-customer breakdown.

  The at-a-glance number for standups and QBR prep.

  cove-cli fleet health --by partner --json

Billing

• billing usage - Per-device SKU, used storage, and M365 seat counts with column codes decoded - the month-end billing export in one command.

  Turns Cove usage into invoice lines without the column-code legend open in another tab.

  cove-cli billing usage --csv

• billing changes - Devices whose plan changed since last month - current SKU vs Cove's built-in previous-month SKU column.

  Run at month-end to catch upgrades, downgrades, and seat changes that affect invoices.

  cove-cli billing changes --json

Command Reference

audit - Management console audit trail

• cove-cli audit - Enumerate audit actions in a time range (JSON-RPC EnumerateAuditActions)

backup-jobs - Backup/restore jobs

• cove-cli backup-jobs - Enumerate jobs for a partner (JSON-RPC EnumerateJobs)

columns - Statistics column metadata (pairs with the README column-code legend)

• cove-cli columns - Enumerate custom statistic columns visible to a partner (JSON-RPC EnumerateColumns)

devices - Backup devices (accounts) and their column-coded statistics

• cove-cli devices get - Get one device by id (JSON-RPC GetAccountInfoById)
• cove-cli devices list - Enumerate backup devices for a partner (JSON-RPC EnumerateAccounts)
• cove-cli devices stats - Query device statistics by column codes (JSON-RPC EnumerateAccountStatistics; see README column-code legend)

labels - Device labels

• cove-cli labels - Enumerate all device labels (JSON-RPC EnumerateAllLabels)

locations - Data-center locations

• cove-cli locations - Enumerate data-center locations (JSON-RPC EnumerateLocations)

partners - Customers and resellers in the partner hierarchy

• cove-cli partners get - Get one partner by id (JSON-RPC GetPartnerInfoById)
• cove-cli partners list - Enumerate partners under a parent (JSON-RPC EnumeratePartners)

products - Backup products available to a partner

• cove-cli products - Enumerate products (JSON-RPC EnumerateProducts)

server - Management service metadata

• cove-cli server - Get management server info (JSON-RPC GetServerInfo)

storage - Storage pools, statistics, and nodes

• cove-cli storage list - Enumerate storage pools for a partner (JSON-RPC EnumerateStorages)
• cove-cli storage nodes - Enumerate all storage nodes (JSON-RPC EnumerateAllStorageNodes)
• cove-cli storage stats - Storage usage statistics per location (JSON-RPC EnumerateStorageStatistics)

users - Console users

• cove-cli users - Enumerate users for partners (JSON-RPC EnumerateUsers)

Finding the right command

When you know what you want to do but not which command does it, ask the CLI directly:

cove-cli which "<capability in your own words>"

which resolves a natural-language capability query to the best matching command from this CLI's curated feature index. Exit code 0 means at least one match; exit code 2 means no confident match - fall back to --help or use a narrower query.

Recipes

Morning failure sweep for the ticket queue

cove-cli devices failures --since 24h --agent --select items.device_name,items.customer,items.status_name

Cross-customer failed/aborted/not-started list narrowed to the three fields a triage ticket needs.

Find silently stale devices

cove-cli devices stale --days 3 --json

Devices with no successful session in 3 days, ranked worst-first - catches gaps the last-status view hides.

Month-end billing export

cove-cli billing usage --csv

Per-device SKU, used storage, and M365 seats as CSV for the invoice model.

What broke since the last snapshot

cove-cli devices changes --since 7d --json

After two cove-cli snapshot runs some time apart: regressions and recoveries between them.

Call any of the 251 JSON-RPC methods

cove-cli call GetServerInfo --json

Generic escape hatch with automatic visa injection and typed vendor error mapping.

Auth Setup

Cove's JSON-RPC API authenticates with a partner-scoped login, not a bearer token or API key. Create a dedicated API User in the Cove Management Console (Users > API Users); it issues a login name and an API token (shown only once). Set COVE_USERNAME to the API user's login name, COVE_PASSWORD to the API token, and COVE_PARTNER to the customer/partner the API user was created for - for an API User COVE_PARTNER is required, not optional, and an empty partner is the usual cause of a 2100 "Unknown partner/username" error. COVE_PARTNER must be the full customer/partner string exactly as shown in the Cove console customer dropdown - usually including the account email in parentheses, e.g. Acme Corp (admin@acme.com), not just the company name; Cove returns the same 2100 "Unknown partner/username or bad password" error for a wrong COVE_PARTNER format as for a bad password. The API token is the password; it is not itself a visa and is never sent as a header (passing it to --visa fails by design). N-able removed the older per-user "API access" checkbox, and API Users cannot sign in to the console. Run cove-cli auth login once: it calls the Login method with these three values, receives a session token (the "visa"), and caches it locally with auto-refresh on expiry. Hand-built commands (failures, stale, health, billing, snapshot, call) inject the visa automatically. The raw generated endpoint commands (partners/devices/storage list·get, promoted *) do not auto-inject it: pass --visa "$(cove-cli auth token)", or prefer cove-cli call <Method>, which injects the visa for you.

Run cove-cli doctor to verify setup.

Agent Mode

Add --agent to any command. Expands to: --json --compact --no-input --no-color --yes.

• Pipeable - JSON on stdout, errors on stderr

• Filterable - --select keeps a subset of fields. Dotted paths descend into nested structures; arrays traverse element-wise. Critical for keeping context small on verbose APIs:

  cove-cli audit --agent --select id,name,status

• Previewable - --dry-run shows the request without sending

• Offline-friendly - sync/search commands can use the local SQLite store when available

• Non-interactive - never prompts, every input is a flag

• Explicit retries - use --idempotent only when an already-existing create should count as success

Response envelope

Commands that read from the local store or the API wrap output in a provenance envelope:

{
  "meta": {"source": "live" | "local", "synced_at": "...", "reason": "..."},
  "results": <data>
}

Parse .results for data and .meta.source to know whether it's live or local. A human-readable N results (live) summary is printed to stderr only when stdout is a terminal AND no machine-format flag (--json, --csv, --compact, --quiet, --plain, --select) is set - piped/agent consumers and explicit-format runs get pure JSON on stdout.

Agent Feedback

When you (or the agent) notice something off about this CLI, record it:

cove-cli feedback "the --since flag is inclusive but docs say exclusive"
cove-cli feedback --stdin < notes.txt
cove-cli feedback list --json --limit 10

Entries are stored locally at ~/.local/share/cove-cli/feedback.jsonl. They are never POSTed unless COVE_FEEDBACK_ENDPOINT is set AND either --send is passed or COVE_FEEDBACK_AUTO_SEND=true. Default behavior is local-only.

Write what surprised you, not a bug report. Short, specific, one line: that is the part that compounds.

Output Delivery

Every command accepts --deliver <sink>. The output goes to the named sink in addition to (or instead of) stdout, so agents can route command results without hand-piping. Three sinks are supported:

Unknown schemes are refused with a structured error naming the supported set. Webhook failures return non-zero and log the URL + HTTP status on stderr.

Named Profiles

A profile is a saved set of flag values, reused across invocations. Use it when a scheduled agent calls the same command every run with the same configuration - HeyGen's "Beacon" pattern.

cove-cli profile save briefing --json
cove-cli --profile briefing audit
cove-cli profile list --json
cove-cli profile show briefing
cove-cli profile delete briefing --yes

Explicit flags always win over profile values; profile values win over defaults. agent-context lists all available profiles under available_profiles so introspecting agents discover them at runtime.

Exit Codes

Argument Parsing

Parse $ARGUMENTS:

1. Empty, help, or --help → show cove-cli --help output
2. Starts with install → ends with mcp → MCP installation; otherwise → see Prerequisites above
3. Anything else → Direct Use (execute as CLI command with --agent)

MCP Server Installation

1. Install the MCP binary (run the install script from the Prerequisites section, or see mcp-install.md for per-agent wire-up).
2. Register with Claude Code:

   claude mcp add cove-mcp -- cove-mcp

3. Verify: claude mcp list

Direct Use

1. Check if installed: which cove-cli If not found, offer to install (see Prerequisites at the top of this skill).
2. Match the user query to the best command from the Unique Capabilities and Command Reference above.
3. Execute with the --agent flag:

   cove-cli <command> [subcommand] [args] --agent

4. If ambiguous, drill into subcommand help: cove-cli <command> --help.