ultra config

Set tokens, headers, and view configuration details.

Usage

ultra config <subcommand> [flags]

Subcommands

`set-token`

Set an authentication token (PAT, API key) for an MCP connector. The token is stored as an Authorization: Bearer header.

ultra config set-token <connector-name> [token]

If the token is not provided as an argument, you’ll be prompted to enter it securely (hidden input).

Flag	Short	Default	Description
`--interactive`	`-i`	`false`	Force interactive token input

# Set token interactively (recommended)
ultra config set-token github-mcp-server

# Set token directly (less secure, appears in shell history)
ultra config set-token github-mcp-server ghp_xxxxxxxxxxxx

`set-header`

Set a custom HTTP header for an MCP connector.

ultra config set-header <connector-name> <header-name> <header-value>

# Set a custom API key header
ultra config set-header my-connector X-API-Key abc123

# Set an authorization header manually
ultra config set-header my-connector Authorization "Bearer xyz"

`set`

Set a top-level configuration value.

ultra config set <key> [value]

Key	Description
`deploy-key`	Store a workspace deploy key; clears any existing OAuth/sync tokens
`device-email`	Store the device user’s email for deploy-key identity resolution
`drift-enforcement`	Control whether Ultra installs itself into agents you add later

If value is omitted for deploy-key or device-email, Ultra reads it from stdin (or the ULTRA_DEPLOY_KEY / ULTRA_DEVICE_EMAIL environment variable) so the secret never appears in shell history.

# Store a deploy key without putting it in shell history
printf '%s\n' "$ULTRA_DEPLOY_KEY" | ultra config set deploy-key

# Store the device user's work email
ultra config set device-email user@example.com

Drift enforcement

drift-enforcement controls whether Ultra keeps itself installed in the MCP agents it finds on this machine, and how far it goes:

Value	Behavior
`off`	Turn off drift monitoring entirely. Ultra neither reports nor corrects
`detect_only`	Report drift without changing any agent’s configuration
`default`	Keep Ultra installed in the agents you have already set up. Other agents are reported but left alone
`auto_install`	Also install Ultra into supported agents you add later, without changing those agents’ other MCP connectors
`enforce_all`	Everything `auto_install` does, and also moves each agent’s remaining MCP connectors to run through Ultra

default and auto_install differ in kind, not degree. default brings new connectors under Ultra in the agents it already manages, but installs into nothing new. auto_install does the reverse: it installs Ultra into every agent it detects, and deliberately leaves those agents’ other connectors exactly as they are. Neither is strictly stronger than the other, so pick the one matching what you want, rather than reading the list as a ladder. enforce_all is the only mode that does both.

# Opt into auto-installing Ultra into newly discovered agents
ultra config set drift-enforcement auto_install

# Return to the default
ultra config set drift-enforcement default

default and auto_install are the two values the auto-install checkbox in the installer’s agent-setup wizard toggles between. See Configure Agents.

enforce_all rewrites the configuration of MCP connectors you did not add through Ultra, so it is meant for centrally managed deployments rather than an individual machine. Set it deliberately.

When your organization sets it for you

An organization can set drift enforcement centrally, from Governance in Ultra Hub. When it has, the value your organization set wins and the local ultra config set drift-enforcement value is ignored — including when the organization’s value is default. Two things follow that are worth knowing before you go looking for a bug:

The change lands on the next start. Your device resolves drift enforcement once when Ultra starts. A value that arrives afterwards is stored and takes effect the next time you run ultra start, not immediately.
ultra config get drift-enforcement reads your local value, not the effective one. If your organization is setting it, the two can differ.

While a device is unlinked from Hub, the local value is the one that applies. Linking to a workspace clears any previously stored organization value, so a device moved between workspaces never keeps the old one. See Governance for setting this at the organization or workspace level.

`get`

Read back a configuration value.

ultra config get <key>

Key	Description
`drift-enforcement`	Print the agent drift-detection enforcement mode

ultra config get drift-enforcement

`path`

Show the configuration file path.

ultra config path

Examples

# Set a token for a connector
ultra config set-token github-mcp-server YOUR_TOKEN

# Set a custom header
ultra config set-header linear "X-API-Key" YOUR_API_KEY

# Opt into auto-installing Ultra into newly discovered agents
ultra config set drift-enforcement auto_install

# Check the current drift-detection enforcement mode
ultra config get drift-enforcement

# Show current config path
ultra config path

​Usage

​Subcommands

​set-token

​set-header

​set

​Drift enforcement

​When your organization sets it for you

​get

​path

​Examples

Usage

Subcommands

`set-token`

`set-header`

`set`

Drift enforcement

When your organization sets it for you

`get`

`path`

Examples