--- name: pp-adminbyrequest description: "Every Admin By Request portal action, plus a local SQLite mirror of audit, events, inventory and requests for ad-hoc... Trigger phrases: `list pending admin by request elevations`, `approve adminbyrequest request`, `deny adminbyrequest request`, `generate offline elevation PIN`, `check who keeps requesting admin elevation`, `sync admin by request audit log`, `use adminbyrequest`, `run adminbyrequest`." author: "joltsconsulting" license: "Apache-2.0" argument-hint: " [args] | install cli|mcp" allowed-tools: "Read Bash" metadata: openclaw: requires: bins: - adminbyrequest-pp-cli --- # Admin By Request — Printing Press CLI ## Prerequisites: Install the CLI This skill drives the `adminbyrequest-pp-cli` binary. **You must verify the CLI is installed before invoking any command from this skill.** If it is missing, install it first: 1. Install via the Printing Press installer. It defaults binaries to `$HOME/.local/bin` on macOS/Linux and `%LOCALAPPDATA%\Programs\PrintingPress\bin` on Windows: ```bash npx -y @mvanhorn/printing-press-library install adminbyrequest --cli-only ``` 2. Verify: `adminbyrequest-pp-cli --version` 3. Ensure the reported install directory is on `$PATH` for the agent/runtime that will invoke this skill. If the `npx` install fails (no Node, offline, etc.), fall back to a direct Go install (requires Go 1.26.6 or newer): ```bash go install github.com/mvanhorn/printing-press-library/library/devices/adminbyrequest/cmd/adminbyrequest-pp-cli@latest ``` If `--version` reports "command not found" after install, the runtime cannot see the binary directory on `$PATH`. Do not proceed with skill commands until verification succeeds. ## When to Use This CLI Use this CLI when you are administering an Admin By Request tenant from a terminal or AI agent: triaging pending requests in bulk, pulling audit data into a SIEM you have not yet wired up, generating offline PINs without opening the portal, or answering cross-resource questions (repeat requestors, agent-version drift) that the portal does not directly support. ## Unique Capabilities These capabilities aren't available in any other tool for this API. ### Local state that compounds - **`requests repeat-offenders`** — Surface the top users by elevation-request count over a configurable window, so admins can spot patterns the portal does not visualize. _When tracing repeated elevation attempts across a fleet, this is the single query that names the people; without it, an agent has to walk every request and aggregate manually._ ```bash adminbyrequest-pp-cli requests repeat-offenders --window 30d --json ``` - **`correlate`** — Given an audit log entry ID, join it to nearby events on the same computer to reconstruct a full elevation timeline. _Incident response often asks what else happened on this machine when this admin session opened; this is the single command that answers it._ ```bash adminbyrequest-pp-cli correlate 50461167 --window 5m --json ``` ### Fleet hygiene - **`inventory drift`** — List endpoints whose AbR client version is older than a target version, useful for upgrade campaigns. _Before any compliance audit, the agent should know which endpoints are running an old client; this is the one-liner._ ```bash adminbyrequest-pp-cli inventory drift --client-version 8.7.2 --json ``` - **`inventory risk-score`** — Score each endpoint by elevation frequency, local-admin count, and AbR client version recency. _Lets an admin focus remediation effort on the endpoints most likely to be abused._ ```bash adminbyrequest-pp-cli inventory risk-score --top 10 --json ``` ### Reachability mitigation - **`quota forecast`** — Track local API call count against the 100k-per-day quota and predict whether the current pace will exceed it before midnight. _Reachability mitigation: an agent that calls the API in a loop needs to know before it bricks the tenant for the day._ ```bash adminbyrequest-pp-cli quota forecast --json ``` ### Compliance and review - **`requests denied-reasons`** — Tokenize the free-text deniedReason field across all denied requests and emit a top-N word distribution. _For compliance review and tone-of-policy checks, surfacing the actual words used is faster than reading each row._ ```bash adminbyrequest-pp-cli requests denied-reasons --top 20 --json ``` - **`report compliance`** — Render audit entries for a user or computer over a window in a format suitable for auditors (CSV or markdown). _Auditor evidence requests always want a single artifact; this generates it in one command._ ```bash adminbyrequest-pp-cli report compliance --since 2026-01-01 --user CHRISCOOMBES --format md ``` ## Command Reference **auditlog** — Admin session and elevation audit log entries - `adminbyrequest-pp-cli auditlog delta` — Delta query for audit log changes (use timeNow/deltaTime ticks for resumable sync) - `adminbyrequest-pp-cli auditlog list` — List audit log entries (admin sessions, app elevations, denied requests). Pagination is by id cursor. **events** — Security and operational events emitted by AbR clients - `adminbyrequest-pp-cli events` — List events. Use code filter to narrow to specific event types. **inventory** — Endpoint inventory: hardware, software, OS, AbR agent version - `adminbyrequest-pp-cli inventory list` — List inventoried endpoints. Use wantsoftware/wanthardware to expand. - `adminbyrequest-pp-cli inventory pin` — Generate an offline elevation PIN code for a device. Pass --challenge for challenge-response mode. **requests** — Pending, approved, and denied elevation requests - `adminbyrequest-pp-cli requests approve` — Approve a pending elevation request. - `adminbyrequest-pp-cli requests deny` — Deny a pending elevation request. - `adminbyrequest-pp-cli requests list` — List elevation requests filtered by status. **Hand-written commands** - `adminbyrequest-pp-cli correlate ` — Join an audit log entry to nearby events on the same computer (window in minutes) - `adminbyrequest-pp-cli report` — Render compliance reports from synced data - `adminbyrequest-pp-cli quota` — Track local API call count vs AbR's 100k/day quota ### Finding the right command When you know what you want to do but not which command does it, ask the CLI directly: ```bash adminbyrequest-pp-cli which "" ``` `which` resolves a natural-language capability query to the best matching command from this CLI's curated feature index. Exit code `0` means at least one match; exit code `2` means no confident match — fall back to `--help` or use a narrower query. ## Recipes ### Triage pending requests as JSON ```bash adminbyrequest-pp-cli requests list --status pending --agent --select id,user.account,reason ``` Surface the pending elevation queue in agent-friendly JSON narrowed to the fields needed to decide. Approve or deny individual ids with `requests approve --reason ...` or `requests deny --reason ...`. ### Compliance evidence for one user ```bash adminbyrequest-pp-cli report compliance --since 2026-01-01 --user CHRISCOOMBES --format md > evidence.md ``` Render every audit log entry for a user since a date into a markdown report. ### Find every device on an old client ```bash adminbyrequest-pp-cli inventory drift --client-version 8.7.2 --json --select name,abrClientVersion ``` Inventory drift filters the synced inventory snapshot for endpoints below the target client version. ### Check today's API quota consumption ```bash adminbyrequest-pp-cli quota show --agent ``` Local counter of API calls made today; the CLI tracks them in `~/.cache/adminbyrequest-pp-cli/http/` so this command itself never costs an API call. ### Audit-to-event timeline narrowed via --select ```bash adminbyrequest-pp-cli correlate 50461167 --window 5m --agent --select audit.application.name,audit.user.account,events.eventText,events.eventTime ``` Joins audit entry to nearby events on the same computer; --select narrows the deeply nested response so the agent does not parse the full payload. ## Auth Setup Set ADMINBYREQUEST_API_KEY in your environment. The CLI sends it via the apikey header. AbR enforces a 100,000-call daily quota per tenant; the CLI tracks calls locally and warns you before exhaustion via quota forecast. Run `adminbyrequest-pp-cli doctor` to verify setup. ## Agent Mode Add `--agent` to any command. Expands to: `--json --compact --no-input --no-color --yes`. - **Pipeable** — JSON on stdout, errors on stderr - **Filterable** — `--select` keeps a subset of fields. Dotted paths descend into nested structures; arrays traverse element-wise. Critical for keeping context small on verbose APIs: ```bash adminbyrequest-pp-cli auditlog list --agent --select id,name,status ``` - **Previewable** — `--dry-run` shows the request without sending - **Offline-friendly** — sync/search commands can use the local SQLite store when available - **Non-interactive** — never prompts, every input is a flag - **Explicit retries** — use `--idempotent` only when an already-existing create should count as success ### Response envelope Commands that read from the local store or the API wrap output in a provenance envelope: ```json { "meta": {"source": "live" | "local", "synced_at": "...", "reason": "..."}, "results": } ``` Parse `.results` for data and `.meta.source` to know whether it's live or local. A human-readable `N results (live)` summary is printed to stderr only when stdout is a terminal — piped/agent consumers get pure JSON on stdout. ## Agent Feedback When you (or the agent) notice something off about this CLI, record it: ``` adminbyrequest-pp-cli feedback "the --since flag is inclusive but docs say exclusive" adminbyrequest-pp-cli feedback --stdin < notes.txt adminbyrequest-pp-cli feedback list --json --limit 10 ``` Entries are stored locally at `~/.adminbyrequest-pp-cli/feedback.jsonl`. They are never POSTed unless `ADMINBYREQUEST_FEEDBACK_ENDPOINT` is set AND either `--send` is passed or `ADMINBYREQUEST_FEEDBACK_AUTO_SEND=true`. Default behavior is local-only. Write what *surprised* you, not a bug report. Short, specific, one line: that is the part that compounds. ## Output Delivery Every command accepts `--deliver `. The output goes to the named sink in addition to (or instead of) stdout, so agents can route command results without hand-piping. Three sinks are supported: | Sink | Effect | |------|--------| | `stdout` | Default; write to stdout only | | `file:` | Atomically write output to `` (tmp + rename) | | `webhook:` | POST the output body to the URL (`application/json` or `application/x-ndjson` when `--compact`) | Unknown schemes are refused with a structured error naming the supported set. Webhook failures return non-zero and log the URL + HTTP status on stderr. ## Named Profiles A profile is a saved set of flag values, reused across invocations. Use it when a scheduled agent calls the same command every run with the same configuration - HeyGen's "Beacon" pattern. ``` adminbyrequest-pp-cli profile save briefing --json adminbyrequest-pp-cli --profile briefing auditlog list adminbyrequest-pp-cli profile list --json adminbyrequest-pp-cli profile show briefing adminbyrequest-pp-cli profile delete briefing --yes ``` Explicit flags always win over profile values; profile values win over defaults. `agent-context` lists all available profiles under `available_profiles` so introspecting agents discover them at runtime. ## Exit Codes | Code | Meaning | |------|---------| | 0 | Success | | 2 | Usage error (wrong arguments) | | 3 | Resource not found | | 4 | Authentication required | | 5 | API error (upstream issue) | | 7 | Rate limited (wait and retry) | | 10 | Config error | ## Argument Parsing Parse `$ARGUMENTS`: 1. **Empty, `help`, or `--help`** → show `adminbyrequest-pp-cli --help` output 2. **Starts with `install`** → ends with `mcp` → MCP installation; otherwise → see Prerequisites above 3. **Anything else** → Direct Use (execute as CLI command with `--agent`) ## MCP Server Installation Install the MCP binary from this CLI's published public-library entry or pre-built release, then register it: ```bash claude mcp add adminbyrequest-pp-mcp -- adminbyrequest-pp-mcp ``` Verify: `claude mcp list` ## Direct Use 1. Check if installed: `which adminbyrequest-pp-cli` If not found, offer to install (see Prerequisites at the top of this skill). 2. Match the user query to the best command from the Unique Capabilities and Command Reference above. 3. Execute with the `--agent` flag: ```bash adminbyrequest-pp-cli [subcommand] [args] --agent ``` 4. If ambiguous, drill into subcommand help: `adminbyrequest-pp-cli --help`. --- Source attribution: mvanhorn Original project: https://github.com/mvanhorn/printing-press-library/blob/d7698149796bc71048f54526e010a1535d808e0c/library/devices/adminbyrequest/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to the Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by the Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding any notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS Copyright 2026 joltsconsulting Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ## Additional upstream notices pp-adminbyrequest/NOTICE adminbyrequest-pp-cli Copyright 2026 joltsconsulting and contributors Created by joltsconsulting (@joltsconsulting). This CLI was generated by CLI Printing Press (https://github.com/mvanhorn/cli-printing-press) by Matt Van Horn and Trevin Chow. The Non-Obvious Insight, domain archetype detection, workflow commands, and behavioral insight commands were produced by the printing press's creative vision engine. CLI Printing Press is licensed separately under the MIT License. # Mega AI Hub resource metadata Creator / publisher: mvanhorn Original project: https://github.com/mvanhorn/printing-press-library/blob/d7698149796bc71048f54526e010a1535d808e0c/library/devices/adminbyrequest/SKILL.md Attribution basis: Source repository record Fields of work: Operations, Sales Roles: Customer Success Manager, IT Operations, Operations Manager Specialties: API, Backend, Database, Word Documents, Frontend, Git, Testing Tools: Adminbyrequest Pp Cli Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: ea498d65210962ae7488e13e3a0fcde2ea0ac8c4a0c94276e2d2d8d53647b4f8