> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mspilot.io/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> MSPilot enrolls technician Windows machines so Claude Desktop and ChatGPT run through one governed gateway. Seat words are standard seat and power seat. ConnectWise PSA import is not available. HIPAA is not a self-serve switch.

# Commands

> enroll, apply, pull, rotate, update, and status.

Run these with the installed binary:

```powershell theme={null}
& "$env:ProgramFiles\MSPilot\mspilot-agent.exe" status
```

A [from-source](/agent/from-source) build uses `./target/debug/mspilot-agent` the same way.

| Command  | What it does                                                                                                                                                                                                           |
| -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `enroll` | Registers this machine. If `device.json` already holds a device token, it pulls and prints `already_enrolled` instead of enrolling again.                                                                              |
| `apply`  | Writes app configs from the saved device state.                                                                                                                                                                        |
| `pull`   | Fetches gateway config and heals drifted apps. On a canonical Windows install it also compares the exe to the build the gateway pinned, and swaps the file when the hash differs. The new build runs on the next pull. |
| `rotate` | Rotates the device token and applies configs again.                                                                                                                                                                    |
| `update` | Replaces the Program Files binary from the published channel's `SHA256SUMS`.                                                                                                                                           |
| `status` | Prints enrollment and drift. It does not print secrets.                                                                                                                                                                |

`enroll` takes `--gateway-url` or the environment variable `MSPILOT_GATEWAY_URL`. `--region ca`, `--region us`, or `--region eu` selects `https://{region}.gateway.mspilot.io` only when no gateway URL is set. United Kingdom and Australia organizations pass the gateway URL from **Deployment**. After enroll, later commands use the gateway URL the server returned.

The enrollment key is only the environment variable `MSPILOT_ENROLLMENT_KEY`. Passing `--enrollment-key` fails as an unknown argument.

| Exit | Meaning                                                                                                        |
| ---- | -------------------------------------------------------------------------------------------------------------- |
| 0    | Ok. `mspilot_pending` on this exit means the gateway queued the machine.                                       |
| 1    | Partial apply, drift, missing key, or no machine fingerprint.                                                  |
| 2    | This command cannot run in this context. Pull as SYSTEM returns 2. Enroll as SYSTEM is allowed.                |
| 3    | The gateway rejected enroll, pull, or rotate.                                                                  |
| 4    | Pending sync or pending approval. RMM wrappers turn this into exit 0 and print `mspilot_pending`. Retry later. |

On the device list a machine is active, pending approval, not enrolled, or revoked. A global key can also leave a machine **Unassigned** when the RMM has no record to place it. Disable a device to free its seat.

Pending sync means the RMM has not reported the machine yet. It shows in the job output, not as a device-list filter. You do not click anything. The agent retries at the next sign-in, and the machine moves on once the RMM reports it.