Tuning Engines CLI & MCP Server

Govern every AI workflow through one API.

Tuning Engines is a governed AI runtime for model, agent, skill, and MCP workflows. Route inference through one OpenAI-compatible API, apply RBAC and traffic policies, request approvals for high-risk actions, inspect traces and usage, and connect durable orchestration frameworks such as LangGraph and Temporal. The same CLI and MCP server also manage domain-specific fine-tuning of open-source models.

Training Agents

Tuning Engines uses specialized agents that control how your data is analyzed and converted into training data. Each agent produces a different kind of domain-specific fine-tuned model optimized for its use case. Current agents focus on code, with more coming for customer support, data extraction, security review, ops, and other domains.

Cody (code_repo) — Code Autocomplete Agent

Cody fine-tunes on your GitHub repo using QLoRA (4-bit quantized LoRA) via the Axolotl framework (HuggingFace Transformers + PEFT). It learns your codebase's patterns, naming conventions, and project structure to produce a fast, lightweight adapter optimized for real-time completions.

Best for: code autocomplete, inline suggestions, tab-complete, code style matching, pattern completion.

te jobs create --agent code_repo \
  --base-model Qwen/Qwen2.5-Coder-7B-Instruct \
  --repo-url https://github.com/your-org/your-repo \
  --output-name my-cody-model

SIERA (sera_code_repo) — Bug-Fix Specialist

SIERA (Synthetic Intelligent Error Resolution Agent) uses the Open Coding Agents approach from AllenAI to generate targeted bug-fix training data from your repository. It synthesizes realistic error scenarios and their resolutions, then fine-tunes a model that learns your team's debugging style, error handling conventions, and fix patterns.

Best for: debugging, error resolution, patch generation, root cause analysis, fix suggestions.

te jobs create --agent sera_code_repo \
  --quality-tier high \
  --base-model Qwen/Qwen2.5-Coder-7B-Instruct \
  --repo-url https://github.com/your-org/your-repo \
  --output-name my-siera-model

Quality tiers (SIERA only):

• low — Faster, fewer synthetic pairs (default)
• high — Deeper analysis, more training data, better results

Coming Soon

Supported Base Models

Quick Start

npm install -g tuningengines-cli

# Or run without installing
npx -y --package tuningengines-cli@latest te auth status

# Sign up or log in (opens browser — works for new accounts too)
te auth login

# Add credits (opens browser to billing page)
te billing add-credits

# Estimate cost before training
te jobs estimate --base-model Qwen/Qwen2.5-Coder-7B-Instruct

# Train Cody on your repo
te jobs create --agent code_repo \
  --base-model Qwen/Qwen2.5-Coder-7B-Instruct \
  --repo-url https://github.com/your-org/your-repo \
  --output-name my-model

# Monitor training
te jobs status <job-id> --watch

# View your trained models
te models list

# Create a governed orchestration starter
te orchestration init langgraph
te orchestration init temporal
te orchestration init inngest
te orchestration init triggerdev
te orchestration init hatchet
te orchestration init restate
te orchestration init dbos
te orchestration init dapr
te orchestration init prefect
te orchestration init dagster
te orchestration init airflow

MCP Server Setup

The CLI includes a built-in MCP server with 60+ tools. Any AI assistant that supports MCP can fine-tune models, manage training jobs, run evaluations, check inference usage, inspect traces, review approvals, and manage non-secret tenant registry metadata through natural language.

For security, the MCP server intentionally does not expose internal proxy routes. It also refuses MCP-side inference-key creation and raw secret-bearing mutation fields. Use the CLI or web UI for workflows that intentionally create one-time keys, submit raw provider secrets, validate S3 credentials, or import/export S3 assets with raw credentials.

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "tuning-engines": {
      "command": "npx",
      "args": ["-y", "--package", "tuningengines-cli@latest", "te", "mcp", "serve"],
      "env": {
        "TE_API_KEY": "te_your_key_here"
      }
    }
  }
}

Claude Code

claude mcp add tuning-engines -- npx -y --package tuningengines-cli@latest te mcp serve

Work Sessions and outcomes

Label the desired outcome for a project without interrupting your coding workflow:

te goal start "Fix flaky checkout retries"
te goal show
te goal complete --result succeeded

Install optional native telemetry hooks for Claude Code or Codex:

te guard claude-code install --mode observe --project .
te guard claude-code doctor
te guard claude-code doctor --probe
te guard codex install
te guard codex doctor

Claude Code writes project-local hooks into .claude/settings.local.json. On Windows, verify with dir .\.claude, type .\.claude\settings.local.json, then restart Claude Code from the same project root and review claude /hooks. doctor --probe is available in tuningengines-cli 0.4.20 and later; it runs synthetic hook events through the installed commands and checks that the trace is visible to Tuning Engines. Hook invocations also write a local redacted status log at .claude/tuning-engines-hook-status.jsonl. Codex project hooks require review and trust from /hooks. The installer pins hooks to the exact CLI executable that created them; te guard codex doctor reports that path, CLI version, native-event contract, required lifecycle hooks, and any conflicting te command found on PATH. Each Codex or Claude Code user prompt starts a new trace while retaining one stable Work Session for the native conversation. Tuning Engines sends pseudonymous session and transcript references by default, not transcript contents or local absolute paths.

Claude Code Plugin

The repository also ships a Claude Code plugin wrapper around the same MCP server. It keeps installation discoverable while preserving the same TE_API_KEY environment-variable boundary:

claude plugin marketplace add cerebrixos-org/tuning-engines-cli
claude plugin install tuning-engines@tuning-engines

The same plugin directory includes a Codex plugin manifest, marketplace entry, MCP server, and tenant-operations skill. It uses the Tuning Engines web app as the shared control-plane UI for traces, approvals, policies, cost, and review.

DeepSeek Harness Plugin

Install the native Harness bundle to capture turn, model-step, and tool lifecycle telemetry and optionally enforce TE governance before tool execution:

export TE_API_KEY="your-tenant-token-or-inference-key"
dsh plugin --profile default add tuningengines-cli

The adapter uses a disk-backed local spool, background batching, bounded retries, stable tool-call correlation, and metadata-only capture by default.

VS Code / Cursor / Windsurf

Add to your MCP settings (.vscode/mcp.json or equivalent):

{
  "servers": {
    "tuning-engines": {
      "command": "npx",
      "args": ["-y", "--package", "tuningengines-cli@latest", "te", "mcp", "serve"],
      "env": {
        "TE_API_KEY": "te_your_key_here"
      }
    }
  }
}

What the AI assistant can do

When connected, your AI assistant can:

• "Fine-tune Qwen 7B on my-org/my-repo using the SIERA agent with high quality"
• "How much would it cost to train a 32B model for 3 epochs on this repo?"
• "Check the status of my latest training job"
• "List my trained models"
• "Export my model to s3://my-bucket/models/"
• "Show my account balance"
• "Train a bug-fix specialist on this repo" (auto-selects SIERA)
• "Create an autocomplete model for this codebase" (auto-selects Cody)

The create_job tool description includes full agent details and model lists, so AI assistants automatically select the right agent and model based on what you ask for.

Unified API Endpoint

Tuning Engines can be used anywhere a tool accepts an OpenAI-compatible API base URL. Point the client at:

https://api.tuningengines.com/v1

Use an inference key that starts with sk-te-... for live model calls, and use the model IDs shown by:

te inference models

This lets OpenCode, Temporal activities, LangGraph apps, OpenAI SDK clients, and other custom-provider clients route through the same Tuning Engines control plane for model RBAC, routing, fallbacks, guardrails, AGT policy, traces, usage metering, and cost attribution.

See docs/unified-api-endpoint.md for copy-paste examples for OpenCode, Temporal, Python, JavaScript, and other OpenAI-compatible clients.

Agent Runtime SDK and Orchestration Starters

Use the CLI/MCP package when you want npx tools for assistants. Use the Python SDK when you want your own app to run durable agent workflows while Tuning Engines remains the governed control plane for models, agents, skills, MCP tools, RBAC, AGT policy, audit, usage, and token economics.

OpenAI Agents SDK users can install the native model and trace integration:

pip install "tuning-engines[openai-agents]"

See packages/tuning-agents/README.md for setup. The OpenAI Agents runtime owns the loop; TE supplies the governed endpoint and receives metadata-only SDK traces through its background processor.

Install the published Python SDK:

pip install "tuning-engines[langgraph]"
pip install "tuning-engines[temporal]"

The package installs the tuning_agents Python module.

LangGraph example:

from langgraph.checkpoint.memory import InMemorySaver

from tuning_agents import TuningClient
from tuning_agents.langgraph import create_tuning_langgraph_agent, invoke_with_trace

client = TuningClient(api_key="te_your_key_here")

agent = create_tuning_langgraph_agent(
    client,
    model="llama-3.3-70b-fp8",
    agent_names=["billing-escalation"],
    checkpointer=InMemorySaver(),
    interrupt_before=["tools"],
)

result = invoke_with_trace(
    client,
    agent,
    [{"role": "user", "content": "Triage this ticket and escalate if needed."}],
    thread_id="ticket-123",
)

client.flush_trace(name="ticket-triage", runtime="langgraph", status="succeeded")

Temporal example:

from tuning_agents.temporal import (
    TuningEnginesTemporalFeatures,
    create_tuning_engines_plugin,
    define_temporal_workflow,
)

plugin = create_tuning_engines_plugin(
    features=TuningEnginesTemporalFeatures(
        built_in_workflow=False,
        model_calls=True,
        skill_tools=True,
        mcp_tools=True,
        agents=True,
        approvals=True,
        traces=True,
        state_references=True,
        interventions=True,
        model_catalog=True,
        usage=True,
    )
)
TuningAgentWorkflow = define_temporal_workflow()
# Pass plugin to Client.connect(..., plugins=[plugin]) and register the workflow.

The SDK captures runtime events from LangGraph/Temporal and posts them to POST /api/v1/traces. Each event carries a run_id, request_id, and a normalized event type such as model.call, mcp.tool_call, agent.message, workflow.step, human.edit, action.finalized, outcome.recorded, or state.reference. The app pairs that with inference usage, request capture, policy decisions, approval requests, external state references, audit, and billing logs.

JavaScript/TypeScript users can also import lightweight tracing helpers from the npm package:

import { createOpenAIAgentsTraceAdapter } from "tuningengines-cli/adapters/openai-agents";
import { createClaudeAgentSdkTraceAdapter } from "tuningengines-cli/adapters/claude-agent-sdk";

Both helpers send redacted run, model, tool, handoff, error, goal, and outcome events to the existing trace API. goal_key, goal_status, and goal_score are normalized into the same success-signal analytics as outcome_key.

For decision traces, store redacted signals in metadata.decision, for example proposal_summary, changed_fields, change_summary, final_action, outcome_label, and reason_summary. Do not place raw prompts, provider keys, tenant secrets, or full customer data in trace metadata.

Generate a starter kit:

te orchestration init langgraph --dir ./lg-te-demo
te orchestration init temporal --dir ./temporal-te-demo
te orchestration init inngest --dir ./inngest-te-demo
te orchestration init triggerdev --dir ./trigger-te-demo
te orchestration init hatchet --dir ./hatchet-te-demo
te orchestration init restate --dir ./restate-te-demo
te orchestration init dbos --dir ./dbos-te-demo
te orchestration init dapr --dir ./dapr-te-demo
te orchestration init prefect --dir ./prefect-te-demo
te orchestration init dagster --dir ./dagster-te-demo
te orchestration init airflow --dir ./airflow-te-demo

LangGraph and Temporal starters use the Python runtime SDK. Inngest, Trigger.dev, and Hatchet starters generate TypeScript projects with a small self-contained Tuning Engines helper. Restate, DBOS, and Dapr starters use the same TypeScript helper. Prefect, Dagster, and Airflow starters generate Python workflow examples with a small helper module. All generated examples include governed model calls, trace flushing, registry manifests, policy context metadata, decision metadata, runtime state references, and approval retry patterns.

CLI Commands

Authentication

Training Jobs

Models

Datasets

Evaluations

Inference

Runtime Traces and Approvals

Orchestration Starters

Agents

Skills and MCP Execution

Compliance Automation

Tenant Admin Automation

These commands require an API token for a tenant owner or tenant admin. They are designed for CI smoke tests and end-to-end product checks. Secret fields can be sent on create/update where the server supports them, but responses never print stored provider keys, AWS secrets, or invitation tokens.

Billing & Account

Configuration

All commands support --json for machine-readable output.

MCP Tools Reference

Training Jobs

Models

Marketplace

Datasets

Evaluations

Inference

Runtime, Policy, and Approvals

Tenant Admin MCP Tools

These tools require a tenant owner/admin API token. The MCP server refuses internal proxy routes, inference-key creation, and raw secret-bearing mutation fields.

Agents

Account

Environment Variables

Tenant management commands keep the configured te_* API token local and exchange it for a short-lived management JWT before calling the API. Inference keys (sk-te-*) are for inference-only flows such as te inference token and proxy calls; they are not accepted for tenant registry management commands.

Inference Smoke Testing

Use te-inference-smoke to exercise inference behavior as a tenant admin and, optionally, real tenant users. The default run is read-only. Set TE_SMOKE_MUTATE=1 to create temporary inference roles, keys, policies, guardrails, MCP servers, agents, and skills, then test permission permutations and clean them up.

If you only have an sk-te-* inference key, set TE_INFERENCE_KEY for proxy-only checks. Full role/user/policy permutations require a tenant-admin app API key that starts with te_.

TE_API_URL=https://app.tuningengines.com \
TE_ADMIN_API_KEY=te_admin_key_here \
TE_USER_API_KEY=te_user_key_here \
npx -y --package tuningengines-cli@latest te-inference-smoke

For actual proxy model calls, enable live calls explicitly:

TE_API_URL=https://app.tuningengines.com \
TE_INFERENCE_BASE=https://api.tuningengines.com/v1 \
TE_ADMIN_API_KEY=te_admin_key_here \
TE_SMOKE_MUTATE=1 \
TE_SMOKE_LIVE_CALLS=1 \
TE_SMOKE_CREATE_MODEL_DEPLOYMENT=1 \
TE_SMOKE_ALLOWED_MODEL=llama-3.1-8b-fast \
TE_SMOKE_DENIED_MODEL=llama-3.3-70b-fp8 \
TE_SMOKE_AGENT_URL=https://httpbin.org/post \
npx -y --package tuningengines-cli@latest te-inference-smoke

TE_SMOKE_CREATE_MODEL_DEPLOYMENT=1 is useful for disposable tenants that do not already have an enabled model. By default the runner treats a provider authentication failure on an allowed model as proof that Tuning Engines RBAC allowed the request through to the provider. Set TE_SMOKE_ALLOW_PROVIDER_AUTH_FAILURE=0 when the tenant has real provider credentials and the allowed call must return 200.

To test multiple tenant users, provide their API tokens:

TE_SMOKE_USERS_JSON='[
  {"email":"member1@example.com","api_key":"te_user_key_1"},
  {"email":"member2@example.com","api_key":"te_user_key_2"}
]' \
TE_ADMIN_API_KEY=te_admin_key_here \
TE_SMOKE_MUTATE=1 \
npx -y --package tuningengines-cli@latest te-inference-smoke

Preview coverage:

npx -y --package tuningengines-cli@latest te-inference-smoke --list

Each run writes a masked JSON report under te-smoke-results/, or to TE_SMOKE_REPORT when that env var is set.

Authentication

te auth login uses a secure device authorization flow (same pattern as gh auth login):

1. CLI generates a device code and opens your browser
2. Sign up or log in (email/password, Google, or GitHub)
3. Click "Authorize" to grant CLI access
4. Token flows back automatically — no copy-paste

Works for both new sign-ups and existing accounts. Token saved to ~/.tuningengines/config.json with 0600 permissions.

Links

• Website
• MCP Registry
• npm
• GitHub

License

MIT