Twingate has released a Python-based command line interface that gives administrators direct, scriptable access to the GraphQL APIs underpinning its zero trust network access platform. Rather than clicking through the Admin Panel for every change, teams can now list, create, update and remove resources, devices, groups, connectors, service accounts and policies straight from a terminal. For organizations managing dozens or hundreds of remote networks, that shift from manual console work to automatable commands is more than a convenience - it changes how security operations scale.
The tool, called tgcli, requires only Python 3 and the widely used pandas library, both free and straightforward to install on most systems. Once set up, administrators authenticate with a tenant name and API key, after which the CLI stores a reusable session so that subsequent commands do not require re-entering credentials each time. This session-based model mirrors a broader trend in access-control tooling: rather than exposing raw secrets at every step, modern systems increasingly separate authentication from authorization, a principle that sits close to the logic behind how VPN encryption works, where a single secure handshake underpins many subsequent, protected exchanges without repeatedly renegotiating trust.
A Self-Documenting Interface
What distinguishes tgcli from many administrative scripts is its reliance on contextual help. Every object type and every operation supports the -h flag, which returns the exact arguments required at that level. Running the CLI with no arguments reveals the available object categories - auth, device, connector, user, group, resource, network and account. Drilling into any one of them, such as resource, exposes the operations permitted (list, show, create, delete), and drilling further into an operation shows precisely which parameters are mandatory versus optional. This layered discoverability means administrators do not need to memorize command syntax or consult external documentation for routine tasks.
Flexible Output for Humans and Scripts
Because the CLI wraps a GraphQL API, its native output format is JSON - useful for automation but dense for anyone scanning results manually. Twingate addressed this by building in three output modes: JSON by default, CSV for shell-based processing in Bash or PowerShell pipelines, and a dataframe-style table format intended for quick human review. Switching between them requires only a single flag, letting the same underlying query serve both a monitoring script and a manual audit without rewriting logic.
Why This Matters for Zero Trust Operations
Zero trust architectures depend on continuous, granular control over who can reach which resources, and under what conditions. Manual administration does not scale well against that requirement, particularly in environments where access policies change frequently or where infrastructure is provisioned and decommissioned on a regular cycle. A command line interface tied directly to the API layer allows these changes to be version-controlled, scripted into deployment pipelines, and audited alongside other infrastructure-as-code practices. That reduces the operational lag between a policy decision and its enforcement - a gap that, in many organizations, has historically been where security gaps quietly form.
Twingate has signaled that the CLI will continue to receive new features, with the development repository open to community suggestions and issue reports. For administrators already managing complex remote network topologies, that ongoing development matters: tooling that keeps pace with infrastructure change is, in practice, what separates access control that works on paper from access control that works in production.