# The Agent Control Plane: Logs, Rollback, Env, Domains, Spend

> Every operation as an agent tool call — deploy, logs, rollback, env and secrets, domains, share lists, status, spend, destroy. Nothing is dashboard-only.

Published: 2026-09-19  
Canonical: https://agentcell.dev/resources/agent-control-plane  
Markdown: https://agentcell.dev/resources/agent-control-plane.md

> **TL;DR:** The design rule: every operation is available as an agent tool call, and nothing is dashboard-only. The dashboard is a rendering of the same API, built second — optimized for the person sharing, not the person operating. This page is the command-level companion to [Deploy From Your Agent](/resources/deploy-from-your-agent/).

## The command surface

| Command | What it does | Why it must be headless |
|---|---|---|
| `agentcell deploy` | Detect runtime, build, return a URL (target `<30s`, zero config) | The last step of a build session, performed by the agent |
| `agentcell logs` | Stream and search build + runtime logs, historical and live | The agent debugs the 500 without a human opening a logs tab |
| `agentcell rollback` | Instant recovery to the previous version | Recovery can't wait for a human with console access |
| `agentcell env set/list` + `secrets` | Config and scoped credentials at the boundary | Keys never pasted into code or prompts |
| `agentcell domains` | Attach custom domains and certs | Sharing a real URL shouldn't need DNS-console fluency |
| `agentcell share` / `access ls` | Change the share list; inspect who can open what | Sharing is a membership change, not a redeploy |
| `agentcell ps` | What's running, what's asleep | Twenty cells need one glanceable state |
| `agentcell spend` | Current usage per cell and org | No surprise bills for non-technical deployers |
| `agentcell destroy` | Remove what shouldn't exist | Cleanup must be as easy as creation or sprawl rots |

Same capabilities over MCP (`agentcell.metrics({ app: "prod", window: "1h" })`) and CLI — same permissions, structured for AI harnesses.

## Built for unaided debugging

The person who built the tool is not on call — there is no on-call. So failures must be agent-legible: structured log output with fields instead of wall-of-text, machine-readable errors carrying a `hint` field with the most likely fix, and exit codes the agent can branch on (retryable vs needs-a-decision). The loop — deploy fails, agent reads hint, fixes, redeploys — closes without a human reading a stack trace. Ever.

## Scoped agency

Full headless power requires least-privilege keys: scoped tokens per project and per capability. The coding session's token can deploy and read logs without being able to touch org secrets or access lists. Combined with [membrane](/resources/membrane-security/) caps and [front-door](/resources/front-door-identity/) identity, the agent is powerful inside a boundary it cannot cross.

## Honest note

Vercel's MCP server covers deploy, logs, env CRUD, domains, and rollback today — this surface is table stakes for agent-native hosting, not a moat. The moat is the combination with free idle and cheap org identity, plus the accumulation dynamic: once the org's identity, permissions, and environment live here, cell #20 deploys at near-zero marginal effort, and twenty tools in daily use is a migration nobody attempts.

## FAQ

**Do humans ever need the CLI?**
No — the dashboard renders the same API for sharing, logs, usage, and spend. The guarantee runs one direction: nothing requires the dashboard.

**How is this different from kubectl / cloud CLIs?**
Those CLIs expose infrastructure (pods, policies, IAM) and expect you to assemble outcomes. These commands expose outcomes (deploy it, share it, roll it back) with infrastructure invisible.

**What about CI/CD pipelines?**
Git-connected redeploy exists for teams that want it. But the primary path is the agent's session — pipelines are optional, not required.

---

*Want infrastructure your agent can actually drive? [Deploy now](/docs/deploy/).*