Team Management

Collaborate with your team using shared hosts, roles, and audit trails.

Nefia teams let multiple operators share hosts, policies, and audit logs under a single workspace. Every Nefia account starts with a personal team that acts as your default workspace. You can create additional shared teams to collaborate with others.

Plans and Pricing

Plan	Hosts	Members	Price
Free	2	1	$0
Team	Unlimited	Unlimited	$8/user/month

Personal teams are always on the Free plan and cannot be upgraded. They are single-user workspaces.
Shared teams start on the Free plan (1 member, 2 hosts), but collaboration features stay gated until you upgrade. In the current implementation, Free shared teams cannot create invitations or sync host inventory to the Web Dashboard.
Per-seat billing: The Team plan charges $8 per member per month. Seat counts are automatically adjusted when members join or leave. Stripe handles proration so you only pay for what you use.

Team Roles

Each team member is assigned one of three roles:

Role	Permissions
Owner	Full control -- billing, member management, host management, all operations
Admin	Member management (invite, remove Members), host management, all operations
Member	Execute commands and file operations on team hosts

Role hierarchy: Owner > Admin > Member

Creating a Team

Create a new shared team with a name. You are automatically assigned as the Owner.

bash

nefia team create --name "My Team"

nefia team create --name "My Team"

Team "My Team" created (slug: my-team-a1b2c3d4)

Shared teams require a Team plan ($8/member/mo). Upgrade at: https://www.nefia.ai/dashboard/team

Next steps: nefia team use my-team-a1b2c3d4 Switch to this team

The team slug is auto-generated from the name and used for all CLI references.

Viewing the Active Team

Show details about the currently active team:

bash

nefia team

This is equivalent to nefia team current. It displays the team name, slug, plan, your role, and member/host counts.

nefia team

Active team: My Team Slug: my-team-a1b2c3d4 ID: clx... Plan: Team Role: OWNER Members: 3 Hosts: 5

If no shared team is active, it shows your personal (default) team.

Listing Teams

View all teams you belong to:

bash

nefia team list

nefia team list

SLUG NAME PLAN ROLE MEMBERS HOSTS

personal-abc12345 (personal) Free OWNER 1 2 my-team-a1b2c3d4 My Team Team OWNER 3 5 acme-corp-x9y8z7w6 ACME Corporation Team MEMBER 8 12

The * marker indicates the active team. All commands operate in the context of the active team by default.

Switching Teams

Switch your active team context. The selection is saved to the config file and persists across sessions.

bash

nefia team use my-team-a1b2c3d4

All subsequent commands will operate on hosts belonging to the selected team.

To switch back to your personal team:

bash

nefia team use personal

You can also override the team context per-command with the --team flag:

bash

nefia exec --team acme-corp-x9y8z7w6 --target all -- uptime

Or set the NEFIA_TEAM environment variable for the current shell session:

bash

export NEFIA_TEAM=acme-corp-x9y8z7w6
nefia exec --target all -- uptime  # operates in acme-corp team context

Inviting Members

Generate an invitation code for the currently active team. Requires the Admin or Owner role.

bash

nefia team invite

nefia team invite

Invitation code generated: Code: a8BkR3mXqY2nPw6vZ1cJdF9g Role: MEMBER Expires: 2026-03-06T09:00:00Z Max uses: 1 (used: 0)

Share this code: nefia team join a8BkR3mXqY2nPw6vZ1cJdF9g

Customize the invitation with optional flags:

bash

nefia team invite --role ADMIN --max-uses 5 --expires 168

Flag	Default	Description
`--role`	`MEMBER`	Role assigned to the joining user (`MEMBER` or `ADMIN`)
`--max-uses`	`1`	Number of times the invite code can be used (1-100)
`--expires`	`48` (2 days)	Expiration in hours (max: 168 = 7 days)

Joining a Team

Join a team using an invitation code:

bash

nefia team join a8BkR3mXqY2nPw6vZ1cJdF9g

nefia team join a8BkR3mXqY2nPw6vZ1cJdF9g

Joined team "My Team" as MEMBER Use 'nefia team list' to see your teams.

Viewing Team Members

List all members of the current team:

bash

nefia team members

nefia team members

EMAIL NAME ROLE JOINED

alice@example.com Alice Tanaka OWNER 2026-02-01T00:00:00Z bob@example.com Bob Suzuki ADMIN 2026-02-15T00:00:00Z carol@example.com Carol Yamada MEMBER 2026-03-01T00:00:00Z

Changing Member Roles

Owners can change a member's role:

bash

nefia team role user@example.com --role ADMIN

nefia team role carol@example.com --role ADMIN

Changed Carol Yamada's role to ADMIN

Flag	Description
`--role`	New role for the member (`ADMIN` or `MEMBER`)

Leaving a Team

Leave a team you no longer need access to:

bash

nefia team leave

You must have a shared team selected as active (nefia team use <slug>) before running this command. You cannot leave your personal team.

When you leave, the team's Stripe seat count is automatically reduced.

Team Hosts

Hosts enrolled under a team are shared with all team members (subject to policy rules). When you enroll a new host, it belongs to your currently active team:

bash

nefia team use my-team-a1b2c3d4
nefia vpn invite --name prod-server-1 --os linux
# prod-server-1 is now a host in the my-team team

View hosts in your local configuration:

bash

nefia hosts list

Web Dashboard

Teams can also be managed from the Nefia Web Dashboard at www.nefia.ai.

The dashboard currently provides:

Team overview -- view team name, slug, plan, and member count
Member management -- invite new members, remove members, and change roles
Plan management -- upgrade to the Team plan, manage Stripe subscription
Team switcher -- inspect another team in the Team page if you belong to multiple
Leave team -- leave a non-personal team with confirmation

The dashboard does not currently change the CLI's active team context. To switch the CLI, use nefia team use <slug>.

Profiles

Profile management allows operators to maintain multiple named configuration profiles. Each profile is a partial YAML override that is merged on top of the main config file at runtime. This is useful for switching between environments (e.g., development, staging, production) without modifying the main config.

Listing Profiles

bash

nefia profile list

nefia profile list

NAME DEFAULT

development * staging production

The * marker indicates the default profile.

Showing Profile Details

bash

nefia profile show development

Displays the full YAML overrides stored in the named profile.

Creating a Profile

bash

nefia profile create staging

Creates a new named profile. You can then edit the generated YAML file to add your overrides.

Deleting a Profile

bash

nefia profile delete staging

Removes the named profile. The default profile cannot be deleted until another profile is set as default.

Setting the Default Profile

bash

nefia profile set-default production

Sets the named profile as the default. The default profile is applied automatically when no --profile flag is specified.

Using a Profile Per-Command

All CLI commands accept the --profile flag to apply a specific profile for that invocation:

bash

nefia exec --profile production --target all -- uptime

When --profile is not specified, the default profile (if set) is used.

CLI Command Reference

Command	Description
`nefia team`	Show the active team (alias for `nefia team current`)
`nefia team current`	Show the active team details
`nefia team list`	List all teams you belong to
`nefia team use <slug>`	Switch the active team
`nefia team create --name "Name"`	Create a new shared team
`nefia team invite`	Generate an invitation code
`nefia team join <code>`	Join a team via invitation code
`nefia team members`	List members of the active team
`nefia team role <email> --role <role>`	Change a member's role (Owner only)
`nefia team leave`	Leave the active team
`nefia profile list`	List all available profiles
`nefia profile show <name>`	Show details of a specific profile
`nefia profile create <name>`	Create a new named profile
`nefia profile delete <name>`	Delete a named profile
`nefia profile set-default <name>`	Set a profile as the default

All team commands require authentication (nefia login). Commands that operate on a specific team (invite, members, role, leave) require an active shared team selected via nefia team use.

All commands support --output json for machine-readable output.

MCP Tools

AI agents can manage teams programmatically via MCP:

Tool	Description
`nefia.team.current`	Show the currently active team context.
`nefia.team.list`	List all teams you belong to.
`nefia.team.use`	Switch to a different team context.
`nefia.team.create`	Create a new team workspace.
`nefia.team.invite`	Generate a shareable invite code for the current team.
`nefia.team.join`	Join a team using an invite code.
`nefia.team.members`	List members of the current team with their roles.
`nefia.team.leave`	Leave the current team.
`nefia.team.role`	Change a team member's role (owner, admin, member).
`nefia.profile.list`	List all available configuration profiles.
`nefia.profile.show`	Show details and overrides of a named profile.
`nefia.profile.create`	Create a new named configuration profile.
`nefia.profile.delete`	Delete a named configuration profile.
`nefia.profile.set_default`	Set a profile as the default.

Host Management

Organize and manage target PCs with hosts, groups, and tag-based targeting.

CLI Reference

Full reference for all Nefia CLI commands and flags.