Every endpoint, three more ways.

One file, no dependencies. It needs Node.js 22.18 or later.

curl -fsSLo orbit.mjs https://orbit.yunzheng.space/cli/orbit.mjs
node orbit.mjs --help

Commands are grouped by product: dns, shield, pages, link, verify, mail, meet, vgate and the rest. node orbit.mjs dns --help lists a product's commands; add --help to any command for its fields.

Create a token on the API page of the console, then save it as a profile. A read-only token is enough for everything that only looks.

node orbit.mjs login --token orb_…
node orbit.mjs whoami

node orbit.mjs dns zones list
node orbit.mjs dns records create 42 --name www --type A --content 192.0.2.10 --ttl 300
node orbit.mjs dns records list 42 --all --json
node orbit.mjs shield sites purge 7 --urls /index.html,/app.js

• Ids are positional: the zone, then the record.
• --json prints the answer as it came; --all follows every page of a list.
• Deleting asks first; pass --yes in scripts.

Describe zones, records and Shield sites in a file kept with your code. plan shows what would change; apply makes the account match.

export default {
  zones: [{
    name: "example.com",
    records: [
      { name: "www", type: "A", content: "192.0.2.10", ttl: 300 },
      { name: "@", type: "MX", content: "10 mx.example.com" },
    ],
  }],
  sites: [{ hostname: "www.example.com", origin: "192.0.2.10", force_https: true }],
};

node orbit.mjs plan -f orbit.config.ts
node orbit.mjs apply -f orbit.config.ts

• A record set (name and type) the file lists is made exactly as written; sets it does not list are left alone unless the zone says prune: true.
• plan exits with code 2 when there are changes, so a pipeline can stop on drift.
• apply asks before changing anything; --yes skips the question.
• JSON works too: orbit.config.json.

The MCP server offers every endpoint as a tool. Add it to any client that supports remote MCP servers, with your token as the Authorization header.

{
  "mcpServers": {
    "orbit": {
      "url": "https://dash.yunzheng.space/mcp",
      "headers": { "Authorization": "Bearer orb_…" }
    }
  }
}

• A read-only token lists read tools only. Add ?readonly=1 to the address to keep a write token read-only for this client.
• Tools that change the account return a preview first; the agent asks you, then calls again to confirm.
• Fewer tools for a smaller context: ?products=dns,shield.

In a browser with an agent built in, the console offers tools for the page you are on: list, add and delete records on a zone, show a Shield site and purge its cache. They act with your own sign-in, and deleting or purging asks you on screen first.