CLI reference

netclamp.exe is the command-line client. It talks to the local service on 127.0.0.1:9845 using the same bearer token the SPA uses (read from C:\ProgramData\NetClamp\auth.token by default).

The installer puts the install directory on PATH, so netclamp is reachable from any shell.

Global options

--host <addr>

API host. Default 127.0.0.1.

--port <n>

API port. Default 9845.

--token <value>

Override the bearer token. Otherwise read from auth.token or $env:NETCLAMP_TOKEN.

--json

Print raw JSON instead of the formatted human view.

-v, --verbose

Increase log verbosity.

--help

Help text. Works on every subcommand.

Subcommands

`netclamp status`

Show service health: WFP active, kdrv active, active rules, active connections, uptime, competing shapers detected, BFE restart count.

netclamp status --json

`netclamp rule`

Manage rules.

# List
netclamp rule list

# Create
netclamp rule create `
    --name "Block Discord" `
    --app "C:\Users\me\AppData\Local\Discord\app-1.0.0\Discord.exe" `
    --action block --direction both --priority 100

# Update
netclamp rule update 5 --enabled false

# Delete
netclamp rule delete 5

# Retry a broken rule
netclamp rule retry 5

`netclamp quota`

Manage quotas. Same list / create / update / delete / reset verbs.

netclamp quota create `
    --name "Spotify 2 GB/day" `
    --app "C:\Users\me\AppData\Roaming\Spotify\Spotify.exe" `
    --window daily --bytes 2GB `
    --throttle 200KB/s

`netclamp license`

# Show current cap, used, baseline, bound credits, HWID hash
netclamp license info

# Activate a credit token (paste payload.signature)
netclamp license activate "<payload.signature>"

# Release a credit so it can be bound to a different machine
netclamp license release <credit-id>

# Re-bind a released credit to this machine
netclamp license rebind "<unbound-token>"

`netclamp diag`

Diagnostic counters and tools.

# Snapshot WFP / kdrv counters
netclamp diag dump

# Real-traffic shaper test against a CapKBps target
netclamp diag shaper --cap 200 --payload 5

`netclamp config`

netclamp config get
netclamp config set logging.level=debug
netclamp config reload     # picks up changes to config.toml without restart

`netclamp ruleset`

Install or subscribe to rule bundles.

netclamp ruleset install path\to\bundle.json
netclamp ruleset subscribe https://policy.example.com/bundle.json --interval 3600
netclamp ruleset list
netclamp ruleset remove <id>

Exit codes

0

Success.

1

Generic failure. Stderr has the reason.

2

Argument parse error.

3

API request failed (network / auth / 5xx).

4

Operation succeeded on the wire but server reported a per-row failure (e.g. one of three rules in a bundle is broken — the rest installed cleanly).

Scripting examples

PowerShell — block any app whose Total bytes exceeded 1 GB today:

netclamp rule list --json | ConvertFrom-Json | Where-Object { $_.total_bytes -gt 1GB } | ForEach-Object {
    netclamp rule create --name "Auto-block $($_.app_path)" --app $_.app_path --action block
}