> ## Documentation Index > Fetch the complete documentation index at: https://orbit.nckrtl.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # extension > Enable or disable optional Gateway extensions for every Orbit client. An extension is an optional Gateway feature. Each extension has one switch, and the Gateway stores it. The switch decides for every client whether the extension's CLI commands, MCP tools, API operations, and web pages are available. A disabled extension is invisible in every client, and the Gateway refuses its operations. ## Commands | Command | Result | | - | - | | [`extension:list`](#orbit-extensionlist) | List the extensions and their state. | | [`extension:enable`](#orbit-extensionenable) | Enable one extension for every client. | | [`extension:disable`](#orbit-extensiondisable) | Disable one extension for every client. | Each command accepts `--json`. Enable and disable need Gateway access. ## Extensions | Extension | What it adds | | - | - | | `tasks` | The [`tasks`](/docs/cli/tasks) family, its MCP tools and API operations, and the Tasks pages. See [Tasks](/docs/reference/tasks). | | `proxycli` | The [`proxycli`](/docs/cli/proxycli) family, its MCP tools and API operations, and the Quota pages. See [proxycli](/docs/reference/proxycli). | ## What a disabled extension does | Client | Behavior | | - | - | | API | The operations stay registered. Each one refuses with HTTP 409 `extension.disabled` and changes nothing. | | MCP | `tools/list` and `/mcp/search` omit the tools. A direct `tools/call` or `execute_tools` call returns a tool error with `extension.disabled`. See [MCP errors](/docs/reference/mcp#tools). A connected client sees the change when it lists the tools again. See [tool list changes](/docs/reference/mcp#tool-list-changes). | | CLI | `list`, `help`, and completion hide the family. A direct call reaches the Gateway, which refuses it with `extension.disabled`. | | Web app | Navigation hides the extension's pages. The app reads the switches every 30 seconds. | `tasks:status` is a core view. It stays available while `tasks` is disabled. Disabling an extension keeps its data, such as tasks or the proxycli collector. A nested empty object in a tool argument stays an object through a direct `tools/call` and through `execute_tools`. [MCP](/docs/reference/mcp) describes that shape. ## Extension state in the CLI The CLI asks the Gateway for the switches at most once per process: when it lists commands or shows help, when it runs `extension:list`, and when it runs an extension command. The request has a 2-second deadline, which includes its one retry after a connection failure. The CLI stores no copy. When the CLI cannot read the switches, the state is unknown, not disabled. This happens when no Gateway profile is active, the Gateway CA is not trusted, or the Gateway does not answer in time. * `extension:list` shows `UNKNOWN` and the cause, such as `gateway.profile_missing`, `gateway.ca_untrusted`, or `gateway.unreachable`. * `list` and `help` hide the extension commands. * An extension command fails with `extension.state_unknown` and sends no request. The `gateway:*` commands need no extension state, so you can add, select, trust, or remove a profile and try again. ## orbit extension:list List every extension with its Gateway state. ```bash theme={"dark"} orbit extension:list [--json] ``` Human output is a table with the columns EXTENSION, STATE, and DETAIL. JSON returns an `extensions` array. Each entry has `extension` and `enabled`, which is null when the state is unknown. An unknown entry also has `state`, with the error `code`, `message`, and `request_id`. ## orbit extension:enable Enable one extension for every client. ```bash theme={"dark"} orbit extension:enable [--json] ``` | Argument | Required | Meaning | | - | - | - | | `extension` | yes | `tasks` or `proxycli`. | JSON returns `name` and `enabled`. Enabling an enabled extension succeeds and changes nothing. Enabling only flips the switch. An extension that needs fleet resources has its own setup command, such as [`proxycli:setup`](/docs/cli/proxycli#orbit-proxyclisetup). ## orbit extension:disable Disable one extension for every client. ```bash theme={"dark"} orbit extension:disable [--json] ``` | Argument | Required | Meaning | | - | - | - | | `extension` | yes | `tasks` or `proxycli`. | JSON returns `name` and `enabled`. Disabling a disabled extension succeeds and changes nothing. Disabling `proxycli` does not stop its collector. Run [`proxycli:teardown`](/docs/cli/proxycli#orbit-proxycliteardown) for that. ## Errors | Code | Meaning | | - | - | | `extension.unknown` | The CLI does not know the slug. It sends no request. The API and MCP refuse an unknown slug with `validation.failed` (422). | | `extension.disabled` | The extension is disabled at the Gateway (HTTP 409). | | `extension.state_unknown` | The CLI could not read the switches, so it ran no extension command. | ## Why it works this way Each extension has one switch, and the Gateway owns it. A switch on each operator's machine could not hide Gateway routes, MCP tools, or web pages, so two operators could see different products. A cached copy in the CLI would become a second source of truth, so the CLI asks the Gateway in each process. The switch only shows or hides. Setting up proxycli needs a Node, a cache connection, an upstream URL, and a key, so that stays in the extension's own setup command. Every extension then keeps the same small switch contract, and one extension has one switch name. API routes stay registered while an extension is off and refuse with `extension.disabled`. Removing routes at runtime would make the OpenAPI document, the SDK, and the generated MCP tools change with runtime state. MCP filters tools before listing, search, and execution, so no path can find or run a disabled tool. An unknown state is not a disabled state. Treating an unreachable Gateway as "disabled" would hide commands for a reason that has nothing to do with the switch, and the operator would look in the wrong place. ## Related * [`tasks`](/docs/cli/tasks) describes task operations. * [`proxycli`](/docs/cli/proxycli) describes collector setup, teardown, and quota commands. * [Using the CLI](/docs/cli/overview#select-a-gateway) describes Gateway selection. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.