diff --git a/completions/mcpctl.bash b/completions/mcpctl.bash
index ff46bc9..bd4136b 100644
--- a/completions/mcpctl.bash
+++ b/completions/mcpctl.bash
@@ -2,84 +2,65 @@ _mcpctl() {
   local cur prev words cword
   _init_completion || return
 
-  local commands="config status get describe instance instances apply setup claude project projects backup restore help"
-  local global_opts="-v --version -o --output --daemon-url -h --help"
-  local resources="servers profiles projects instances"
+  local commands="status login logout config get describe delete logs create edit apply backup restore help"
+  local global_opts="-v --version --daemon-url --direct -h --help"
+  local resources="servers instances secrets templates projects users groups rbac"
 
   case "${words[1]}" in
     config)
-      COMPREPLY=($(compgen -W "view set path reset help" -- "$cur"))
+      if [[ $cword -eq 2 ]]; then
+        COMPREPLY=($(compgen -W "view set path reset claude-generate impersonate help" -- "$cur"))
+      fi
       return ;;
     status)
-      COMPREPLY=($(compgen -W "--daemon-url -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
+      return ;;
+    login)
+      COMPREPLY=($(compgen -W "--url --email --password -h --help" -- "$cur"))
+      return ;;
+    logout)
       return ;;
     get)
       if [[ $cword -eq 2 ]]; then
         COMPREPLY=($(compgen -W "$resources" -- "$cur"))
       else
-        COMPREPLY=($(compgen -W "-o --output --daemon-url -h --help" -- "$cur"))
+        COMPREPLY=($(compgen -W "-o --output -h --help" -- "$cur"))
       fi
       return ;;
     describe)
       if [[ $cword -eq 2 ]]; then
         COMPREPLY=($(compgen -W "$resources" -- "$cur"))
       else
-        COMPREPLY=($(compgen -W "-o --output --daemon-url -h --help" -- "$cur"))
+        COMPREPLY=($(compgen -W "-o --output --show-values -h --help" -- "$cur"))
       fi
       return ;;
-    instance|instances)
+    delete)
       if [[ $cword -eq 2 ]]; then
-        COMPREPLY=($(compgen -W "list ls start stop restart remove rm logs inspect help" -- "$cur"))
-      else
-        case "${words[2]}" in
-          logs)
-            COMPREPLY=($(compgen -W "--tail --since -h --help" -- "$cur"))
-            ;;
-          start)
-            COMPREPLY=($(compgen -W "--env --image -h --help" -- "$cur"))
-            ;;
-          list|ls)
-            COMPREPLY=($(compgen -W "--server-id -o --output -h --help" -- "$cur"))
-            ;;
-        esac
+        COMPREPLY=($(compgen -W "$resources" -- "$cur"))
       fi
       return ;;
-    claude)
+    edit)
       if [[ $cword -eq 2 ]]; then
-        COMPREPLY=($(compgen -W "generate show add remove help" -- "$cur"))
-      else
-        case "${words[2]}" in
-          generate|show|add|remove)
-            COMPREPLY=($(compgen -W "--path -p -h --help" -- "$cur"))
-            ;;
-        esac
+        COMPREPLY=($(compgen -W "servers projects" -- "$cur"))
       fi
       return ;;
-    project|projects)
+    logs)
+      COMPREPLY=($(compgen -W "--tail --since -f --follow -h --help" -- "$cur"))
+      return ;;
+    create)
       if [[ $cword -eq 2 ]]; then
-        COMPREPLY=($(compgen -W "list ls create delete rm show profiles set-profiles help" -- "$cur"))
-      else
-        case "${words[2]}" in
-          create)
-            COMPREPLY=($(compgen -W "--description -d -h --help" -- "$cur"))
-            ;;
-          list|ls)
-            COMPREPLY=($(compgen -W "-o --output -h --help" -- "$cur"))
-            ;;
-        esac
+        COMPREPLY=($(compgen -W "server secret project user group rbac help" -- "$cur"))
       fi
       return ;;
     apply)
       COMPREPLY=($(compgen -f -- "$cur"))
       return ;;
     backup)
-      COMPREPLY=($(compgen -W "-o --output -p --password -r --resources -h --help" -- "$cur"))
+      COMPREPLY=($(compgen -W "-o --output -p --password -h --help" -- "$cur"))
       return ;;
     restore)
       COMPREPLY=($(compgen -W "-i --input -p --password -c --conflict -h --help" -- "$cur"))
       return ;;
-    setup)
-      return ;;
     help)
       COMPREPLY=($(compgen -W "$commands" -- "$cur"))
       return ;;
diff --git a/completions/mcpctl.fish b/completions/mcpctl.fish
index 796bb37..e523ae9 100644
--- a/completions/mcpctl.fish
+++ b/completions/mcpctl.fish
@@ -1,73 +1,73 @@
 # mcpctl fish completions
 
-set -l commands config status get describe instance instances apply setup claude project projects backup restore help
+set -l commands status login logout config get describe delete logs create edit apply backup restore help
 
 # Disable file completions by default
 complete -c mcpctl -f
 
 # Global options
 complete -c mcpctl -s v -l version -d 'Show version'
-complete -c mcpctl -s o -l output -d 'Output format' -xa 'table json yaml'
-complete -c mcpctl -l daemon-url -d 'mcpd daemon URL' -x
+complete -c mcpctl -l daemon-url -d 'mcplocal daemon URL' -x
+complete -c mcpctl -l direct -d 'Bypass mcplocal, connect directly to mcpd'
 complete -c mcpctl -s h -l help -d 'Show help'
 
 # Top-level commands
-complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a config -d 'Manage configuration'
 complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a status -d 'Show status and connectivity'
+complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a login -d 'Authenticate with mcpd'
+complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a logout -d 'Log out'
+complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a config -d 'Manage configuration'
 complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a get -d 'List resources'
 complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a describe -d 'Show resource details'
-complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a instance -d 'Manage instances'
+complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a delete -d 'Delete a resource'
+complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a logs -d 'Get instance logs'
+complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a create -d 'Create a resource'
+complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a edit -d 'Edit a resource'
 complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a apply -d 'Apply configuration from file'
-complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a setup -d 'Interactive setup wizard'
-complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a claude -d 'Manage Claude .mcp.json'
-complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a project -d 'Manage projects'
 complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a backup -d 'Backup configuration'
 complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a restore -d 'Restore from backup'
 complete -c mcpctl -n "not __fish_seen_subcommand_from $commands" -a help -d 'Show help'
 
-# get/describe resources
-complete -c mcpctl -n "__fish_seen_subcommand_from get describe" -a 'servers profiles projects instances' -d 'Resource type'
+# Resource types for get/describe/delete/edit
+set -l resources servers instances secrets templates projects users groups rbac
+complete -c mcpctl -n "__fish_seen_subcommand_from get describe delete" -a "$resources" -d 'Resource type'
+complete -c mcpctl -n "__fish_seen_subcommand_from edit" -a 'servers projects' -d 'Resource type'
+
+# get/describe/delete options
+complete -c mcpctl -n "__fish_seen_subcommand_from get" -s o -l output -d 'Output format' -xa 'table json yaml'
+complete -c mcpctl -n "__fish_seen_subcommand_from describe" -s o -l output -d 'Output format' -xa 'detail json yaml'
+complete -c mcpctl -n "__fish_seen_subcommand_from describe" -l show-values -d 'Show secret values'
+
+# login options
+complete -c mcpctl -n "__fish_seen_subcommand_from login" -l url -d 'mcpd URL' -x
+complete -c mcpctl -n "__fish_seen_subcommand_from login" -l email -d 'Email address' -x
+complete -c mcpctl -n "__fish_seen_subcommand_from login" -l password -d 'Password' -x
 
 # config subcommands
-complete -c mcpctl -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from view set path reset" -a view -d 'Show configuration'
-complete -c mcpctl -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from view set path reset" -a set -d 'Set a config value'
-complete -c mcpctl -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from view set path reset" -a path -d 'Show config file path'
-complete -c mcpctl -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from view set path reset" -a reset -d 'Reset to defaults'
+set -l config_cmds view set path reset claude-generate impersonate
+complete -c mcpctl -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from $config_cmds" -a view -d 'Show configuration'
+complete -c mcpctl -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from $config_cmds" -a set -d 'Set a config value'
+complete -c mcpctl -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from $config_cmds" -a path -d 'Show config file path'
+complete -c mcpctl -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from $config_cmds" -a reset -d 'Reset to defaults'
+complete -c mcpctl -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from $config_cmds" -a claude-generate -d 'Generate .mcp.json'
+complete -c mcpctl -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from $config_cmds" -a impersonate -d 'Impersonate a user'
 
-# instance subcommands
-set -l instance_cmds list ls start stop restart remove rm logs inspect
-complete -c mcpctl -n "__fish_seen_subcommand_from instance instances; and not __fish_seen_subcommand_from $instance_cmds" -a list -d 'List instances'
-complete -c mcpctl -n "__fish_seen_subcommand_from instance instances; and not __fish_seen_subcommand_from $instance_cmds" -a start -d 'Start instance'
-complete -c mcpctl -n "__fish_seen_subcommand_from instance instances; and not __fish_seen_subcommand_from $instance_cmds" -a stop -d 'Stop instance'
-complete -c mcpctl -n "__fish_seen_subcommand_from instance instances; and not __fish_seen_subcommand_from $instance_cmds" -a restart -d 'Restart instance'
-complete -c mcpctl -n "__fish_seen_subcommand_from instance instances; and not __fish_seen_subcommand_from $instance_cmds" -a remove -d 'Remove instance'
-complete -c mcpctl -n "__fish_seen_subcommand_from instance instances; and not __fish_seen_subcommand_from $instance_cmds" -a logs -d 'Get logs'
-complete -c mcpctl -n "__fish_seen_subcommand_from instance instances; and not __fish_seen_subcommand_from $instance_cmds" -a inspect -d 'Inspect container'
-complete -c mcpctl -n "__fish_seen_subcommand_from instance instances; and __fish_seen_subcommand_from logs" -l tail -d 'Number of lines' -x
-complete -c mcpctl -n "__fish_seen_subcommand_from instance instances; and __fish_seen_subcommand_from logs" -l since -d 'Since timestamp' -x
+# create subcommands
+set -l create_cmds server secret project user group rbac
+complete -c mcpctl -n "__fish_seen_subcommand_from create; and not __fish_seen_subcommand_from $create_cmds" -a server -d 'Create a server'
+complete -c mcpctl -n "__fish_seen_subcommand_from create; and not __fish_seen_subcommand_from $create_cmds" -a secret -d 'Create a secret'
+complete -c mcpctl -n "__fish_seen_subcommand_from create; and not __fish_seen_subcommand_from $create_cmds" -a project -d 'Create a project'
+complete -c mcpctl -n "__fish_seen_subcommand_from create; and not __fish_seen_subcommand_from $create_cmds" -a user -d 'Create a user'
+complete -c mcpctl -n "__fish_seen_subcommand_from create; and not __fish_seen_subcommand_from $create_cmds" -a group -d 'Create a group'
+complete -c mcpctl -n "__fish_seen_subcommand_from create; and not __fish_seen_subcommand_from $create_cmds" -a rbac -d 'Create an RBAC binding'
 
-# claude subcommands
-set -l claude_cmds generate show add remove
-complete -c mcpctl -n "__fish_seen_subcommand_from claude; and not __fish_seen_subcommand_from $claude_cmds" -a generate -d 'Generate .mcp.json'
-complete -c mcpctl -n "__fish_seen_subcommand_from claude; and not __fish_seen_subcommand_from $claude_cmds" -a show -d 'Show .mcp.json'
-complete -c mcpctl -n "__fish_seen_subcommand_from claude; and not __fish_seen_subcommand_from $claude_cmds" -a add -d 'Add server entry'
-complete -c mcpctl -n "__fish_seen_subcommand_from claude; and not __fish_seen_subcommand_from $claude_cmds" -a remove -d 'Remove server entry'
-complete -c mcpctl -n "__fish_seen_subcommand_from claude; and __fish_seen_subcommand_from $claude_cmds" -s p -l path -d 'Path to .mcp.json' -rF
-
-# project subcommands
-set -l project_cmds list ls create delete rm show profiles set-profiles
-complete -c mcpctl -n "__fish_seen_subcommand_from project projects; and not __fish_seen_subcommand_from $project_cmds" -a list -d 'List projects'
-complete -c mcpctl -n "__fish_seen_subcommand_from project projects; and not __fish_seen_subcommand_from $project_cmds" -a create -d 'Create project'
-complete -c mcpctl -n "__fish_seen_subcommand_from project projects; and not __fish_seen_subcommand_from $project_cmds" -a delete -d 'Delete project'
-complete -c mcpctl -n "__fish_seen_subcommand_from project projects; and not __fish_seen_subcommand_from $project_cmds" -a show -d 'Show project'
-complete -c mcpctl -n "__fish_seen_subcommand_from project projects; and not __fish_seen_subcommand_from $project_cmds" -a profiles -d 'List profiles'
-complete -c mcpctl -n "__fish_seen_subcommand_from project projects; and not __fish_seen_subcommand_from $project_cmds" -a set-profiles -d 'Set profiles'
-complete -c mcpctl -n "__fish_seen_subcommand_from project projects; and __fish_seen_subcommand_from create" -s d -l description -d 'Description' -x
+# logs options
+complete -c mcpctl -n "__fish_seen_subcommand_from logs" -l tail -d 'Number of lines' -x
+complete -c mcpctl -n "__fish_seen_subcommand_from logs" -l since -d 'Since timestamp' -x
+complete -c mcpctl -n "__fish_seen_subcommand_from logs" -s f -l follow -d 'Follow log output'
 
 # backup options
 complete -c mcpctl -n "__fish_seen_subcommand_from backup" -s o -l output -d 'Output file' -rF
 complete -c mcpctl -n "__fish_seen_subcommand_from backup" -s p -l password -d 'Encryption password' -x
-complete -c mcpctl -n "__fish_seen_subcommand_from backup" -s r -l resources -d 'Resources to backup' -xa 'servers profiles projects'
 
 # restore options
 complete -c mcpctl -n "__fish_seen_subcommand_from restore" -s i -l input -d 'Input file' -rF
@@ -75,6 +75,7 @@ complete -c mcpctl -n "__fish_seen_subcommand_from restore" -s p -l password -d
 complete -c mcpctl -n "__fish_seen_subcommand_from restore" -s c -l conflict -d 'Conflict strategy' -xa 'skip overwrite fail'
 
 # apply takes a file
+complete -c mcpctl -n "__fish_seen_subcommand_from apply" -s f -l file -d 'Configuration file' -rF
 complete -c mcpctl -n "__fish_seen_subcommand_from apply" -F
 
 # help completions
diff --git a/src/cli/src/commands/delete.ts b/src/cli/src/commands/delete.ts
index 5bbed69..ba365aa 100644
--- a/src/cli/src/commands/delete.ts
+++ b/src/cli/src/commands/delete.ts
@@ -11,7 +11,7 @@ export function createDeleteCommand(deps: DeleteCommandDeps): Command {
   const { client, log } = deps;
 
   return new Command('delete')
-    .description('Delete a resource (server, instance, profile, project)')
+    .description('Delete a resource (server, instance, secret, project, user, group, rbac)')
     .argument('<resource>', 'resource type')
     .argument('<id>', 'resource ID or name')
     .action(async (resourceArg: string, idOrName: string) => {