Lepton AI

The Python library and lep CLI for NVIDIA DGX Cloud Lepton

Homepage • Examples • Documentation • CLI References

The LeptonAI Python library lets you operate the NVIDIA DGX Cloud Lepton platform from Python and the command line. Key features include:

• A lep command-line tool to create and manage endpoints, batch jobs, dev pods, Ray clusters, fine-tuning jobs, storage, secrets, and more, plus inspect managed Slurm clusters and jobs.
• A Client to call your deployed endpoints like native Python functions.
• Pythonic configuration specs that are readily shipped to the cloud.
• Skills that let agents operate the Lepton platform for you.

Getting started

Install the library, which also installs the lep command-line tool:

pip install -U leptonai

Log in to your workspace (this opens a browser to fetch credentials if you don't pass them in):

lep login

Deploy a container image as an endpoint, then inspect it:

lep endpoint create -n my-endpoint --container-image my-registry/my-app:latest
lep endpoint list
lep endpoint status -n my-endpoint

In workspaces with secure endpoint defaults enabled, an endpoint created without --tokens is protected automatically. The create command prints the generated API token; save that value so clients can authenticate. You can instead provide one or more repeatable --tokens values, or explicitly opt out with --allow-unauthenticated-access (the CLI displays a warning). The --public option only controls IP reachability and does not disable API-token authentication. lep endpoint status reports these dimensions separately as IP Access and API Token Authentication.

SDK callers that leave endpoint authentication unspecified should use client.deployment.create_with_response(...) and save the token from the returned resource. The older create(...) method keeps its boolean return contract and cannot return a server-generated credential, so it emits a RuntimeWarning for requests that may ask the server to generate one. SDK updates may not clear api_tokens by sending an empty list alone: set allow_unauthenticated_access=true in the same update, or replace the list with at least one token.

lep endpoint get redacts literal tokens by default. Use --show-tokens only when you need a credential-bearing response or reusable spec export, and handle that output as a secret. The former hidden update --remove-tokens option is rejected; use --allow-unauthenticated-access for an explicit opt-out.

Authentication-mode updates are explicit:

# Replace tokens and enable token authentication
lep endpoint update -n my-endpoint --tokens MY_TOKEN

# Clear tokens and explicitly allow requests without API-token authentication
lep endpoint update -n my-endpoint --allow-unauthenticated-access

You can also launch batch jobs and dev pods:

# Run a batch job
lep job create -n my-job --container-image my-registry/my-trainer:latest --command "python train.py"

# Launch an interactive dev pod
lep pod create -n my-pod --resource-shape gpu.a10

# Connect to a pod with Teleport SSH enabled (requires local tsh)
lep pod ssh -n my-pod --transport teleport

Pod, Job, and Node Teleport SSH require tsh v18 or newer in your PATH. The CLI checks the client version before reading login profiles or starting SSO; missing, older, or unrecognized clients produce an actionable error. This minimum version check does not guarantee compatibility with every Teleport cluster version.

Teleport SSH reuses your local Teleport login, or starts SSO login when needed. The default connector is Starfleet; use --teleport-auth <connector> to override it. Lepton API credentials and Teleport login are separate. Your workspace, node group, and pod must have Teleport enabled. This currently supports legacy Pods; the new DevPod API does not yet publish Teleport connection details. Without --transport teleport, lep pod ssh continues to use direct SSH.

Jobs can also be accessed through Teleport when their workspace has job_teleport enabled and their image/entrypoint starts a Teleport agent:

lep job replicas --id <job-id>
lep job ssh --id <job-id> --replica <replica-id>
# Or select a uniquely named job (a single ready replica is selected automatically)
lep job ssh --name <job-name>
# Specify the proxy when you have not logged in, or to switch from another proxy
lep job ssh --id <job-id> --replica <replica-id> --teleport-proxy <host>:443

Job SSH defaults to the active tsh profile because the Job API does not publish Teleport connection details. It uses the standard Lepton agent's <workspace-id>-<replica-id> hostname and workspace label to find one node, then connects to its Teleport node ID as root. Historical and unready replicas are excluded; multiple ready replicas require --replica. Job SSH does not install the agent or change the workload's startup command. Use --teleport-auth to override the default Starfleet SSO connector.

Slurm compute nodes also support Teleport SSH:

lep node list-nodes --node-group <node-group>
lep node ssh --node-group <node-group-name-or-id> --id <node-id>

Node SSH discovers the Slurm cluster, Teleport proxy, Machine hostname, and Linux account automatically. Use a personal API token with workspace user or admin access; Teleport sign-in must match that token's owner. The compute group must enable Teleport and use host networking. For clusters using Pod Networking, open a running Slurm Job you own in the TUI and select an allocated node instead. The session opens in the compute container; Slurm account permissions and job allocation policies still apply. Use --teleport-auth to override the SSO connector.

For a workspace with managed Slurm, inspect clusters and jobs:

lep slurm cluster list --name prod --status Ready
lep slurm cluster shell -n production
lep slurm job list --cluster production --status Running --include-archived
lep slurm job attempts -i 12345 --steps
lep slurm job logs -n my-training-job --follow
lep slurm devpod get --cluster production
lep slurm devpod ssh --cluster production

Personal Slurm Dev Pods are available under lep slurm devpod; run lep slurm --help for the complete command tree. devpod get shows the effective configuration, identity, connection details, and dashboard link; devpod ssh runs the bastion command reported by the platform. Slurm job submission and cancellation remain native Slurm operations (sbatch, squeue, scancel) on the cluster rather than Lepton API mutations.

Run lep --help, or lep <command> --help for any subcommand, to explore everything. See the CLI references for the full guide.

Calling an endpoint from Python

Once an endpoint is running, call it from Python with the Client. It reads the endpoint's OpenAPI schema and exposes each path as a method:

from leptonai.client import Client, local

# Connect to a workspace endpoint...
c = Client("my-workspace", "my-endpoint", token="MY_TOKEN")
# ...or to something running locally:
c = Client(local(port=8080))

# Discover the available paths and their docs
print(c.paths())
print(c.run.__doc__)

# Call the endpoint as if it were a local function
print(c.run(inputs="hello world"))

Checking out more examples

You can find more examples in the examples repository, and full guides in the documentation.

Skills: Operating Lepton from Claude Code or Codex

This repo ships an agent skill that lets Claude Code (or Codex) drive the lep CLI for you — listing endpoints, inspecting jobs and dev pods, checking workspace status, and managing workloads, all from natural language. It uses the same lep CLI installed above, so make sure it is authenticated to your workspace.

The plugin lives under plugins/lepton-cli with per-agent manifests for Claude Code, Codex, and Cursor (.claude-plugin/, .codex-plugin/, .cursor-plugin/), all sharing the one skill at skills/lepton-cli. It is listed in two marketplaces in this repo: .claude-plugin/marketplace.json for Claude Code and .agents/plugins/marketplace.json for Codex.

Codex — add this repo as a marketplace, then install the plugin:

codex plugin marketplace add leptonai/leptonai
codex plugin add lepton-cli@lepton-skills

Or browse interactively: run /plugins in the Codex CLI (or open Plugins in the Codex app), find Lepton CLI, and install.

Claude Code — install from the Lepton marketplace in one line, nothing to clone:

/plugin marketplace add leptonai/leptonai
/plugin install lepton-cli@lepton-skills

Start a new session, then ask something like "List the endpoints in my Lepton workspace." The skill asks for explicit confirmation before any command that modifies or deletes a workload.

# Codex
cp -R plugins/lepton-cli/skills/lepton-cli "${CODEX_HOME:-$HOME/.codex}/skills/lepton-cli"
# Claude Code (personal skill)
cp -R plugins/lepton-cli/skills/lepton-cli "$HOME/.claude/skills/lepton-cli"

Contributing

This repository uses uv to manage its Python environment and dependencies. After installing uv, run these commands from the repository root:

uv sync --locked
uv run lep --help

This installs the local source and development tools into .venv, using the Python version in .python-version and the dependencies in uv.lock. Use uv run lep to run the CLI without activating the environment.

Contributions and collaborations are welcome and highly appreciated. Please check out the contributor guide for how to get involved.

License

The Lepton AI Python library is released under the Apache 2.0 license.

Developer Note: early development of LeptonAI was in a separate mono-repo, which is why you may see commits from the leptonai/lepton repo. We intend to use this open source repo as the source of truth going forward.