diff --git a/cli_generate_secret.go b/cli_generate_secret.go
new file mode 100644
index 0000000..d0edfa3
--- /dev/null
+++ b/cli_generate_secret.go
@@ -0,0 +1,17 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/9seconds/mtg/v2/mtglib"
+)
+
+func runGenerateSecret(cli *CLI) {
+	secret := mtglib.GenerateSecret(cli.GenerateSecret.HostName)
+
+	if cli.GenerateSecret.Hex {
+		fmt.Println(secret.EE())
+	} else {
+		fmt.Println(secret.Base64())
+	}
+}
diff --git a/go.mod b/go.mod
index 910aef8..20cbeb9 100644
--- a/go.mod
+++ b/go.mod
@@ -3,6 +3,7 @@ module github.com/9seconds/mtg/v2
 go 1.16
 
 require (
+	github.com/alecthomas/kong v0.2.16
 	github.com/alecthomas/units v0.0.0-20210208195552-ff826a37aa15
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
 	github.com/babolivier/go-doh-client v0.0.0-20201028162107-a76cff4cb8b6
diff --git a/go.sum b/go.sum
index 497262e..73e7830 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,5 @@
+github.com/alecthomas/kong v0.2.16 h1:F232CiYSn54Tnl1sJGTeHmx4vJDNLVP2b9yCVMOQwHQ=
+github.com/alecthomas/kong v0.2.16/go.mod h1:kQOmtJgV+Lb4aj+I2LEn40cbtawdWJ9Y8QLq+lElKxE=
 github.com/alecthomas/units v0.0.0-20210208195552-ff826a37aa15 h1:AUNCr9CiJuwrRYS3XieqF+Z9B9gNxo/eANAJCF2eiN4=
 github.com/alecthomas/units v0.0.0-20210208195552-ff826a37aa15/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
@@ -18,6 +20,7 @@ github.com/mccutchen/go-httpbin v1.1.1 h1:aEws49HEJEyXHLDnshQVswfUlCVoS8g6h9YaDy
 github.com/mccutchen/go-httpbin v1.1.1/go.mod h1:fhpOYavp5g2K74XDl/ao2y4KvhqVtKlkg1e+0UaQv7I=
 github.com/pelletier/go-toml v1.8.1 h1:1Nf83orprkJyknT6h7zbuEGUEjcyVlCxSUGTENmNCRM=
 github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -25,6 +28,7 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.3.0 h1:NGXK3lHquSN08v5vWalVI/L8XU9hdzE/G6xsrze47As=
 github.com/stretchr/objx v0.3.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
diff --git a/main.go b/main.go
index 61e5db8..a45e0a8 100644
--- a/main.go
+++ b/main.go
@@ -1,18 +1,41 @@
 package main
 
 import (
-	"fmt"
 	"math/rand"
-	"os"
 	"time"
+
+	"github.com/alecthomas/kong"
 )
 
 var version = "dev" // has to be set by ldflags
 
+type CLI struct {
+	GenerateSecret struct {
+		HostName string `arg optional help:"Hostname to use for domain fronting. Default is '${domain_front}'." name:"hostname" default:"${domain_front}"`
+		Hex      bool   `help:"Print secret in hex encoding."`
+	} `cmd help:"Generate new proxy secret."`
+	Access struct {
+		ConfigPath string `arg required type:"existingfile" help:"Path to the configuration file." name:"config-path"`
+	} `cmd help:"Print access information."`
+	Run struct {
+		ConfigPath string `arg required type:"existingfile" help:"Path to the configuration file." name:"config-path"`
+	} `cmd help:"Run proxy."`
+}
+
 func main() {
 	rand.Seed(time.Now().UTC().UnixNano())
 
-	f, _ := os.Open("example.config.toml")
+	cli := &CLI{}
+	ctx := kong.Parse(cli, kong.Vars{
+		"domain_front": "amazonaws.com",
+		"config_path":  "/etc/mtg.toml",
+	})
 
-	fmt.Println(parseConfig(f))
+	switch ctx.Command() {
+	case "generate-secret":
+		runGenerateSecret(cli)
+	case "access":
+	case "run":
+		panic("not implemented yet")
+	}
 }