diff --git a/cli_access.go b/cli_access.go
index dc54bc1..ed9c7b8 100644
--- a/cli_access.go
+++ b/cli_access.go
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"io/ioutil"
 	"net"
 	"net/http"
@@ -31,38 +32,43 @@ type runAccessResponseURLs struct {
 	TmeQrCode string `json:"tme_qrcode"`
 }
 
-func runAccess(cli *CLI) {
+type cliCommandAccess struct {
+	ConfigPath string `arg required type:"existingfile" help:"Path to the configuration file." name:"config-path"` // nolint: lll, govet
+	Hex        bool   `help:"Print secret in hex encoding."`
+}
+
+func (c *cliCommandAccess) Run(cli *CLI) error {
 	filefp, err := os.Open(cli.Access.ConfigPath)
 	if err != nil {
-		exit(err)
+		return fmt.Errorf("cannot open config file: %w", err)
 	}
 
 	defer filefp.Close()
 
 	conf, err := parseConfig(filefp)
 	if err != nil {
-		exit(err)
+		return fmt.Errorf("cannot parse config: %w", err)
 	}
 
 	ntw, err := makeNetwork(conf)
 	if err != nil {
-		exit(err)
+		return fmt.Errorf("cannot build a network: %w", err)
 	}
 
 	ipv4 := conf.Network.PublicIP.IPv4.Value(nil)
 	ipv6 := conf.Network.PublicIP.IPv6.Value(nil)
 
 	if ipv4 == nil {
-		ipv4 = runAccessGetIP(ntw, "tcp4")
+		ipv4 = c.getIP(ntw, "tcp4")
 	}
 
 	if ipv6 == nil {
-		ipv6 = runAccessGetIP(ntw, "tcp6")
+		ipv6 = c.getIP(ntw, "tcp6")
 	}
 
 	resp := runAccessResponse{
-		IPv4: runMakeAccessResponseURLs(ipv4, conf, cli),
-		IPv6: runMakeAccessResponseURLs(ipv6, conf, cli),
+		IPv4: c.makeResponseURLs(ipv4, conf, cli),
+		IPv6: c.makeResponseURLs(ipv6, conf, cli),
 	}
 	resp.Secret.Base64 = conf.Secret.Base64()
 	resp.Secret.Hex = conf.Secret.Hex()
@@ -73,11 +79,13 @@ func runAccess(cli *CLI) {
 	encoder.SetIndent("", "  ")
 
 	if err := encoder.Encode(resp); err != nil {
-		exit(err)
+		return fmt.Errorf("cannot dump access json: %w", err)
 	}
+
+	return nil
 }
 
-func runAccessGetIP(ntw *network.Network, protocol string) net.IP {
+func (c *cliCommandAccess) getIP(ntw *network.Network, protocol string) net.IP {
 	client := &http.Client{
 		Timeout: ntw.HTTP.Timeout,
 		Transport: &http.Transport{
@@ -106,7 +114,7 @@ func runAccessGetIP(ntw *network.Network, protocol string) net.IP {
 	return net.ParseIP(strings.TrimSpace(string(data)))
 }
 
-func runMakeAccessResponseURLs(ip net.IP, conf *config, cli *CLI) *runAccessResponseURLs {
+func (c *cliCommandAccess) makeResponseURLs(ip net.IP, conf *config, cli *CLI) *runAccessResponseURLs {
 	if ip == nil {
 		return nil
 	}
@@ -139,13 +147,13 @@ func runMakeAccessResponseURLs(ip net.IP, conf *config, cli *CLI) *runAccessResp
 		}).String(),
 	}
 
-	rv.TgQrCode = runMakeAccessResponseURLsQRCode(rv.TgURL)
-	rv.TmeQrCode = runMakeAccessResponseURLsQRCode(rv.TmeURL)
+	rv.TgQrCode = c.makeResponseQRCode(rv.TgURL)
+	rv.TmeQrCode = c.makeResponseQRCode(rv.TmeURL)
 
 	return rv
 }
 
-func runMakeAccessResponseURLsQRCode(data string) string {
+func (c *cliCommandAccess) makeResponseQRCode(data string) string {
 	values := url.Values{}
 
 	values.Set("qzone", "4")
diff --git a/cli_generate_secret.go b/cli_generate_secret.go
index 1c8af9a..d84466e 100644
--- a/cli_generate_secret.go
+++ b/cli_generate_secret.go
@@ -6,7 +6,12 @@ import (
 	"github.com/9seconds/mtg/v2/mtglib"
 )
 
-func runGenerateSecret(cli *CLI) {
+type cliCommandGenerateSecret struct {
+	HostName string `arg optional help:"Hostname to use for domain fronting. Default is '${domain_front}'." name:"hostname" default:"${domain_front}"` // nolint: lll, govet
+	Hex      bool   `help:"Print secret in hex encoding."`
+}
+
+func (c *cliCommandGenerateSecret) Run(cli *CLI) error { // nolint: unparam
 	secret := mtglib.GenerateSecret(cli.GenerateSecret.HostName)
 
 	if cli.GenerateSecret.Hex {
@@ -14,4 +19,6 @@ func runGenerateSecret(cli *CLI) {
 	} else {
 		fmt.Println(secret.Base64()) // nolint: forbidigo
 	}
+
+	return nil
 }
diff --git a/main.go b/main.go
index 0b78ac4..b4cf3f6 100644
--- a/main.go
+++ b/main.go
@@ -10,18 +10,9 @@ import (
 var version = "dev" // has to be set by ldflags
 
 type CLI struct {
-	GenerateSecret struct { // nolint: govet
-		HostName string `arg optional help:"Hostname to use for domain fronting. Default is '${domain_front}'." name:"hostname" default:"${domain_front}"` // nolint: lll, govet
-		Hex      bool   `help:"Print secret in hex encoding."`
-	} `cmd help:"Generate new proxy secret."`
-	Access struct { // nolint: govet
-		ConfigPath string `arg required type:"existingfile" help:"Path to the configuration file." name:"config-path"` // nolint: lll, govet
-		Hex        bool   `help:"Print secret in hex encoding."`
-	} `cmd help:"Print access information."`
-	Run struct { // nolint: govet
-		ConfigPath string `arg required type:"existingfile" help:"Path to the configuration file." name:"config-path"` // nolint: lll, govet
-	} `cmd help:"Run proxy."`
-	Version kong.VersionFlag `help:"Print version."`
+	GenerateSecret cliCommandGenerateSecret `cmd help:"Generate new proxy secret"` // nolint: govet
+	Access         cliCommandAccess         `cmd help:"Print access information."` // nolint: govet
+	Version        kong.VersionFlag         `help:"Print version."`
 }
 
 func main() {
@@ -30,18 +21,8 @@ func main() {
 	cli := &CLI{}
 	ctx := kong.Parse(cli, kong.Vars{
 		"domain_front": "amazonaws.com",
-		"config_path":  "/etc/mtg.toml",
 		"version":      version,
 	})
 
-	switch ctx.Command() {
-	case "generate-secret":
-		runGenerateSecret(cli)
-	case "access <config-path>":
-		runAccess(cli)
-	case "run <config-path>":
-		panic("not implemented yet")
-	default:
-		panic(ctx.Command())
-	}
+	ctx.FatalIfErrorf(ctx.Run(cli))
 }
diff --git a/utils.go b/utils.go
index c2a11ae..1c46d27 100644
--- a/utils.go
+++ b/utils.go
@@ -7,16 +7,10 @@ import (
 	"net"
 	"net/http"
 	"net/url"
-	"os"
 
 	"github.com/9seconds/mtg/v2/mtglib/network"
 )
 
-func exit(err error) {
-	fmt.Fprintln(os.Stderr, err.Error())
-	os.Exit(1)
-}
-
 func makeNetwork(conf *config) (*network.Network, error) {
 	tcpTimeout := conf.Network.Timeout.TCP.Value(network.DefaultTimeout)
 	httpTimeout := conf.Network.Timeout.TCP.Value(network.DefaultHTTPTimeout)