diff --git a/docs/cli/approvals.md b/docs/cli/approvals.md
index 85243e557b2..9381bd0ced9 100644
--- a/docs/cli/approvals.md
+++ b/docs/cli/approvals.md
@@ -11,6 +11,8 @@ title: "approvals"
 Manage exec approvals for the **local host**, **gateway host**, or a **node host**.
 By default, commands target the local approvals file on disk. Use `--gateway` to target the gateway, or `--node` to target a specific node.
 
+Alias: `openclaw exec-approvals`
+
 Related:
 
 - Exec approvals: [Exec approvals](/tools/exec-approvals)
@@ -41,10 +43,15 @@ Precedence is intentional:
 
 ```bash
 openclaw approvals set --file ./exec-approvals.json
+openclaw approvals set --stdin <<'EOF'
+{ version: 1, defaults: { security: "full", ask: "off" } }
+EOF
 openclaw approvals set --node <id|name|ip> --file ./exec-approvals.json
 openclaw approvals set --gateway --file ./exec-approvals.json
 ```
 
+`set` accepts JSON5, not only strict JSON. Use either `--file` or `--stdin`, not both.
+
 ## "Never prompt" / YOLO example
 
 For a host that should never stop on exec approvals, set the host approvals defaults to `full` + `off`:
@@ -103,6 +110,24 @@ openclaw approvals allowlist add --agent "*" "/usr/bin/uname"
 openclaw approvals allowlist remove "~/Projects/**/bin/rg"
 ```
 
+## Common options
+
+`get`, `set`, and `allowlist add|remove` all support:
+
+- `--node <id|name|ip>`
+- `--gateway`
+- shared node RPC options: `--url`, `--token`, `--timeout`, `--json`
+
+Targeting notes:
+
+- no target flags means the local approvals file on disk
+- `--gateway` targets the gateway host approvals file
+- `--node` targets one node host after resolving id, name, IP, or id prefix
+
+`allowlist add|remove` also supports:
+
+- `--agent <id>` (defaults to `*`)
+
 ## Notes
 
 - `--node` uses the same resolver as `openclaw nodes` (id, name, ip, or id prefix).
diff --git a/docs/cli/hooks.md b/docs/cli/hooks.md
index 41c955efac1..e4302268eeb 100644
--- a/docs/cli/hooks.md
+++ b/docs/cli/hooks.md
@@ -10,6 +10,8 @@ title: "hooks"
 
 Manage agent hooks (event-driven automations for commands like `/new`, `/reset`, and gateway startup).
 
+Running `openclaw hooks` with no subcommand is equivalent to `openclaw hooks list`.
+
 Related:
 
 - Hooks: [Hooks](/automation/hooks)
@@ -67,7 +69,7 @@ Show detailed information about a specific hook.
 
 **Arguments:**
 
-- `<name>`: Hook name (e.g., `session-memory`)
+- `<name>`: Hook name or hook key (e.g., `session-memory`)
 
 **Options:**
 
@@ -125,7 +127,7 @@ Not ready: 0
 openclaw hooks enable <name>
 ```
 
-Enable a specific hook by adding it to your config (`~/.openclaw/config.json`).
+Enable a specific hook by adding it to your config (`~/.openclaw/openclaw.json` by default).
 
 **Note:** Workspace hooks are disabled by default until enabled here or in config. Hooks managed by plugins show `plugin:<id>` in `openclaw hooks list` and can’t be enabled/disabled here. Enable/disable the plugin instead.
 
@@ -186,6 +188,11 @@ openclaw hooks disable command-logger
 
 - Restart the gateway so hooks reload
 
+## Notes
+
+- `openclaw hooks list --json`, `info --json`, and `check --json` write structured JSON directly to stdout.
+- Plugin-managed hooks cannot be enabled or disabled here; enable or disable the owning plugin instead.
+
 ## Install Hook Packs
 
 ```bash
diff --git a/docs/cli/index.md b/docs/cli/index.md
index cee7469edc8..cc120410df4 100644
--- a/docs/cli/index.md
+++ b/docs/cli/index.md
@@ -978,6 +978,48 @@ Options:
 
 See [`acp`](/cli/acp) for full behavior, security notes, and examples.
 
+### `mcp`
+
+Manage saved MCP server definitions and expose OpenClaw channels over MCP stdio.
+
+#### `mcp serve`
+
+Expose routed OpenClaw channel conversations over MCP stdio.
+
+Options:
+
+- `--url <url>`
+- `--token <token>`
+- `--token-file <path>`
+- `--password <password>`
+- `--password-file <path>`
+- `--claude-channel-mode <auto|on|off>`
+- `--verbose`
+
+#### `mcp list`
+
+List saved MCP server definitions.
+
+Options:
+
+- `--json`
+
+#### `mcp show [name]`
+
+Show one saved MCP server definition or the full saved MCP server object.
+
+Options:
+
+- `--json`
+
+#### `mcp set <name> <value>`
+
+Save one MCP server definition from a JSON object.
+
+#### `mcp unset <name>`
+
+Remove one saved MCP server definition.
+
 ### `approvals`
 
 Manage exec approvals. Alias: `exec-approvals`.
diff --git a/docs/cli/mcp.md b/docs/cli/mcp.md
index f9bee6bf09e..03623419bf8 100644
--- a/docs/cli/mcp.md
+++ b/docs/cli/mcp.md
@@ -382,6 +382,13 @@ Commands:
 - `openclaw mcp set <name> <json>`
 - `openclaw mcp unset <name>`
 
+Notes:
+
+- `list` sorts server names.
+- `show` without a name prints the full configured MCP server object.
+- `set` expects one JSON object value on the command line.
+- `unset` fails if the named server does not exist.
+
 Examples:
 
 ```bash
diff --git a/docs/cli/secrets.md b/docs/cli/secrets.md
index baefdc91886..07d9d8395a9 100644
--- a/docs/cli/secrets.md
+++ b/docs/cli/secrets.md
@@ -49,6 +49,7 @@ Re-resolve secret refs and atomically swap runtime snapshot.
 ```bash
 openclaw secrets reload
 openclaw secrets reload --json
+openclaw secrets reload --url ws://127.0.0.1:18789 --token <token>
 ```
 
 Notes:
@@ -57,6 +58,13 @@ Notes:
 - If resolution fails, gateway keeps last-known-good snapshot and returns an error (no partial activation).
 - JSON response includes `warningCount`.
 
+Options:
+
+- `--url <url>`
+- `--token <token>`
+- `--timeout <ms>`
+- `--json`
+
 ## Audit
 
 Scan OpenClaw state for:
@@ -134,6 +142,7 @@ Notes:
 - Apply path is one-way for scrubbed plaintext values.
 - Without `--apply`, CLI still prompts `Apply this plan now?` after preflight.
 - With `--apply` (and no `--yes`), CLI prompts an extra irreversible confirmation.
+- `--json` prints the plan + preflight report, but the command still requires an interactive TTY.
 
 Exec provider safety note: