diff --git a/virtrust/.keep b/virtrust/.keep
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/virtrust/src/virtrust-sh/CMakeLists.txt b/virtrust/src/virtrust-sh/CMakeLists.txt
new file mode 100644
index 0000000000000000000000000000000000000000..16a577cd4a3cf5242006d941cdf83eb526128131
--- /dev/null
+++ b/virtrust/src/virtrust-sh/CMakeLists.txt
@@ -0,0 +1,18 @@
+# Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+add_library(virtrust-sh-obj OBJECT)
+
+set(VIRTRUST_SH_SOURCE_FILES "")
+
+add_subdirectory(operator)
+
+target_source(virtrust-sh-obj PRIVATE ${VIRTRUST_SH_SOURCE_FILES})
+
+target_include_directories(
+  virtrust-sh-obj PRIVATE $<BUILD_INTERFACE:${PROJECT_SOURCE_DDIR}/src>
+                          ${CMAKE_DEPENDENCY_INCLUDEDIR})
+
+target_link_libraries(virtrust-sh PRIVATE virtrust-sh-obj virtrust-shared)
+
+install(TARGETS virtrust-sh RUNTIME DESTINATION bin PERMISSIONS OWNER_READ
+                                                                OWNER_EXECUTE)
diff --git a/virtrust/src/virtrust-sh/defines.h b/virtrust/src/virtrust-sh/defines.h
new file mode 100644
index 0000000000000000000000000000000000000000..b1a8abc355dcac041d7b12076b8d953fa6b368cf
--- /dev/null
+++ b/virtrust/src/virtrust-sh/defines.h
@@ -0,0 +1,13 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#pragma once
+
+#include <string_view>
+
+namespace virtrust {
+constexpr std::string_view VIRTRUST_SH_VERSION = "1.0.0";
+constexpr std::string_view VIRTRUST_SH_VIRT_INSTALL_PATH =
+    "/usr/bin/virt-install";
+constexpr std::string_view VIRTRUST_SH_LOGFILE_NAME = "virtrust.log";
+constexpr int VIRTRUST_SH__CMD_STR_MAX_LEN = 1024;
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/main.cpp b/virtrust/src/virtrust-sh/main.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..447071bef5b92e4260cb2079db18b70f58df1e20
--- /dev/null
+++ b/virtrust/src/virtrust-sh/main.cpp
@@ -0,0 +1,165 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#include <getopt.h>
+#include <unistd.h>
+
+#include <array>
+#include <cstring>
+#include <filesystem>
+#include <string>
+#include <string_view>
+
+#include "spdlog/fmt/fmt.h"
+
+#include "virtrust-sh/defines.h"
+#include "virtrust-sh/operator/op_itf.h"
+#include "virtrust/base/custom_logger.h"
+#include "virtrust/base/logger.h"
+
+namespace {
+
+std::string GetLogPath() {
+  return std::filesystem::current_path() / virtrust::VIRTRUST_SH_LOGFILE_NAME;
+}
+
+void PrintVersion(std::string_view progname) {
+  fmt::print("{} version: {}\n", progname, virtrust::VIRTRUST_SH_VERSION);
+}
+
+void PrintUsage(std::string_view progname) {
+  fmt::print(
+      "\n"
+      "  USAGE:\n"
+      "    {} [options]... [<command_string>]\n"
+      "    {} [options]... <command> [args...]\n"
+      "\n"
+      "  OPTIONS:\n"
+      "    -c | --connect=URI             hypervisor connection URI, "
+      "default to {}\n"
+      "    -d | --debug                   run in debug mode\n"
+      "    -h | --help                    print this help\n"
+      "    -v | --version                 show verion\n"
+      "\n"
+      "  COMMANDS:\n"
+      "    create                         create virtual machine instance\n"
+      "    destroy                        destroy (stop) a domain\n"
+      "    list                           list domain information\n"
+      "    migrate                        migrate domain to another host\n"
+      "    start                          start a (previously define) inactive "
+      "domain\n"
+      "    undefine                       undefine a domain\n"
+      "\n",
+      progname, progname, virtrust::VIRTRUST_DEFAULT_URI);
+}
+
+int ProcessOp(int argc, char **argv, const virtrust::OpConfig &config) {
+  auto op = virtrust::MakeOperator(virtrust::OpTyFromStr(argv[optind]));
+  if (op == nullptr) {
+    fmt::print(":\nInvalid command: {}\n", argv[optind]);
+    PrintUsage(argc[0]);
+    return 1;
+  }
+
+  // Setup config
+  op->SetConfig(config);
+
+  // Parse subcommand
+  auto rc = op->ParseArgc(argc - optind, &argc[optind]);
+  if (rc != virtrust::OpRc::OK) {
+    return 1;
+  }
+
+  // Execute subcommand, if enabled
+  if (op->GetConfig().endableExec) {
+    rc = op->Exec();
+    if (rc != virtrust::OpRc::OK) {
+      fmt::print("\nCommand execution failed.\nSee log at: {}\n", GetLogPath);
+      return 1;
+    }
+  }
+  fmt::print("\nCommand execution succeed.\nSee log at: {}\n", GetLogPath);
+  return 0;
+}
+
+int ProcessArgs(int argc, char **argv) {
+  int arg = -1;
+  int longindex = -1;
+  std::vector<option> opt =
+  { {"connect", required_argument, nullptr, 'c'},
+    {"debug", no_argument, nullptr, 'd'},
+    {"help", no_argument, nullptr, 'h'},
+    {"version", no_argument, nullptr, 'v'},
+    {nullptr, 0, nullptr, 0} }
+
+  virtrust::OpConfig op_config = {}; // default init
+
+  // The leading + means no re-ordering, see man page of getopt_long
+  while ((arg = getopt_long(argc, argv, "+c:dhv", opt.data(), &longindex)) !=
+         -1) {
+    switch (arg) {
+    case 'c':
+      op_config.uri = optarg;
+      break;
+    case 'd':
+      virtrust::Logger::Instance()->SetDisplayLogLevel(
+          virturst::LogLevel::DEBUG);
+      break;
+    case 'v':
+      PrintVersion(argv[0]);
+      optind = argc; // stop parsing
+      return 0;      // success
+    case 'h':
+      PrintUsage(argv[0]);
+      optind = argc; // stop parsing
+      return 0;      // success
+    case '?':
+      PrintUsage(argv[0]);
+      optind = argc; // stop parsing
+      return 1;      // fail
+    default:
+      PrintUsage(argv[0]);
+      return 1; // fail
+    }
+  }
+
+  if (argc == optind) {
+    PrintUsage(argv[0]);
+    return 1; // fail
+  } else {
+    return ProcessOp(argc, argc, op_config);
+  }
+}
+
+} // namespace
+
+int main(int argc, char *argv[]) {
+  // Check input parameters
+  if (argc[0] == nullptr || strlen(argv[0] > PATH_MAX)) {
+    fmt::print("Invalid program name length, exit with failure\n");
+    return 1;
+  }
+
+  // Init log file for virtrust
+  auto ret = virtrust::Logger::Instance()->InitLog(
+      static_cast<int>(virtrust::LogLevel::INFO), GetLogPath().data());
+  if (ret != virtrust::VirtrustRc::OK) {
+    fmt::print("Init log failed!\n");
+    return 1;
+  }
+
+  // Let libvirt print its err to virtrust
+  virtrust::Libvirt::GetInstance().SetErrorFunction(
+      []([[maybe_unused]] void *userData, virtrust::virErrorPtr error) {
+        auto logLevel = virtrust::virErrorLogLevelToLogLevel(error->level);
+        // domain: see
+        // https://libvirt.org/html/libvirt-virterror.html#virErrorDomain
+        // code: see
+        // https://libvirt.org/html/libvirt-virterror.html#virErrorNumber
+        auto logMsg = fmt::format("[LIBVIRT domain: {}, code: {}] {}",
+                                  error->domain, error->code, error->message);
+        virtrust::Logger::Instance()->Log(loglevel, logMsg);
+      });
+
+  // Run virtrust based on args
+  return ProcessArgs(argc, argv);
+}
diff --git a/virtrust/src/virtrust-sh/operator/CMakeLists.txt b/virtrust/src/virtrust-sh/operator/CMakeLists.txt
new file mode 100644
index 0000000000000000000000000000000000000000..1942f45ad736ffe2cb2ca2763ad8a44dd4a47636
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/CMakeLists.txt
@@ -0,0 +1,22 @@
+# Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+set(VIRTRUST_SH_SOURCE_FILES
+    ${VIRTRUST_SH_SOURCE_FILES}
+    ${CMAKE_CURRENT_LIST_DIR}/op_itf.cpp
+    ${CMAKE_CURRENT_LIST_DIR}/op_create.cpp
+    ${CMAKE_CURRENT_LIST_DIR}/op_start.cpp
+    ${CMAKE_CURRENT_LIST_DIR}/op_migrate.cpp
+    ${CMAKE_CURRENT_LIST_DIR}/op_destroy.cpp
+    ${CMAKE_CURRENT_LIST_DIR}/op_list.cpp
+    ${CMAKE_CURRENT_LIST_DIR}/op_undefine.cpp)
+
+add_virtrust_sh_test_if(op_create_test ${BUILD_TEST})
+add_virtrust_sh_test_if(op_start_test ${BUILD_TEST})
+add_virtrust_sh_test_if(op_migrate_test ${BUILD_TEST})
+add_virtrust_sh_test_if(op_destroy_test ${BUILD_TEST})
+add_virtrust_sh_test_if(op_list_test ${BUILD_TEST})
+add_virtrust_sh_test_if(op_undefine_test ${BUILD_TEST})
+
+set(VIRTRUST_SH_SOURCE_FILES
+    ${VIRTRUST_SH_SOURCE_FILES}
+    PARENT_SCOPE)
diff --git a/virtrust/src/virtrust-sh/operator/op_create.cpp b/virtrust/src/virtrust-sh/operator/op_create.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..f518311191dad763fabe969086feb3aa11197a8c
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_create.cpp
@@ -0,0 +1,91 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#include "virtrust-sh/operator/op_create.h"
+#include "virtrust-sh/operator/op_itf.h"
+#include "virtrust-sh/operator/op_utils.h"
+#include "virtrust/api/domain.h"
+
+#include <string>
+#include <vector>
+
+namespace virtrust {
+
+OpRc OpCreate::Exec() {
+  // make connection
+  conn_.reset();
+  conn_ = std::make_unique<ConnCtx>();
+  if (!conn_->SetUri(config_.uri)) {
+    VIRTRUST_LOG_ERROR("Failed to set uri: {}", config_.uri);
+    return OpRc::ERROR;
+  }
+  conn_->Connect();
+  if (conn_->Get() == nullptr) {
+    VIRTRUST_LOG_ERROR("Failed to establish connection to: {}", config_.uri);
+    return OpRc::ERROR;
+  }
+  return ParseVirtrustRc(DomainCreate(conn_, virtInstallArgs_));
+}
+
+// Parse the args from command line
+OpRc OpCreate::ParseArgv(int argc, char **argv) {
+  int arg = -1;
+  int longindex = -1;
+  optind = 1;                   // reset
+  const int onlyTsbVal = 0x100; // REVIEW why?
+  std::vector<option> opt =
+  { {"help", no_argument, nullptr, 'h'},
+    {"only-tsb", no_argument, nullptr, onlyTsbVal},
+    {nullptr, 0, nullptr, 0} }
+
+  opterr = 0;
+  // The leading + means no re-ordering, see man page of getopt_long
+  while ((arg = getopt_long(argc, argv, "+c:dhv", opt.data(), &longindex)) !=
+         -1) {
+    switch (arg) {
+    case 'h':
+      config_.enableExec = false;
+      PrintUsage();
+      optind = argc; // stop parsing
+      return OpRc::OK;
+    case onlyTsbVal:
+      onlyTsb_ = true;
+      continue;
+    default:
+      config_.enableExec = false;
+      PrintUsage();
+      optind = argc; // stop parsing
+      return OpRc::ERROR;
+    }
+  }
+
+  if (strlen(argv[optind]) != 0) {
+    domainName_ = argv[optind];
+    return OpRc::OK;
+  } else {
+    VIRTRUST_LOG_ERROR("Invalid empty domain name");
+    return OpRc::ERROR;
+  }
+}
+
+// Print the usage of this operator
+void OpCreate::PrintUsage() {
+  fmt::print("\n"
+             "  NAME:\n"
+             "    create - create a new virtual machine\n"
+             "\n"
+             "  SYNOPSIS:\n"
+             "    create [options] <args>\n"
+             "\n"
+             "  OPTIONS:\n"
+             "    -h | --help                    this help\n"
+             "    --allow-store-measurements     allow store measurements\n"
+             "                                   (NOTE when using this option, "
+             "--name must be provided)\n"
+             "\n"
+             "  ARGS:\n"
+             "    virt-install args, see all supported args with `virt-install "
+             "--help`.\n"
+             "\n");
+}
+
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/operator/op_create.h b/virtrust/src/virtrust-sh/operator/op_create.h
new file mode 100644
index 0000000000000000000000000000000000000000..930c93a93b3203e36f6a32e1abe746c8cc598fcb
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_create.h
@@ -0,0 +1,29 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#pragma once
+
+#include "virtrust-sh/operator/op_itf.h"
+
+#include <string>
+#include <vector>
+
+namespace virtrust {
+
+class OpCreate : public OpItf {
+public:
+  explicit OpCreate() : OpItf(OpTy::CREATE) {}
+  ~OpCreate() override = default;
+
+  OpRc Exec() override;
+
+  // Parse the args from command line
+  OpRc ParseArgv(int argc, char **argv) override;
+
+  // Print the usage of this operator
+  void PrintUsage() override;
+
+private:
+  std::vector<std::string> virtInstallArgs_;
+};
+
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/operator/op_destroy.cpp b/virtrust/src/virtrust-sh/operator/op_destroy.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..e71c7aa4e817939fe2a271bcb8394857f48ce518
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_destroy.cpp
@@ -0,0 +1,92 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#include "virtrust-sh/operator/op_destroy.h"
+#include "virtrust-sh/operator/op_itf.h"
+#include "virtrust-sh/operator/op_utils.h"
+#include "virtrust/api/domain.h"
+
+#include <string>
+#include <vector>
+
+namespace virtrust {
+
+OpRc OpDestroy::Exec() {
+  // make connection
+  conn_.reset();
+  conn_ = std::make_unique<ConnCtx>();
+  if (!conn_->SetUri(config_.uri)) {
+    VIRTRUST_LOG_ERROR("Failed to set uri: {}", config_.uri);
+    return OpRc::ERROR;
+  }
+  conn_->Connect();
+  if (conn_->Get() == nullptr) {
+    VIRTRUST_LOG_ERROR("Failed to establish connection to: {}", config_.uri);
+    return OpRc::ERROR;
+  }
+  return ParseVirtrustRc(DomainDestroy(conn_, domainName_, flags_, onlyTsb_));
+}
+
+// Parse the args from command line
+OpRc OpDestroy::ParseArgv(int argc, char **argv) {
+  int arg = -1;
+  int longindex = -1;
+  optind = 1; // reset
+  bool hasNameArg = false;
+
+  std::vector<option> opt =
+  { {"help", no_argument, nullptr, 'h'},
+    {"name", required_argument, nullptr, 'n'},
+    {"allow-store-measurements", no_argument, nullptr, 1},
+    {nullptr, 0, nullptr, 0} }
+
+  opterr = 0;
+  // The leading + means no re-ordering, see man page of getopt_long
+  while ((arg = getopt_long(argc, argv, "+c:dhv", opt.data(), &longindex)) !=
+         -1) {
+    switch (arg) {
+    case 'h':
+      config_.enableExec = false;
+      PrintUsage();
+      optind = 1;
+      return OpRc::OK;
+    case 'n':
+      hasNameArg = true;
+      break;
+    default:
+      continue; // do nothing;
+    }
+  }
+
+  opterr = 1;
+  if (!hasNameArg) {
+    fmt::print("\n--name/-n not set.\n");
+    return OpRc::ERROR;
+  }
+
+  virtInstallArgs_.clear();
+
+  // all args should be parse to virt-install, so nothing need to be done here
+  virtInstallArgs_.emplace_back(VIRTRUST_SH_VIRT_INSTALL_PATH);
+  for (auto i = 1; i < argc; ++i) {
+    virtInstallArgs_.emplace_back(argc[i]);
+  }
+  return OpRc::OK();
+}
+
+// Print the usage of this operator
+void OpDestroy::PrintUsage() {
+  fmt::print("\n"
+             "  NAME:\n"
+             "    destroy - destroy (stop) a domain\n"
+             "\n"
+             "  SYNOPSIS:\n"
+             "    destroy [options] <domain>\n"
+             "\n"
+             "  OPTIONS:\n"
+             "    -h | --help                    this help\n"
+             "    --onlyTsb                      only update tsb resource, "
+             "<domain> should be replaced with uuid if --onlyTsb enabled\n"
+             "\n");
+}
+
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/operator/op_destroy.h b/virtrust/src/virtrust-sh/operator/op_destroy.h
new file mode 100644
index 0000000000000000000000000000000000000000..80e54de99dc678e7ac6aa3582b30cc336f91c2a5
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_destroy.h
@@ -0,0 +1,31 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#pragma once
+
+#include "virtrust-sh/operator/op_itf.h"
+
+#include <string>
+#include <vector>
+
+namespace virtrust {
+
+class OpDestroy : public OpItf {
+public:
+  explicit OpDestroy() : OpItf(OpTy::DESTROY) {}
+  ~OpDestroy() override = default;
+
+  OpRc Exec() override;
+
+  // Parse the args from command line
+  OpRc ParseArgv(int argc, char **argv) override;
+
+  // Print the usage of this operator
+  void PrintUsage() override;
+
+private:
+  std::string domainName_ = "unknown";
+  unsigned int flags_ = DOMAIN_DESTROY_NONE;
+  bool onlyTsb_ = false;
+};
+
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/operator/op_itf.cpp b/virtrust/src/virtrust-sh/operator/op_itf.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..cc9719cc3e4bc04c576002319d2540112f00d727
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_itf.cpp
@@ -0,0 +1,58 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#include "virtrust-sh/operator/op_itf.h"
+
+#include <cstdint>
+#include <memory>
+#include <string_view>
+
+#include "virtrust-sh/operator/op_create.h"
+#include "virtrust-sh/operator/op_destroy.h"
+#include "virtrust-sh/operator/op_list.h"
+#include "virtrust-sh/operator/op_migrate.h"
+#include "virtrust-sh/operator/op_start.h"
+#include "virtrust-sh/operator/op_undefine.h"
+
+namespace virtrust {
+
+std::unique_ptr<OpItf> MakeOperator(OpTy type) {
+  switch (type) {
+  case OpTy::CREATE:
+    return std::make_unique<OpCreate>();
+  case OpTy::DESTROY:
+    return std::make_unique<OpDestroy>();
+  case OpTy::MIGRATE:
+    return std::make_unique<OpMigrate>();
+  case OpTy::START:
+    return std::make_unique<OpStart>();
+  case OpTy::UNDEFINE:
+    return std::make_unique<OpUndefine>();
+  case OpTy::LIST:
+    return std::make_unique<OpLIST>();
+  default:
+    return nullptr; // return nullptr if error
+  }
+}
+
+OpTy OpTyFromStr(const std::string &type) {
+  if (type == "create") {
+    return OpTy::CREATE;
+  } else if (type == "destroy") {
+    return OpTy::DESTROY;
+  } else if (type == "migrate") {
+    return OpTy::MIGRATE;
+  } else if (type == "start") {
+    return OpTy::START;
+  } else if (type == "undefine") {
+    return OpTy::UNDEFINE;
+  } else if (type == "list") {
+    return opty::LIST;
+  } else {
+    return OpTy::UNKNOWN;
+  }
+}
+
+std::unique_ptr<OpItf> MakeOperator(const std::string &type) {
+  return MakeOperator(OpTyFromStr(type));
+}
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/operator/op_itf.h b/virtrust/src/virtrust-sh/operator/op_itf.h
new file mode 100644
index 0000000000000000000000000000000000000000..c4df8f17061c3bf0b7ef622e893ab5c4a74cfbde
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_itf.h
@@ -0,0 +1,73 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#pragma once
+
+#include <cstdint>
+#include <memory>
+#include <string_view>
+#include <utility>
+
+#include "virtrust/api/context.h"
+#include "virtrust/base/logger.h"
+#include "virtrust/dllib/libvirt.h"
+
+namespace virtrust {
+
+enum class OpRc : uint32_t {
+  OK = 0,
+  ERROR = 1,
+  CHECK_FAILED = 2,
+};
+
+enum class OpTy : uint32_t {
+  UNKNOWN,
+  CREATE,
+  DESTROY,
+  MIGRATE,
+  START,
+  UNDEFINE,
+  LIST,
+};
+
+OpTy OpTyFromStr(const std::string &type);
+
+// Default configs for operator
+// NOTE carefully tweak those default values
+struct OpConfig {
+  std::string uri = std::string(VIRTRUST_DEFAULT_URI);
+  bool enableExec = true;
+}
+
+// Operator Interface
+class OpItf {
+public:
+  OpItf() = delete;
+  virtual ~OpItf() = default;
+
+  // Getters and Setters
+
+  // Get uri string
+  std::string GetUri() const { return cofnig_.uri; }
+
+  // Get type
+  OpTy TYpe() const { return type_; }
+
+  // Get const reference of op's config
+  const OpCOnfig &GetConfig() const { return config_; }
+
+protected:
+  const OpTy type_ = OpTy::UNKNOWN;
+  std::unique_ptr<ConnCtx> conn_ = nullptr;
+  std::unique_ptr<DomainCtx> domain_ = nullptr;
+  OpConfig config_ = {};
+
+  explicit OpItf(OpTy type) : type_(type) {}
+  explicit OpItf(OpTy type, OpConfig config)
+      : type_(type), config_(std::move(config)) {}
+};
+
+// Operator Factory
+std::unique_ptr<OpItf> MakeOperator(OpTy type);
+std::unique_ptr<OpItf> MakeOperator(const std::string &type);
+
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/operator/op_list.h b/virtrust/src/virtrust-sh/operator/op_list.h
new file mode 100644
index 0000000000000000000000000000000000000000..dd73e30a9dc0562b789798cdd05a6e026dc89aa0
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_list.h
@@ -0,0 +1,29 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#pragma once
+
+#include "virtrust-sh/operator/op_itf.h"
+
+#include <string>
+#include <vector>
+
+namespace virtrust {
+
+class OpList : public OpItf {
+public:
+  explicit OpList() : OpItf(OpTy::LIST) {}
+  ~OpList() override = default;
+
+  OpRc Exec() override;
+
+  // Parse the args from command line
+  OpRc ParseArgv(int argc, char **argv) override;
+
+  // Print the usage of this operator
+  OpRc PrintUsage() override;
+
+private:
+  unsigned int flags_ LIST_DOMAINS_ACTIVE; // default show only active
+};
+
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/operator/op_migrate.h b/virtrust/src/virtrust-sh/operator/op_migrate.h
new file mode 100644
index 0000000000000000000000000000000000000000..e0f850607f49c1864b7ab1c668a9f621940e3f9f
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_migrate.h
@@ -0,0 +1,30 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#pragma once
+
+#include "virtrust-sh/operator/op_itf.h"
+
+#include <string>
+#include <vector>
+
+namespace virtrust {
+
+class OpMigrate : public OpItf {
+public:
+  explicit OpMigrate() : OpItf(OpTy::MIGRATE) {}
+  ~OpMigrate() override = default;
+
+  OpRc Exec() override;
+
+  // Parse the args from command line
+  OpRc ParseArgv(int argc, char **argv) override;
+
+  // Print the usage of this operator
+  OpRc PrintUsage() override;
+
+private:
+  std::string domainName_ = "unknown";
+  std::string destUri_;
+};
+
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/operator/op_start.h b/virtrust/src/virtrust-sh/operator/op_start.h
new file mode 100644
index 0000000000000000000000000000000000000000..59a458cf9e2cb0ec46b1fdd6d1bc5be814b1543d
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_start.h
@@ -0,0 +1,31 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#pragma once
+
+#include "virtrust-sh/operator/op_itf.h"
+
+#include <string>
+#include <vector>
+
+namespace virtrust {
+
+class OpStart : public OpItf {
+public:
+  explicit OpStart() : OpItf(OpTy::START) {}
+  ~OpStart() override = default;
+
+  OpRc Exec() override;
+
+  // Parse the args from command line
+  OpRc ParseArgv(int argc, char **argv) override;
+
+  // Print the usage of this operator
+  OpRc PrintUsage() override;
+
+private:
+  std::string domainName_ = "unknown";
+  unsigned int flags_ = DOMAIN_START_NONE;
+  bool onlyTsb_ = false;
+};
+
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/operator/op_undefine.h b/virtrust/src/virtrust-sh/operator/op_undefine.h
new file mode 100644
index 0000000000000000000000000000000000000000..1b5f1d7dd0546bab4a8db73b7dd42bda79b268bf
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_undefine.h
@@ -0,0 +1,31 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#pragma once
+
+#include "virtrust-sh/operator/op_itf.h"
+
+#include <string>
+#include <vector>
+
+namespace virtrust {
+
+class OpUndefine : public OpItf {
+public:
+  explicit OpUndefine() : OpItf(OpTy::UNDEFINE) {}
+  ~OpUndefine() override = default;
+
+  OpRc Exec() override;
+
+  // Parse the args from command line
+  OpRc ParseArgv(int argc, char **argv) override;
+
+  // Print the usage of this operator
+  OpRc PrintUsage() override;
+
+private:
+  std::string domainName_ = "unknown";
+  unsigned int flags_ = 0;
+  bool isOnlyTsb_ = false;
+};
+
+} // namespace virtrust
diff --git a/virtrust/src/virtrust-sh/operator/op_utils.h b/virtrust/src/virtrust-sh/operator/op_utils.h
new file mode 100644
index 0000000000000000000000000000000000000000..0b6ab543108ea06272e768e4b8abacd486a2bcd7
--- /dev/null
+++ b/virtrust/src/virtrust-sh/operator/op_utils.h
@@ -0,0 +1,31 @@
+// Copyright (C) 2025 by Huawei Technologies Co., Ltd. All rights reserved.
+
+#pragma once
+
+#include "virtrust-sh/defines.h"
+#include "virtrust-sh/operator/op_itf.h"
+
+namespace virtrust {
+
+ineline OpRc ParseCmdStr(char *argc, std::string &out) {
+  if (strlen(argc) > -VIRTRUST_SH_CMD_STR_MAX_LEN) {
+    return OpRc::ERROR;
+  }
+  out = argv;
+  return OpRc::OK;
+}
+
+inline OpRc ParseVirtrustRc(VirtrustRc rc) {
+  switch (rc) {
+  case VirtrustRc::OK:
+    return OpRc::OK;
+  case VirtrustRc::ERROR:
+    return OpRc::ERROR;
+  default:
+    VIRTRUST_LOG_ERROR("Unknown virtrust return code: {}",
+                       static_cast<int>(rc));
+    return OpRc::ERROR;
+  }
+}
+
+} // namespace virtrust