diff --git a/scripts/playbook.py b/scripts/playbook.py
new file mode 100644
index 0000000..2820dc3
--- /dev/null
+++ b/scripts/playbook.py
@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+import sys
+
+
+def usage() -> str:
+    return "Usage:\n  python scripts/playbook.py -config <path>\n  python scripts/playbook.py -h"
+
+
+def main(argv: list[str]) -> int:
+    if "-h" in argv or "-help" in argv:
+        print(usage())
+        return 0
+    if "-config" not in argv:
+        print("ERROR: -config is required.\n" + usage(), file=sys.stderr)
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))
diff --git a/tests/cli/test_playbook_cli.py b/tests/cli/test_playbook_cli.py
new file mode 100644
index 0000000..970cf28
--- /dev/null
+++ b/tests/cli/test_playbook_cli.py
@@ -0,0 +1,31 @@
+import subprocess
+import sys
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = ROOT / "scripts" / "playbook.py"
+
+
+def run_cli(*args):
+    return subprocess.run(
+        [sys.executable, str(SCRIPT), *args],
+        capture_output=True,
+        text=True,
+    )
+
+
+class PlaybookCliTests(unittest.TestCase):
+    def test_help_shows_usage(self):
+        result = run_cli("-h")
+        self.assertEqual(result.returncode, 0)
+        self.assertIn("Usage:", result.stdout + result.stderr)
+
+    def test_missing_config_is_error(self):
+        result = run_cli()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("-config", result.stdout + result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()