diff --git a/include/types/cli.h b/include/types/cli.h
index 4e7e6b1..913167a 100644
--- a/include/types/cli.h
+++ b/include/types/cli.h
@@ -31,6 +31,7 @@
 	int (*io_handler)(struct appctx *appctx);
 	void (*io_release)(struct appctx *appctx);
 	void *private;
+	int level; /* this is the level needed to show the keyword usage and to use it */
 };
 
 struct cli_kw_list {
diff --git a/include/types/global.h b/include/types/global.h
index 66ae6da..a5d948e 100644
--- a/include/types/global.h
+++ b/include/types/global.h
@@ -76,6 +76,8 @@
 #define ACCESS_LVL_MASK     0x3
 
 #define ACCESS_FD_LISTENERS 0x4  /* expose listeners FDs on stats socket */
+#define ACCESS_MASTER       0x8  /* works with the master (and every other processes) */
+#define ACCESS_MASTER_ONLY  0x10 /* only works with the worker */
 
 /* SSL server verify mode */
 enum {
diff --git a/src/cli.c b/src/cli.c
index 8a4fbc5..87227a3 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -93,6 +93,8 @@
 
 extern const char *stat_status_codes[];
 
+extern int master;
+
 static struct proxy *mworker_proxy; /* CLI proxy of the master */
 
 static char *cli_gen_usage_msg(struct appctx *appctx)
@@ -113,8 +115,20 @@
 	list_for_each_entry(kw_list, &cli_keywords.list, list) {
 		kw = &kw_list->kw[0];
 		while (kw->str_kw[0]) {
+
+			/* in a worker or normal process, don't display master only commands */
+			if (master == 0 && (kw->level & ACCESS_MASTER_ONLY))
+				goto next_kw;
+
+			/* in master don't displays if we don't have the master bits */
+			if (master == 1 && !(kw->level & (ACCESS_MASTER_ONLY|ACCESS_MASTER)))
+				goto next_kw;
+
 			if (kw->usage)
 				chunk_appendf(tmp, "  %s\n", kw->usage);
+
+next_kw:
+
 			kw++;
 		}
 	}
@@ -465,6 +479,14 @@
 	if (!kw)
 		return 0;
 
+	/* in a worker or normal process, don't display master only commands */
+	if (master == 0 && (kw->level & ACCESS_MASTER_ONLY))
+		return 0;
+
+	/* in master don't displays if we don't have the master bits */
+	if (master == 1 && !(kw->level & (ACCESS_MASTER_ONLY|ACCESS_MASTER)))
+		return 0;
+
 	appctx->io_handler = kw->io_handler;
 	appctx->io_release = kw->io_release;
 	/* kw->parse could set its own io_handler or ip_release handler */