diff --git a/ipalib/cli.py b/ipalib/cli.py
index 904d34d49..db4a08e85 100644
--- a/ipalib/cli.py
+++ b/ipalib/cli.py
@@ -612,6 +612,8 @@ class help(frontend.Command):
 
         # build help topics
         for c in self.Command():
+            if c.INTERNAL:
+                continue
             topic = self._get_command_module(c.module)
             if topic:
                 self._topics.setdefault(topic, [0]).append(c)
@@ -779,7 +781,7 @@ class cli(backend.Executioner):
         self.create_context()
         (key, argv) = (argv[0], argv[1:])
         name = from_cli(key)
-        if name not in self.Command:
+        if name not in self.Command or self.Command[name].INTERNAL:
             raise CommandError(name=key)
         cmd = self.Command[name]
         kw = self.parse(cmd, argv)
diff --git a/ipalib/frontend.py b/ipalib/frontend.py
index 3727833a2..48215c5df 100644
--- a/ipalib/frontend.py
+++ b/ipalib/frontend.py
@@ -201,6 +201,9 @@ class HasParam(Plugin):
     of ``api.env.context``, subclasses can override this with implementations
     that consider arbitrary ``api.env`` values.
     """
+    # HasParam is the base class for most frontend plugins, that make it to users
+    # This flag should be used by UI components to make the plugin unaccessible
+    INTERNAL = False
 
     def _get_param_iterable(self, name, verb='takes'):
         """