diff --git a/ocis/pkg/command/shares.go b/ocis/pkg/command/shares.go
new file mode 100644
index 0000000000..a6b1795b84
--- /dev/null
+++ b/ocis/pkg/command/shares.go
@@ -0,0 +1,122 @@
+package command
+
+import (
+	"errors"
+
+	"github.com/urfave/cli/v2"
+
+	"github.com/cs3org/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/cs3org/reva/v2/pkg/share/manager/jsoncs3"
+	"github.com/cs3org/reva/v2/pkg/share/manager/registry"
+	"github.com/cs3org/reva/v2/pkg/utils"
+
+	"github.com/owncloud/ocis/v2/ocis-pkg/config"
+	"github.com/owncloud/ocis/v2/ocis-pkg/config/configlog"
+	"github.com/owncloud/ocis/v2/ocis-pkg/config/parser"
+	mregistry "github.com/owncloud/ocis/v2/ocis-pkg/registry"
+	"github.com/owncloud/ocis/v2/ocis/pkg/register"
+	sharingparser "github.com/owncloud/ocis/v2/services/sharing/pkg/config/parser"
+)
+
+// SharesCommand is the entrypoint for the groups command.
+func SharesCommand(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:     "shares",
+		Usage:    `cli tools to manage entries in the share manager.`,
+		Category: "maintenance",
+		Before: func(c *cli.Context) error {
+			// Parse base config
+			if err := parser.ParseConfig(cfg, true); err != nil {
+				return configlog.ReturnError(err)
+			}
+
+			// Parse sharing config
+			cfg.Sharing.Commons = cfg.Commons
+			return configlog.ReturnError(sharingparser.ParseConfig(cfg.Sharing))
+		},
+		Subcommands: []*cli.Command{
+			cleanupCmd(cfg),
+		},
+	}
+}
+
+func init() {
+	register.AddCommand(SharesCommand)
+}
+
+func cleanupCmd(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "cleanup",
+		Usage: `clean up stale entries in the share manager.`,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:     "service-account-id",
+				Value:    "",
+				Usage:    "Name of the service account to use for the cleanup",
+				EnvVars:  []string{"OCIS_SERVICE_ACCOUNT_ID"},
+				Required: true,
+			},
+			&cli.StringFlag{
+				Name:     "service-account-secret",
+				Value:    "",
+				Usage:    "Secret for the service account",
+				EnvVars:  []string{"OCIS_SERVICE_ACCOUNT_SECRET"},
+				Required: true,
+			},
+		},
+		Before: func(c *cli.Context) error {
+			// Parse base config
+			if err := parser.ParseConfig(cfg, true); err != nil {
+				return configlog.ReturnError(err)
+			}
+
+			// Parse sharing config
+			cfg.Sharing.Commons = cfg.Commons
+			return configlog.ReturnError(sharingparser.ParseConfig(cfg.Sharing))
+		},
+		Action: func(c *cli.Context) error {
+			return cleanup(c, cfg)
+		},
+	}
+}
+
+func cleanup(c *cli.Context, cfg *config.Config) error {
+	driver := cfg.Sharing.UserSharingDriver
+	// cleanup is only implemented for the jsoncs3 share manager
+	if driver != "jsoncs3" {
+		return configlog.ReturnError(errors.New("cleanup is only implemented for the jsoncs3 share manager"))
+	}
+
+	rcfg := revaShareConfig(cfg.Sharing)
+	f, ok := registry.NewFuncs[driver]
+	if !ok {
+		return configlog.ReturnError(errors.New("Unknown share manager type '" + driver + "'"))
+	}
+	mgr, err := f(rcfg[driver].(map[string]interface{}))
+	if err != nil {
+		return configlog.ReturnError(err)
+	}
+
+	// Initialize registry to make service lookup work
+	_ = mregistry.GetRegistry()
+
+	// get an authenticated context
+	gatewaySelector, err := pool.GatewaySelector(cfg.Sharing.Reva.Address)
+	if err != nil {
+		return configlog.ReturnError(err)
+	}
+
+	client, err := gatewaySelector.Next()
+	if err != nil {
+		return configlog.ReturnError(err)
+	}
+
+	serviceUserCtx, err := utils.GetServiceUserContext(c.String("service-account-id"), client, c.String("service-account-secret"))
+	if err != nil {
+		return configlog.ReturnError(err)
+	}
+
+	mgr.(*jsoncs3.Manager).CleanupStaleShares(serviceUserCtx)
+
+	return nil
+}