HTTP intercepting proxy · TUI

HTTP security testing from the terminal.

A fast, keyboard-driven HTTP/HTTPS proxy and security toolkit. Capture, replay, fuzz and scan, or drive it all from an AI agent.

Get started View on GitHub
curl -fsSL https://gori.hahwul.com/install.sh | bash
gori History tab in the terminal, listing captured HTTP flows with time, method, protocol, host, path, status, type, size and duration

Every request your client makes lands in History as a flow, one keystroke from Repeater, the Fuzzer, or an issue.

Start

Capture your first request

Install, trust the CA, and watch flows land.

 Guide

Proxy, Repeater & Fuzzer

Intercept, scope, replay, fuzz, and scan.

 Reference

CLI & query language

Every subcommand, config key, and filter.
gori History tab with the Space menu open, listing context actions like add host to scope, repeater flow, and mine parameters

One tool, the whole assessment.

History, Intercept, Repeater, Fuzzer, the Probe scanner, Param Miner, and Issues live in a single project, every flow one keystroke away.

Keyboard-native A palette-driven TUI built with Crystal. No mouse required, no browser tab to babysit.
Fast A compiled proxy with SQLite-backed projects that stay responsive under load.
Scriptable and AI Everything reachable headless via gori run, and open to AI agents through the built-in MCP server.

From capture to issue.

Capture Run the proxy, trust the CA once, and every request flows into History with full HTTP/2, WebSocket, and gRPC detail.
gori flow detail on the response tab, showing an HTTP/2 200 status and syntax-highlighted response headers
Test Send interesting flows to Repeater or the Fuzzer, mine hidden parameters, and let Probe flag issues as you browse.
gori Fuzzer tab with marked payload positions in the request, a results table, and a status distribution sidebar
Report Triage results into Issues, take notes, and export, or hand the whole project to an agent over MCP.
gori Issues tab listing triaged findings with severity and status columns: permissive CORS, missing Content-Security-Policy, and missing HSTS, each with an affected host

Or hand it to an agent.

gori has no chat window baked in. It exposes your project over MCP, so any agent (Claude, Codex, Grok) reads your captured traffic and drives the tools through one clean seam. You pick the model; your traffic stays where you put it.

AI agent Claude · Codex · Grok any MCP-capable client
gori project History · Repeater · Fuzzer · Issues list_history · get_flow · send_request · create_issue · fuzz_start
Read the MCP guide →

고리

/go·ri/ · noun, Korean

In English it needs three words. Ring, link, and loop all name the same thing, a piece that holds two separate things together.

Traffic you captured, a request you replayed, a bug you filed: gori keeps them on one chain.