English

MCP Server

gori ships a built-in MCP (Model Context Protocol) server. Instead of embedding a chat window in the TUI, gori exposes its project over a clean tool interface so any MCP-capable agent (Claude, Codex, Grok, and others) can read your traffic and drive the tools.

agent Β· gori over MCP

youFind an IDOR on the users API and log it.

β†’ list_history path~/v1/users status:200

← 14 flows, customer and admin tokens

β†’ send_request GET /v1/users/2 Β· customer token

← 200 {"id":2,"email":"other-tenant@example.com"}, not the caller's row

β†’ create_issue "IDOR on /v1/users/{id}" severity:high

βœ“ Issue logged; the request is saved as a Repeater session for repro.

gori mcp

The server speaks JSON-RPC 2.0 over stdio: STDOUT carries the protocol, STDERR carries logs. Tool results include both backward-compatible text and MCP structuredContent when the payload is JSON.

Choosing a Project

cd /path/to/my-repository && gori mcp # path-binds this Git workspace to its own gori project
gori mcp --project my-engagement   # serve a named project's database
gori mcp --db /path/to/project.db  # serve a specific database file
gori mcp --use-active-project      # explicitly serve the active TUI/MRU project

With no explicit selector, gori discovers the nearest Git root and binds its canonical path to an isolated project. The binding prevents two repositories with the same directory name from sharing a database. If the process is outside a Git workspace, gori fails closed instead of silently serving an unrelated active project; pass --project, --db, GORI_MCP_PROJECT, GORI_MCP_DB, or the explicit --use-active-project opt-in.

Call project_info before using data. It reports the selected project, database path, workspace root, and selection source.

Read-Only Mode

By default the server also exposes action tools that send live requests and write issues. To expose only the read tools (safe for handing a project to an untrusted agent), start it read-only:

gori mcp --read-only

Installing Into an Agent

gori can write the MCP configuration for common clients for you:

Flag Client Config written
--install-claude Claude Desktop ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)
--install-claude-code Claude Code ~/.claude.json (mcpServers.gori)
--install-codex OpenAI Codex ~/.codex/config.toml ([mcp_servers.gori])
--install-agy Antigravity CLI ~/.gemini/antigravity-cli/mcp_config.json
--install-grok Grok ~/.grok/config.toml ([mcp_servers.gori]) 
gori mcp --install-claude-code
gori mcp --install-codex
gori mcp --install-grok

Codex and Grok use TOML with an [mcp_servers.gori] table (not JSON). Restart the client (or re-open the session) after installing so it reloads MCP servers.

If a client starts MCP outside your repository directory, pin the installation to a project, for example gori mcp --project my-engagement --install-codex.

Tools

Read tools (always available):

Tool Purpose
list_history List flows newest-first, with optional QL and pagination
list_events Tail an append-only feed of job lifecycle and agent activity, by forward cursor. Flows stay the firehose; this never duplicates flow rows
get_flow Full request + response for one flow
get_response_body_chunk Page through decoded (or raw) flow/Repeater responses beyond the inline 64 KiB cap
list_sitemap Distinct endpoints (host, method, path)
list_issues / get_issue Read triaged issues
list_scope Current scope include/exclude rules
intercept_list / intercept_get Inspect the live intercept queue and one held item in full
list_projects Every gori project on this host
list_notes / get_note Read project notes
list_rules List the project's Match & Replace rules in apply order
decode Run an encode/decode/hash/compress chain over input (pure transform; no network or state)
jwt_decode / jwt_encode / jwt_attacks Decode, re-sign, or generate attack payloads for a JWT (pure compute; available even under --read-only)
sequence_analyze Grade a pasted token list for randomness / predictability (pure)
oast_presets / oast_payload / oast_poll List OAST providers, read the active payload, and poll a running listener for callbacks
discover_status / discover_results Progress and findings of a Discover run
project_info Flow / issue counts, database, workspace binding, and selection source
get_current_context What the user is viewing in the TUI right now
get_repeater_context Repeater workbench state and saved sessions
ql_reference The query-language reference
ql_explain Diagnose a query without running it, to check a filter before spending requests on it

Action tools (disabled by --read-only):

Tool Purpose
send_request Send / resend an HTTP request (active; records History by default, expands $KEY env tokens, and redacts sensitive response-header values unless explicitly requested)
send_websocket Execute a saved WebSocket Repeater session and collect the replies
create_repeater / update_repeater / delete_repeater Manage Repeater sessions
create_issue / update_issue Record and update issues
create_note / update_note / delete_note Manage project notes
create_rule / update_rule / set_rule_enabled / delete_rule Create, edit, toggle, and delete Match & Replace rules (rewrites on in-flight request/response head or body)
preview_rule Estimate how many stored flows a rule would change, before creating it
create_project / switch_project / delete_project Create or reopen a project, point this server at another one, or delete one. Deletion is two-step: a dry_run first, then a confirmation token
fuzz_start / fuzz_status / fuzz_results / fuzz_stop Drive the fuzzer
mine_start / mine_status / mine_results / mine_stop Drive the param miner
sequence_start / sequence_status / sequence_results / sequence_stop Collect tokens by live replay and grade them (results return the report, never the tokens)
discover_start / discover_stop Spider and brute-force endpoints (poll with discover_status / discover_results)
oast_start / oast_stop Register an OAST payload and poll for callbacks (read the hits with oast_poll)
list_jobs / get_job / stop_job Work across job kinds: list every fuzz and mine job this session started, or fetch and stop one by id
intercept_forward / intercept_forward_edit / intercept_drop Release a held message byte-exact, release it with edited wire bytes, or drop it
intercept_toggle / intercept_set_filter / intercept_set_direction Arm or disarm the catch, set its condition query, and choose which leg it holds

Action tools are capped for safety: fuzz, mine, sequence, and discover jobs are limited in total requests, concurrency, and stored results. A rule created via create_rule is picked up by gori run and newly opened TUIs; an already-running TUI applies it only after its rules reload.

Live Intercept

An agent can sit in the intercept loop next to you rather than reading History after the fact. The TUI session holding the capture lock mirrors held messages out to the agent and drains the commands it sends back, so intercept_list β†’ intercept_get β†’ intercept_forward_edit is the same loop you drive by hand.

The mutating half (intercept_forward, intercept_forward_edit, intercept_drop, intercept_toggle, intercept_set_filter, intercept_set_direction) is disabled by --read-only, and every one of them refuses when no live capture session is holding the lock. There is nothing to forward without a proxy actually holding traffic.

Agent actions are visible, not silent. Each one lands in the notification center tagged as coming from an agent, rendered differently from your own actions, so you can see what a co-pilot did to traffic while you were reading another tab.

One safety rule is worth knowing before you leave an agent running. A held message normally waits forever for a human decision, which is what you want when you are the only one at the keyboard. Once an agent attaches to the intercept queue in that session, gori arms a 30 second auto-forward for items nobody is watching, so a client that dies mid-hold cannot wedge the connection indefinitely. A session with no agent attached never auto-forwards.

Why an MCP Seam

gori deliberately has no in-tool AI chat. The intelligence lives outside the tool, reachable through MCP. That means you choose the model, your traffic isn't shipped anywhere you didn't intend, and the same interface serves scripts and agents alike. gori run covers the non-interactive path; MCP covers the interactive-agent path.

Next Steps