CLI Reference

Reference for the gori command line. Running gori with no subcommand starts the TUI.

gori [command] [options]

Global flags: -v / --version, -h / --help.

gori tui

Start the intercepting proxy and TUI. This is the default when no subcommand is given.

gori
gori tui --listen 0.0.0.0 --port 8080

GORI_HOME is an environment variable, not a flag. Project selection in the TUI is done through the project picker. Bind flags only set the global layer for this run. See Configuration. For the root CA path, use gori ca.

gori run

The non-interactive suite. Each subcommand operates over a project; with neither --project nor --db it uses the most-recently-active project.

gori run <subcommand> [options]

Common flags across read subcommands: --project=NAME, --db=PATH, --format=FMT (usually text or json).

run capture

gori run capture --port 8070 --format json --for 5m

run history / ls

gori run history -q 'status:5xx' --limit 100 --format json

run show

gori run show <flow-id> --format raw

--format is text, json, or raw (exact bytes). --request-only / --response-only limit the output. Decoded SAML/JWT/GraphQL/params, WebSocket messages, and SSE events are included where present.

run repeater

Re-send one captured flow, or manage the Repeater workbench sessions shared with the TUI.

gori run repeater <flow-id> --target https://staging.example.com --http2 --diff

repeater list: list saved Repeater sessions (--format text|json).

repeater create: create a Repeater session:

gori run repeater create --target https://api.example.com --request-file req.txt --name "login probe"
gori run repeater create --flow 42 --name "clone of 42"

run fuzz

Sources: --flow=ID, --request=FILE, or stdin. Positions: §…§ markers, --auto, or --mark=TOKEN.

run mine

gori run mine <flow-id> --locations query,headers --wordlist params.txt

run sequence

Grade the randomness of a token. Live: replay a request and extract the token from each response. Manual: analyze a pasted list with --tokens (no network). Alias seq.

gori run sequence 42 --cookie SESSIONID --count 500
gori run sequence --tokens tokens.txt          # '-' reads stdin

run probe

gori run probe --severity high --category cors

--severity is info|low|medium|high|critical; --category is headers|cookies|tech|infoleak|cors (passive only, active probes run in the TUI); -q/--query filters with QL.

run discover

Spider a target and brute-force unlinked paths; findings flow into the Sitemap unless --no-store. Sends real, unsolicited traffic, so only run it against authorized targets.

gori run discover --target https://target.example --max-depth 3 --extensions php,json,bak --format jsonl

run sitemap

gori run sitemap --in-scope --format paths

-q/--query=QL filters endpoints with the same QL as history (also positional), -n/--limit=N caps the endpoints scanned (default SITEMAP_MAX), --in-scope limits to in-scope hosts, --no-group disables id folding, --format is text (tree), json, or paths.

run oast

Ad-hoc, store-free out-of-band listener: register a payload, print it, then stream callbacks.

gori run oast presets                          # list built-in public providers
gori run oast listen                           # interactsh, poll until Ctrl-C
gori run oast listen --provider webhook.site --once --json

presets lists the public providers. listen options:

run jwt

Decode, re-sign, or generate attack payloads for a JWT. Store-free compute; the token comes from the <token> argument or stdin.

gori run jwt eyJhbGci...                        # decode (default)
gori run jwt eyJhbGci... --encode --alg HS256 --secret s3cret
gori run jwt eyJhbGci... --attacks

run decoder

Run a Decoder chain over a value. Steps are separated by |, >, or ,.

gori run decoder 'base64-decode | jwt-decode' "$TOKEN"
echo -n secret | gori run decoder 'sha256 | hex-encode'
gori run decoder list                           # every converter (name, category, direction)

run issues / notes

gori run issues --format markdown --export report.md
gori run notes --all

Write issues from scripts with create / update:

gori run issues create --title "Reflected XSS on /search" --severity high --host app.example.com --flow 42
gori run issues update 7 --status confirmed --notes "Verified on staging" --severity critical

Notes are readable and writable too. notes with no argument lists them (* marks the active note); notes <n> prints one by index:

gori run notes                                  # list
gori run notes 2                                # print note 2
gori run notes create --text "SSRF candidate on /fetch"
echo "pasted from a scratchpad" | gori run notes create
gori run notes delete 2

run rewriter

Manage Match & Replace rules from scripts. The same rules the Rewriter tab edits, applied to live proxy traffic:

gori run rewriter                                       # list rules in apply order
gori run rewriter add --op set_header --target request \
  --find X-Forwarded-For --value 127.0.0.1 --host '*.example.com'
gori run rewriter add --op replace --target response --part body \
  --match regex --find 'secret=(\w+)' --value 'secret=[redacted]'
gori run rewriter preview --op replace --part body --find password --value hunter2
gori run rewriter disable 3
gori run rewriter rm 3

preview takes the same rule flags and reports how many stored flows the rule would have changed, without writing it. rm (delete), enable and disable take a rule id from the list.

Body rules re-sync Content-Length and de-chunk as needed, and an enabled rule forces HTTP/1.1 on hosts it matches. See Proxy & History for the interactive editor.

run project

List known projects, or manage project-scoped config (scope rules, env vars, host overrides):

gori run project --format json
gori run project list

project scope

Manage the project's include/exclude scope rules from scripts:

gori run project scope                                          # list rules + enabled state
gori run project scope --format json
gori run project scope add --kind=include --type=host --pattern=api.example.com
gori run project scope add --kind=exclude --type=regex --pattern='.*\.(css|js)$'
gori run project scope delete 3
gori run project scope enable
gori run project scope disable

project env

Manage project env vars used for $KEY substitution in outbound requests (Repeater, Fuzzer, Miner, CLI, MCP). Global vars live in settings.json / the TUI Settings. This command only touches the per-project layer.

gori run project env                              # list KEY=value
gori run project env --format json
gori run project env set TOKEN=secret
gori run project env set HOST api.example.com
gori run project env delete TOKEN

project host-override

Manage project host overrides: /etc/hosts-style maps that change only the TCP dial target (SNI, certificate hostname, and Host header stay the original name). Project entries win over the global hostname overrides on collision. Alias: host-overrides.

gori run project host-override                              # list
gori run project host-override --format json
gori run project host-override add --host=api.example.com --ip=10.0.0.1
gori run project host-override add 10.0.0.1 api.example.com   # /etc/hosts order
gori run project host-override update 1 --host=api.example.com --ip=10.0.0.9
gori run project host-override delete 1

gori mcp

MCP stdio server. See the MCP guide for tool details.

gori ca

gori ca
gori ca --pem
gori ca --ca-dir=DIR
gori ca regenerate
gori ca regenerate --yes
gori ca import --cert root.crt.pem --key root.key.pem --yes

Prints the path to gori's root CA certificate (creates it on first use). Use this when trusting the CA in a browser or system store, or when pointing a client at --cacert.

gori ca regenerate

Replaces the on-disk root CA with a freshly minted one. Destructive: every client that trusted the old CA must re-trust the new certificate. Any already-running gori process keeps the old CA in memory until restarted.

Without --yes, the command prompts on a tty and expects you to type regenerate (same word as the TUI confirm). Scripts and CI should pass --yes. On success the new cert path is printed to stdout.

gori ca import

Adopts an externally-created root CA (a certificate + matching private key, both PEM) in place of gori's own, for sharing one CA across a team or machines, or reusing an organization CA. gori needs both files because it signs per-host leaf certificates on the fly; clients trust only the certificate. Destructive, like regenerate: it replaces the on-disk root and voids prior trust.

The pair is validated before anything is written: the key must match the certificate and the certificate must be a CA (basicConstraints CA:TRUE). A bad pair aborts without touching the current CA. An expired or not-yet-valid certificate imports with a warning. Confirm by typing import on a tty, or pass --yes. The same action is available from the TUI palette (Import CA certificate).

Generate a root with OpenSSL, then import it:

openssl ecparam -genkey -name prime256v1 -out root.key.pem
openssl req -x509 -new -key root.key.pem -days 3650 -subj "/CN=my ca" -out root.crt.pem
gori ca import --cert root.crt.pem --key root.key.pem --yes

Trust only root.crt.pem in your clients. Never distribute the private key.

gori settings

gori settings          # print the settings.json path
gori settings --edit   # open it in $EDITOR

gori wizard

gori wizard

Runs the interactive setup (global proxy bind default, then theme). Also runs automatically on first launch. The bind step writes the shared settings.json defaults. Projects can still pin their own address in the Project tab; --listen / --port override for one run only.

gori tutorial

gori tutorial

Interactive tour of the TUI on a mock UI: tab/pane navigation, the command palette (Ctrl-P), the space menu (Space), and READ/INS edit mode. Each lesson demos the move and prompts you to try the key; a final practice step requires all four before finishing, then points you at a first real session. Offered at the end of gori wizard; safe to re-run anytime without a live proxy session. See the Quick Start.

gori update

gori update
gori update --exec   # Homebrew/Snap: run the package-manager command

Detects how this gori binary was installed and updates accordingly:

Paths under /usr/bin or /bin are classified by package ownership (pacman -Qo, dpkg-query -S, rpm -qf). If a manager owns the file, gori never overwrites it. If probes find no owner, the binary channel self-updates. When no package tools are available, /etc/os-release (ID / ID_LIKE) picks Arch-like / Debian-like / RHEL-like guidance as a fallback.

Release asset names match the installation guide (gori-v*-linux-* plain binaries, gori-v*-osx-*.tar.gz archives). macOS archive updates require a dedicated layout (e.g. PREFIX/opt/gori from the curl installer) so bundled lib/ is never written under shared roots like /usr/local/lib. If no release assets exist yet, the command exits with a clear error pointing at the releases page. It does not silently no-op.