core-cli
The consumer command-line tool for CORE: review
and approve proposals, run checks and fixes on the repository CORE governs, onboard a
repository (BYOR), and work the assisted remediation lane. Its binary is called core.
core-cli is an HTTP client and nothing more. Every command talks to a running CORE
API, using only the routes in CORE's published
OpenAPI contract;
it does not install or import CORE. The operator tool, core-admin, ships separately in
core-runtime and covers the CORE installation itself: secrets, vector store, database
sync (which one do I need?).
Prerequisites
- Python 3.12+
- A reachable CORE API, which itself needs PostgreSQL and Qdrant. See CORE's getting started.
No authentication. OSS CORE runs in trusted-localhost mode: the API binds to loopback and accepts every request. Anyone who can reach it can approve and execute proposals. Keep it on
127.0.0.1and do not expose it on a shared network.
Install
pip install core-cli
Its only dependencies are typer, rich, httpx and PyYAML.
Configure
core uses http://127.0.0.1:8000 unless you point it elsewhere:
export CORE_API_URL=http://127.0.0.1:8000
Use
core proposals list # proposals awaiting a decision
core proposals show <id> # risk assessment and planned changes
core lane list # delegated findings waiting for assisted remediation
core project onboard <path> # preview delivering the machinery floor (BYOR)
core project onboard <path> --write # deliver it
core <group> <command> --help # options for any command
Commands that change files or data preview by default and act only with --write.
Commands
| Group | What it covers |
|---|---|
proposals |
list, show, create, approve, reject, execute, integrate |
lane |
list, next, claim, propose: assisted remediation of delegated findings |
project |
onboard, scout, promote: bring a repository under governance (BYOR) |
code |
quality and verification: lint, format, test, check-imports, audit-duplicates, … |
symbols |
audit, fix-ids, resolve-duplicates |
vectors |
query: semantic search over the governed repository |
Every command, option and default is in the generated
core command reference.
Architecture
The split between the consumer CLI (core) and the operator CLI (core-admin) is
recorded in
ADR-146:
core covers operations on the repository CORE governs; core-admin covers the CORE
installation. tests/test_contract.py checks every route this client calls against CORE's
OpenAPI contract.
License
MIT. See LICENSE.
Metadata
Release files for core-cli 2.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| core_cli-2.0.0.tar.gz | 33.9 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| core_cli-2.0.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 78.6 kB
Release files / core_cli-2.0.0.tar.gz
| Download URL | core_cli-2.0.0.tar.gz |
|---|---|
| Size | 33.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
0732940b246b95bb8b110d8cd6229029e02ec4f0d731a0517ca2d4387b7621c8
|
|
BLAKE2b-256 checksum How to use checksums |
2933fc0fb1de385a657e4acc3a79eed330dbbc5eb3e030dcb710c58bac6e3790
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 3, 2026.
Transparency logRelease files / core_cli-2.0.0-py3-none-any.whl
| Download URL | core_cli-2.0.0-py3-none-any.whl |
|---|---|
| Size | 44.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
7ab6a8cf9c5463c870c364887679a121fb783b71d5ef6fa1b7dce9bd343ee592
|
|
BLAKE2b-256 checksum How to use checksums |
af8a4ef9c81fe4d620d99795fc5ded93a31d4715c86336a51b4eddfadc9de0e6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 3, 2026.
Transparency log