GroundWork CLI
Real CVE training for developers — fix production bugs directly in your terminal.
GroundWork is a terminal-based training tool that pulls real-world Common Vulnerabilities and Exposures (CVEs) from open-source projects and drops you into a simulated scenario. Read the Jira-style ticket, review the buggy code, write your fix, and test your security engineering skills against actual production patches.
Features
- Real-World Vulnerabilities: Pulled directly from GitHub Advisories and Google's OSS-Fuzz database.
- Simulated Environment: Every scenario includes a realistic bug ticket, severity rating, and AI-generated contextual hints.
- Instant Validation: Submit your code to instantly verify if your logic matches the historical commit that fixed the CVE.
- Frictionless: No accounts, no logins, no web portals. Just install and run.
Supported Languages
- Python
- JavaScript / Node.js
- Java
- C++
Installation
GroundWork requires macOS or Linux (Windows is not natively supported due to strict Unix tty dependencies) and Python 3.10+.
You can install the CLI directly from PyPI:
pip install groundwork-cli
Usage
Start a new training session by running:
groundwork
Select your target language from the interactive menu. Once a ticket is loaded, use the following interactive commands:
[h]- Request a hint[s]- Submit your fixed code[r]- Reveal the real-world solution and mental model[n]- Start a new session[q]- Quit the application
Configuration
By default, the CLI connects to the official GroundWork production server. If you are hosting your own GroundWork FastAPI backend for local development or an internal corporate network, you can override the target API using an environment variable:
export GROUNDWORK_URL="http://localhost:8000"
groundwork
Local Development
If you want to contribute to the CLI or run it from source:
- Clone the repository:
git clone https://github.com/yourusername/groundwork-cli.git
cd groundwork-cli
- Install the package in editable mode:
pip install -e .
- Run the CLI:
groundwork
License
MIT
1 maintainer
Metadata
1 maintainer
Release files for groundwork-cli 0.1.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| groundwork_cli-0.1.3.tar.gz | 5.2 kB | Without provenance | Details for groundwork_cli-0.1.3.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| groundwork_cli-0.1.3-py3-none-any.whl | Python 3 | none | any | Details for groundwork_cli-0.1.3-py3-none-any.whl |
Total release size: 11.2 kB
Release files / groundwork_cli-0.1.3.tar.gz
| Download URL | groundwork_cli-0.1.3.tar.gz |
|---|---|
| Size | 5.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ae73a692a91cb567506123195aea87a61615db8eca2c254d41fed97a1443b60e
|
|
BLAKE2b-256 checksum How to use checksums |
e483350235baeb1846f167a8770e32eb2a3a5d11e7b619a1c677a1507ccdd363
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.3
|
Release files / groundwork_cli-0.1.3-py3-none-any.whl
| Download URL | groundwork_cli-0.1.3-py3-none-any.whl |
|---|---|
| Size | 6.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
1603fc4732c1f2e6a7bcb463981e16cc359e1bd258378182b501a812279232c0
|
|
BLAKE2b-256 checksum How to use checksums |
437be919f85654a68f2d3d0efcb00a42cb9fad96b2ff21f25dbadcdf3ad96a7b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.3
|
Security for groundwork-cli 0.1.3
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
