grclanker
grclanker is an experimental open source AI GRC CLI built on Pi 1.3 (@earendil-works/pi-coding-agent and @earendil-works/pi-ai 1.3.0). The current release is v0.1.4. It is early: minor versions can break before 1.0.
macOS and Linux are the platforms with release bundles. Windows support is best effort. Linux musl hosts, including Alpine, have no bundle. Use a source checkout there.
Install
On macOS or Linux:
curl -fsSL https://grclanker.com/install | bash
On Windows PowerShell (best effort):
powershell -ExecutionPolicy Bypass -c "irm https://grclanker.com/install.ps1 | iex"
The installer downloads the newest GitHub release bundle, today v0.1.4. The bundle includes its own Node.js 24.22.0 runtime. Pin that release on macOS or Linux with:
curl -fsSL https://grclanker.com/install | bash -s -- 0.1.4
An official GitHub download or a GRCLANKER_RELEASE_BASE_URL install checks the archive against SHA256SUMS.txt and aborts when that file cannot be fetched, has no entry for the archive, the entry is not a SHA-256 digest, the digest does not match, or (the shell installer only) neither sha256sum nor shasum is available. A custom GRCLANKER_ASSET_URL prints a warning and installs without verifying. The installation guide has the Windows pin command, the local-archive rules, and the GRCLANKER_VERSION, GRCLANKER_INSTALL_DIR, and GRCLANKER_BIN_DIR overrides.
@grclanker/cli is not on npm. npm install -g @grclanker/cli and bun install -g @grclanker/cli fail.
From source
A checkout of main runs changes that are not in the release bundle yet. You need git, npm, and Node.js 22.19 or newer, the engines floor in cli/package.json.
git clone https://github.com/ethanolivertroy/grclanker.git
cd grclanker
npm --prefix cli ci
npm --prefix cli run build
cd cli
npm link
cd ..
grclanker tools
grclanker tools should report 241 domain tools + 7 compute backend tools. npm link has to run from inside cli/, where it puts the cli/bin/grclanker.js launcher on your PATH. npm --prefix cli link does not, because --prefix also redirects npm's global link directory into the checkout.
Quick start
The release installer links grclanker into ~/.local/bin. A source checkout does the same with the npm link step above. The commands below use that name.
Install Ollama yourself. The grclanker installer does not install it. If Ollama is not already serving, start it with a larger context window and leave that terminal running:
OLLAMA_CONTEXT_LENGTH=128000 ollama serve
grclanker sends about 100k tokens of tool definitions with every request. Unless your GPU has 48 GiB or more, Ollama's default context window (4k or 32k tokens) is too small to hold them. If the Ollama app is already serving, raise its context length setting instead. ollama ps shows the context each loaded model got.
In a second terminal:
ollama pull gemma4
grclanker setup
Choose Local-first. Setup uses http://localhost:11434/v1. If that endpoint is down, setup stops and prints the commands to start it. If the model you name is not installed, setup offers an installed local model or asks you to pull one. It never switches you to a hosted model. The wizard can also save an explicit hosted provider and model. grclanker then reads the key from OPENAI_API_KEY, ANTHROPIC_API_KEY, or GEMINI_API_KEY, or from a key saved with /login in a session. See Setup.
Then:
grclanker tools
grclanker
grclanker "Is CVE-2021-44228 in the CISA KEV catalog, and what is its EPSS score?"
grclanker investigate "CVE-2021-44228"
grclanker tools lists every bundled tool without opening a session. grclanker with no arguments opens an interactive session. Leave it with /quit or Ctrl+D before you run the next command, and use /resume inside a session to reopen an earlier one. The grclanker --session <id> command printed on exit reopens that session. The v0.1.3 and older bundles reject it as an unknown command. A quoted argument is a prompt. investigate, audit, assess, and validate open a session that starts on that workflow, and each one takes a subject. The v0.0.1 bundle rejects the quoted form and drops workflow subjects.
Inside a session the same four workflows are slash commands. Guides: Investigate, Audit, Assess, Validate.
What ships in v0.1.4
- 241 domain tools.
grclanker tools and the tool catalog list the same set.
- 7 compute backend tools:
bash, read, write, edit, ls, find, and grep.
- 4 workflows, and 2 personas:
auditor and verifier.
grclanker flue run in the release bundle.grclanker durable run, resume, and tui in the release bundle: the experimental, opt-in durable runtime, which can resume a run that crashed or was stopped.- A Cursor Agent SDK project, from a source checkout.
- Runtime state under
~/.grclanker/agent.
What's New covers v0.1.4: 32 integrations and the public data feeds retry rate limits, server errors, and timeouts, and report a read that still fails as unread. Access checks report failed and name the setting to fix when a vendor rejects the credentials on every probe, grclanker --version and grclanker --session <id> work, installers put the previous install back when an upgrade fails, and bundles are tested on their own operating system before release. The tool count is unchanged from v0.1.3.
Platform integrations
35 integrations, 212 tools. Each count is the number of grclanker tools entries with that prefix.
The Google Workspace CLI operator bridge (gws_ops_*) shells out to an installed gws binary. The Google Workspace tools (gws_*) call the APIs directly.
Reference data
These five families are the other 29 domain tools. They are not tenant integrations.
212 platform tools and 29 reference tools are the 241 domain tools.
Compute backends
The default backend is host, the local shell. grclanker setup --compute <kind> saves a preference. For one run, put --compute <kind> on a workflow command, a quoted prompt, env smoke-test, or env exec. Examples: grclanker investigate --compute docker and grclanker env smoke-test --compute host. grclanker --compute docker is an unknown command. env doctor and env list ignore the flag.
| Kind | State | What runs there |
|---|
host | shipped | The local shell. |
sandbox-runtime | shipped | bash, grep, and find in the sandbox. read, write, edit, and ls stay local and follow the same filesystem policy. |
docker | shipped | bash, read, write, edit, ls, grep, and find in a local container. |
parallels-vm | shipped | Those same seven tools, in a disposable Parallels sandbox. grclanker prefers a dedicated template and falls back to cloning a stopped base VM. It attaches the repo share. |
modal | shipped | One-shot bash. File tools stay on the local workspace. |
runpod-pod | shipped | The seven tools over SSH, on a pod you already own. grclanker copies the repo's tracked files into that pod. |
runpod-serverless | shipped | One-shot bash. File tools stay on the local workspace. |
vercel-sandbox, cloudflare-sandbox | reserved | A request for either kind fails immediately. |
sandbox-runtime reads ~/.grclanker/sandbox.json, then .grclanker/sandbox.json in the current directory. The project file wins. GRCLANKER_HOME moves the home directory off ~/.grclanker.
grclanker env list shows which kinds this machine can run. env doctor checks the saved backend. env smoke-test checks file tools and backend-native search. The compute backends page is the full matrix.
Cursor Agent SDK
From a source checkout, the same 241 domain tools can run as a Cursor Agent SDK agent. The project is cli/agent-sdk/, an adapter over the bundled extension, built on @grok/agent-sdk 0.3.0. It does not expose bash, read, write, edit, ls, find, or grep. The Cursor harness supplies its own shell and file tools.
199 tools declare effect: "read". The other 42 write files (exports, generators, the Google Workspace operator evidence collector, and OSCAL workspace commands) and wait for a person to approve a model-initiated call.
@grok/agent-sdk is a CLI devDependency. npm --prefix cli ci installs it and its agent-sdk CLI:
npm --prefix cli run agent-sdk:validate
npm --prefix cli run agent-sdk:info
npm --prefix cli run agent-sdk:call -- kevs_search --input '{"query":"CVE-2021-44228"}'
validate, info, and tool call need no Cursor credential. Model turns (agent-sdk:dev, agent-sdk:run) need one: run npx agent-sdk login inside cli/, or export CURSOR_API_KEY. See Cursor Agent SDK.
Flue
The release bundle can run the same 241 domain tools, the four workflow prompts, and the auditor and verifier personas under the Flue Framework.
grclanker flue run --message "Is CVE-2021-44228 in the CISA KEV catalog?"
From a checkout, on Node.js 22.19 or newer, run the official CLI from cli/:
cd cli
npm ci
npx flue run flue/agent.ts --message "Is CVE-2021-44228 in the CISA KEV catalog?"
@flue/cli is a devDependency so it shares this repo's @flue/runtime. A separately downloaded npx @flue/cli loads a second runtime and fails.
GRCLANKER_FLUE_MODEL sets the provider/model specifier. Without it, Flue reuses the grclanker setup choice, or anthropic/claude-sonnet-4-6 when setup has not chosen one. Hosted provider API keys come from the environment. A missing key ends the run with Provider is not configured: <provider>. GRCLANKER_FLUE_SANDBOX=none turns off Flue's local file and shell sandbox. Pi compute backends do not apply here.
grclanker flue run stores conversations in ~/.grclanker/flue/conversations.db, including tool arguments and credentials. GRCLANKER_HOME moves that directory. Pass --db <path> to use another file, or --db :memory: in CI so the run keeps nothing.
npx flue run has no --db option. With no flue.config.* database entry, a run from cli/ stores conversations in cli/node_modules/.cache/flue/run.db. That file can hold the same credentials, and a CI cache of node_modules keeps it. Delete node_modules/.cache/flue after the job, or leave that directory out of the cache.
See Flue runtime.
Skills only
User-scoped Codex skill, into ~/.codex/skills/grclanker/:
curl -fsSL https://grclanker.com/install-skills | bash
Repo-local skill, into .agents/skills/grclanker/ under the current directory:
curl -fsSL https://grclanker.com/install-skills | bash -s -- --repo
Windows PowerShell (best effort):
powershell -ExecutionPolicy Bypass -c "irm https://grclanker.com/install-skills.ps1 | iex"
These installers download skills/grclanker/SKILL.md from main. They do not install the CLI.
Specs
The repo has 35 specs in specs/. Browse them at grclanker.com/specs, or fetch one raw file:
curl -O https://raw.githubusercontent.com/ethanolivertroy/grclanker/main/specs/aws-sec-inspector.spec.md
A release bundle does not include specs/. From a source checkout, start grclanker at the repo root and give it a spec path. See Using specs as inputs.
Release bundles
The installers look for these GitHub release assets, plus SHA256SUMS.txt:
grclanker-<version>-darwin-arm64.tar.gzgrclanker-<version>-darwin-x64.tar.gzgrclanker-<version>-linux-arm64.tar.gz (glibc)grclanker-<version>-linux-x64.tar.gz (glibc)grclanker-<version>-win32-arm64.zipgrclanker-<version>-win32-x64.zip
A local archive prints a warning and installs without verifying when no SHA256SUMS.txt sits beside it. When that file is present, a missing entry, a digest that is not SHA-256, or a mismatch aborts the install, and the shell installer also aborts if neither sha256sum nor shasum is available.
Build them from a checkout:
cd cli
npm install
npm run build:bundle -- --all
build:bundle packages Node.js 24.22.0. GRCLANKER_NODE_VERSION overrides that. Artifacts and SHA256SUMS.txt land in cli/release/. Drop --all to build only the host platform, or pass --target <platform-arch>. --output-dir <dir> changes the destination.
Contributing
Bugs and feature requests use the issue templates. Repository layout, commands, and how to add an integration are in AGENTS.md. The short contributor path is CONTRIBUTING.md.
License
grclanker is licensed under the Apache License 2.0. See NOTICE for attribution.
Built by Ethan Troy.
