CLI reference

Cori has exactly nine verbs. There is no cori init, cori save, cori register, cori workers, cori ls, cori rm, cori serve, cori push, cori pull, or cori workflows command.

cori run

cori run <path-or-ref> [--json] [--dry-run] [--update] [--yes] [<param>=<value>...]

Run a workflow. <path-or-ref> is either a local folder path or a git ref.

Example:

cori run ./translate_product_sheets_fr \
  input_file=products.csv \
  spreadsheet_id=1BxiM... \
  --json

cori check

cori check <path-or-ref> [--update] [--yes]

Validate a workflow: verify the manifest, compile step files, check declared tools. Does not execute.

cori show

cori show <path-or-ref>

Display a workflow's metadata (name, description, parameters, tools required) and its recent runs.

cori runs

cori runs list
cori runs show <run-id>

cori runs list — list recent workflow runs with timestamps and status.

cori runs show <run-id> — display the full JSON trace for a specific run.

cori work

cori work [--shared <name>]

Start a long-lived headless worker process.

• Without --shared: listens on your identity-derived task queue. Makes this machine available as a worker for workflows you run from other machines.
• --shared <name>: join the named shared pool. Workflows can dispatch steps to this pool by declaring task_queue: <name>.

The GUI lives in the Cori desktop app — see Use the desktop app.

cori login

cori login <capability>
cori login <provider> --stdin

Authenticate a capability. Four flows, dispatched by the argument:

• Managed CLI (e.g. gws) — installs the binary if missing and runs the vendor's own browser sign-in.
• Auth-free capability (anydoc, lightpanda) — nothing to sign in to; installs the binary if missing and confirms readiness.
• LLM provider (openai, anthropic, gemini) — prompts for the API key with hidden input and stores it in the OS keychain (file fallback on machines without one). With --stdin, reads the key from stdin instead for scripts and CI: echo "$KEY" | cori login anthropic --stdin.
• MCP server — runs the PKCE OAuth flow declared in ~/.cori/mcp-servers.json and stores the token in the OS keychain.

cori logout

cori logout <capability>

Remove a stored credential — an LLM provider's API key from the keychain, or an MCP server's OAuth token for the current OS user.

cori capability

cori capability install <id>
cori capability list [--json]

Manage Cori-blessed capability binaries. install downloads the platform artifact, verifies its SHA-256, and places the binary in ~/.cori/bin — no package manager, no sudo, no PATH edits. list shows the registry with per-capability install and sign-in state (--json for machines; the desktop app's Connect buttons consume the same data).

Current registry:

A binary already on PATH always wins over the Cori-managed install — install never touches a user-managed copy.

Each entry advertises a use_for line (when an agent should reach for it) and, when not ready, a remedy command. cori capability list --json, cori status, and the MCP status tool all render the same registry, so agents discover new capabilities dynamically — no skill or prompt updates needed.

cori status

cori status

Show the current Temporal endpoint, your identity, every capability discovered on this machine with auth state, registry capabilities that are installable but not yet present (with the install command), and any workers that are currently online.

cori config

cori config get <key>
cori config set <key> <value>

Read or write values in ~/.cori/config.toml. Config is for non-secret settings only: cori config set llm.<provider>.api_key is rejected (use cori login <provider>), while cori config get llm.<provider>.api_key reads through to the OS keychain so scripts can still fetch a stored key.

Examples:

cori config get temporal.host
cori config set temporal.host temporal.mycompany.com:7233
cori config get llm.anthropic.api_key   # read-through from the keychain

cori mcp

cori mcp

Serve Cori over the Model Context Protocol on stdio, for agent clients such as Claude Desktop, Cowork, and Claude Code. Exposes check, run, show, runs_list, runs_show, and status as MCP tools — the same arguments and code paths as the CLI verbs — and serves the cori-save-workflow skill as MCP prompts/resources.

There are deliberately no login, work, or config tools over MCP, and every run requires a per-run human confirmation — via MCP elicitation when the client supports it, otherwise a native dialog on this machine. CORI_ASSUME_YES is ignored by this verb. Full details: MCP server reference.

Environment variables