orithos-cli 0.1.0__py3-none-any.whl

orithos_cli/skillscan/report.py

@@ -0,0 +1,130 @@
+"""Report renderers: text, JSON, SARIF."""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+from orithos_cli.skillscan.model import SEVERITY_ORDER, ScanResult
+
+CHECK_TITLES = {
+    "manifest": "Manifest hygiene",
+    "permissions": "Permission scope",
+    "network": "Outbound network",
+    "shell": "Shell execution",
+    "credentials": "Credential access",
+    "obfuscation": "Obfuscation",
+    "iocs": "Known-bad indicators",
+}
+
+_SARIF_LEVEL = {
+    "critical": "error",
+    "high": "error",
+    "medium": "warning",
+    "low": "note",
+    "info": "note",
+}
+
+
+def render_text(result: ScanResult) -> str:
+    lines: list[str] = []
+    counts = result.counts()
+    total = len(result.findings)
+    lines.append("Orithos skill scan")
+    lines.append("=" * 60)
+    lines.append(f"Artifact:  {result.source}")
+    lines.append(
+        f"Files:     {result.files_scanned} scanned"
+        + (f", {len(result.skipped)} skipped" if result.skipped else "")
+    )
+    summary = " · ".join(
+        f"{sev} {counts[sev]}"
+        for sev in sorted(counts, key=lambda s: SEVERITY_ORDER.get(s, 99))
+    )
+    lines.append(f"Findings:  {total}" + (f" ({summary})" if summary else ""))
+    if result.errors:
+        lines.append(f"Errors:    {len(result.errors)} (scan continued)")
+        for e in result.errors[:5]:
+            lines.append(f"  ! {e}")
+    lines.append("")
+
+    if not total:
+        lines.append("No findings — artifact looks clean under the v1 rule set.")
+        return "\n".join(lines)
+
+    for f in result.sorted_findings():
+        loc = f"{f.file}:{f.line}" if f.line else f.file
+        lines.append(f"[{f.severity.upper():8}] {f.check:12} {f.title}")
+        lines.append(f"           at {loc}")
+        if f.evidence:
+            lines.append(f"           > {f.evidence}")
+        lines.append(f"           {f.detail}")
+        lines.append("")
+    return "\n".join(lines).rstrip() + "\n"
+
+
+def render_json(result: ScanResult) -> str:
+    counts = result.counts()
+    payload: dict[str, Any] = {
+        "tool": "orithos-skill-scan",
+        "version": "0.1.0",
+        "artifact": result.source,
+        "files_scanned": result.files_scanned,
+        "summary": {
+            "total": len(result.findings),
+            "by_severity": counts,
+        },
+        "findings": [f.to_dict() for f in result.sorted_findings()],
+    }
+    if result.skipped:
+        payload["skipped"] = result.skipped
+    if result.errors:
+        payload["errors"] = result.errors
+    return json.dumps(payload, indent=2)
+
+
+def render_sarif(result: ScanResult) -> str:
+    rules = [
+        {
+            "id": f"ORITHOS-SKILL-{check.upper()}",
+            "name": check,
+            "shortDescription": {"text": title},
+        }
+        for check, title in CHECK_TITLES.items()
+    ]
+    results: list[dict[str, Any]] = []
+    for f in result.sorted_findings():
+        entry: dict[str, Any] = {
+            "ruleId": f"ORITHOS-SKILL-{f.check.upper()}",
+            "level": _SARIF_LEVEL.get(f.severity, "note"),
+            "message": {"text": f"{f.title}: {f.detail}"},
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {"uri": f.file},
+                        "region": {"startLine": f.line or 1, "startColumn": 1},
+                    }
+                }
+            ],
+            "properties": {"severity": f.severity, "evidence": f.evidence},
+        }
+        results.append(entry)
+
+    sarif = {
+        "version": "2.1.0",
+        "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "orithos-skill-scan",
+                        "version": "0.1.0",
+                        "informationUri": "https://orithos.com",
+                        "rules": rules,
+                    }
+                },
+                "results": results,
+            }
+        ],
+    }
+    return json.dumps(sarif, indent=2)

orithos_cli/template.py

@@ -0,0 +1,60 @@
+"""Scan template subcommands for Orithos CLI."""
+
+from __future__ import annotations
+
+import click
+import httpx
+
+from orithos_cli.config import get_config
+
+
+@click.group(name="template")
+def template_group() -> None:
+    """Manage scan templates."""
+    pass
+
+
+@template_group.command("create")
+@click.option("--name", required=True, help="Template name")
+@click.option("--agent-id", required=True, help="Agent ID")
+@click.option("--connection-id", default=None, help="Connection ID")
+@click.option("--depth", default="standard", type=click.Choice(["quick", "standard", "deep", "exhaustive"]), help="Scan depth")
+@click.option("--attack-suite", default="standard", type=click.Choice(["standard", "policy", "both"]), help="Attack suite")
+@click.option("--remediation-mode", default="manual_only", type=click.Choice(["advisory", "auto_patch_low_medium", "manual_only"]), help="Remediation mode")
+def create_template(name: str, agent_id: str, connection_id: str | None, depth: str, attack_suite: str, remediation_mode: str) -> None:
+    """Create a new scan template."""
+    cfg = get_config()
+    payload = {"name": name, "agent_id": agent_id, "depth": depth, "attack_suite": attack_suite, "remediation_mode": remediation_mode}
+    if connection_id:
+        payload["connection_id"] = connection_id
+    try:
+        resp = httpx.post(f"{cfg.api_url}/v1/templates", json=payload, headers=cfg.auth_headers(), timeout=cfg.timeout)
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    data = resp.json()
+    click.echo(f"Template created: {data['id'][:8]}")
+    click.echo(f"  Name:  {data.get('name', '?')}")
+    click.echo(f"  Agent: {data.get('agent_id', '?')[:8]}")
+    click.echo(f"  Depth: {data.get('depth', '?')}")
+
+
+@template_group.command("list")
+def list_templates() -> None:
+    """List all scan templates."""
+    cfg = get_config()
+    try:
+        resp = httpx.get(f"{cfg.api_url}/v1/templates", headers=cfg.auth_headers(), timeout=cfg.timeout)
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    data = resp.json()
+    items = data if isinstance(data, list) else data.get("templates", [])
+    if not items:
+        click.echo("No templates found.")
+        return
+    for t in items:
+        click.echo(f"[{t['id'][:8]}] {t.get('name', '?')} — depth={t.get('depth', '?')} suite={t.get('attack_suite', '?')}")
+        click.echo(f"  Agent: {t.get('agent_id', '?')[:8]}  Remediation: {t.get('remediation_mode', 'manual_only')}")

orithos_cli/verify.py

@@ -0,0 +1,85 @@
+"""Offline evidence-package verification (`orithos verify <package.json>`).
+
+Recomputes per-artifact SHA-256 and the Merkle root from the package's own
+artifact content and compares against the manifest. Independent
+verifiability — no Orithos contact required, which is what makes the
+package acceptable as auditor-obtained evidence (AS 1105 preference for
+directly obtained evidence; FRE 902(14) hash self-authentication basis).
+"""
+
+import hashlib
+import json
+from pathlib import Path
+from typing import Any
+
+
+def sha256_bytes(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def merkle_root(leaf_hashes: list[str]) -> str:
+    if not leaf_hashes:
+        return sha256_bytes(b"")
+    level = sorted(leaf_hashes)
+    while len(level) > 1:
+        nxt: list[str] = []
+        for i in range(0, len(level), 2):
+            left = level[i]
+            right = level[i + 1] if i + 1 < len(level) else left
+            nxt.append(sha256_bytes((left + right).encode()))
+        level = nxt
+    return level[0]
+
+
+def verify_package(pkg: dict[str, Any]) -> dict[str, Any]:
+    """Return {ok, errors, artifacts} for a parsed package dict."""
+    errors: list[str] = []
+    manifest = pkg.get("manifest", pkg)
+    artifacts = pkg.get("artifacts", {})
+    if not artifacts:
+        errors.append("no artifacts section in package")
+        return {"ok": False, "errors": errors, "artifacts": []}
+
+    computed: dict[str, str] = {}
+    for name, art in artifacts.items():
+        content = art.get("content") if isinstance(art, dict) else art
+        if content is None:
+            errors.append(f"artifact {name}: no content to hash")
+            continue
+        computed[name] = sha256_bytes(
+            json.dumps(content, sort_keys=True, default=str).encode()
+        )
+        declared = art.get("sha256") if isinstance(art, dict) else None
+        if declared and declared != computed[name]:
+            errors.append(
+                f"artifact {name}: hash mismatch (declared {declared}, computed {computed[name]})"
+            )
+
+    expected_root = manifest.get("integrity", {}).get("merkle_root")
+    if expected_root:
+        actual_root = merkle_root(list(computed.values()))
+        if actual_root != expected_root:
+            errors.append(
+                f"merkle root mismatch (declared {expected_root}, computed {actual_root})"
+            )
+    elif "merkle_root" in manifest:
+        errors.append("merkle_root declared but integrity section missing")
+    else:
+        errors.append("no merkle root declared in manifest")
+
+    return {
+        "ok": not errors,
+        "errors": errors,
+        "artifacts": [{"name": n, "sha256": h} for n, h in sorted(computed.items())],
+        "merkle_root": merkle_root(list(computed.values())),
+    }
+
+
+def verify_package_file(path: Path) -> dict[str, Any]:
+    data = json.loads(path.read_text())
+    if "manifest" in data and "artifacts" in data:
+        return verify_package(data)
+    # single-document form: {"package": {...}} or manifest-with-embedded-artifacts
+    if "package" in data:
+        return verify_package(data["package"])
+    return verify_package(data)

orithos_cli/wizard.py

@@ -0,0 +1,314 @@
+"""Interactive scan wizard for Orithos CLI — 4 steps matching dashboard."""
+
+from __future__ import annotations
+
+import httpx
+import click
+
+from orithos_cli.config import get_config, fmt_http_error
+from orithos_cli.scan import _run_scan
+
+
+DEPTH_OPTIONS = [
+    ("quick", "Quick", "Light scan, fast results"),
+    ("standard", "Standard", "Balanced coverage (default)"),
+    ("deep", "Deep", "Thorough scan, longer runtime"),
+    ("exhaustive", "Exhaustive", "Maximum coverage"),
+]
+
+REMEDIATION_OPTIONS = [
+    ("advisory", "Advisory", "Recommendations only"),
+    ("auto_patch_low_medium", "Auto-patch", "Automatic fixes for low/medium findings"),
+    ("manual_only", "Manual only", "No auto-remediation"),
+]
+
+SCHEDULE_OPTIONS = [
+    ("now", "Now", "Run immediately"),
+    ("daily", "Daily", "Daily at 06:00 UTC"),
+    ("weekly", "Weekly", "Weekly on Monday"),
+    ("monthly", "Monthly", "Monthly on 1st"),
+]
+
+DEFAULT_PROBES = [
+    "prompt_injection",
+    "tool_misuse",
+    "scope_escalation",
+    "exfil_attempt",
+]
+
+
+def _s(
+    text: str = "", fg: str | None = None, dim: bool = False, bold: bool = False
+) -> str:
+    return click.style(text, fg=fg, dim=dim, bold=bold)
+
+
+def _fetch_agents(cfg) -> list[dict]:
+    try:
+        r = httpx.get(
+            f"{cfg.api_url}/v1/agents", headers=cfg.auth_headers(), timeout=cfg.timeout
+        )
+        r.raise_for_status()
+        data = r.json()
+        return data if isinstance(data, list) else data.get("items", [])
+    except Exception:
+        return []
+
+
+def _fetch_connections(cfg) -> list[dict]:
+    try:
+        r = httpx.get(
+            f"{cfg.api_url}/v1/connections",
+            headers=cfg.auth_headers(),
+            timeout=cfg.timeout,
+        )
+        r.raise_for_status()
+        data = r.json()
+        return data if isinstance(data, list) else data.get("items", [])
+    except Exception:
+        return []
+
+
+def _pick(options: list[tuple[str, str, str]], prompt: str, default: int = 1) -> str:
+    for i, (_, label, desc) in enumerate(options, 1):
+        click.echo(f"  [{i}] {_s(label, bold=True)} \u2014 {_s(desc, dim=True)}")
+    choice = click.prompt(prompt, type=int, default=default)
+    return options[choice - 1][0]
+
+
+def _pick_from_list(
+    items: list[dict],
+    prompt: str,
+    name_key: str = "name",
+    detail_keys: list[str] | None = None,
+) -> dict | None:
+    if not items:
+        click.echo(_s("  No items available.", fg="yellow"))
+        return None
+    if len(items) == 1:
+        click.echo(f"  Using: {_s(items[0].get(name_key, '?'), bold=True)}")
+        return items[0]
+    for i, item in enumerate(items, 1):
+        label = item.get(name_key, "?")
+        details = ""
+        if detail_keys:
+            parts = [str(item.get(k, "")) for k in detail_keys if item.get(k)]
+            if parts:
+                details = " \u2014 " + " \u00b7 ".join(parts)
+        click.echo(f"  [{i}] {_s(label, bold=True)}{_s(details, dim=True)}")
+    choice = click.prompt(prompt, type=int, default=1)
+    if choice == 0:
+        return None
+    return items[choice - 1] if 0 < choice <= len(items) else None
+
+
+def _confirm(prompt: str, default: bool = True) -> bool:
+    return click.confirm(_s(prompt, dim=True), default=default)
+
+
+def interactive_wizard() -> None:
+    cfg = get_config()
+
+    click.echo()
+    click.echo(_s("\u2726 Orithos Scan Wizard", fg="green", bold=True))
+    click.echo(_s("  Configure your scan step by step.", dim=True))
+    click.echo()
+
+    # Step 1: Agent & Connection
+    click.echo(_s("Step 1/4: Agent & Connection", fg="green"))
+    click.echo(_s("  Fetching available agents...", dim=True))
+    agents = _fetch_agents(cfg)
+    if not agents:
+        click.echo(
+            _s("  No agents found. Create one in the dashboard first.", fg="red")
+        )
+        raise SystemExit(1)
+    agent = _pick_from_list(agents, "Select agent")
+    if not agent:
+        raise SystemExit(1)
+    agent_id = agent["id"]
+
+    click.echo(_s("  Fetching available connections...", dim=True))
+    connections = _fetch_connections(cfg)
+    connection_id = None
+
+    # Check for preferred connection on agent
+    preferred_id = agent.get("preferred_connection_id")
+    preferred_conn = (
+        next((c for c in connections if c.get("id") == preferred_id), None)
+        if preferred_id and connections
+        else None
+    )
+
+    skip_conn_picker = False
+    if preferred_conn:
+        conn_name = preferred_conn.get("name", "?")
+        click.echo(
+            f"  Using preferred connection: {_s(conn_name, bold=True)} (auto-selected from agent)"
+        )
+        if not click.confirm(
+            _s("  Choose a different connection?", dim=True), default=False
+        ):
+            connection_id = preferred_conn["id"]
+            agent_name = agent.get("name", agent_id[:8])
+            click.echo(
+                f"  Pairing: {_s(agent_name, bold=True)} → {_s(preferred_conn.get('base_url', '?'), dim=True)}"
+            )
+            skip_conn_picker = True
+
+    if not skip_conn_picker and connections:
+        conn = _pick_from_list(
+            connections,
+            "Select connection (0 to skip)",
+            detail_keys=["base_url", "health_status", "model_name"],
+        )
+        if conn:
+            connection_id = conn["id"]
+            agent_name = agent.get("name", agent_id[:8])
+            click.echo(
+                f"  Pairing: {_s(agent_name, bold=True)} → {_s(conn.get('base_url', '?'), dim=True)}"
+            )
+    click.echo()
+
+    # Step 2: Attack Suite
+    click.echo(_s("Step 2/4: Attack Suite", fg="green"))
+    click.echo(_s("  Select scan mode:", dim=True))
+    MODE_OPTIONS = [
+        ("agent", "Agent-Targeted", "Attacks derived from this agent's exact config"),
+        ("standard", "Standard Library", "Standard attack vectors"),
+        ("full", "Full Coverage", "Both agent-targeted and standard probes"),
+    ]
+    scan_mode = _pick(MODE_OPTIONS, "Select mode")
+    click.echo()
+
+    # Step 3: Configuration
+    click.echo(_s("Step 3/4: Configuration", fg="green"))
+
+    concurrency = click.prompt("  Concurrency (probes/batch)", type=int, default=50)
+    timeout_ms = click.prompt("  Timeout (ms)", type=int, default=30000)
+    session_isolation = _confirm("  Session isolation?")
+    test_guardrails = _confirm("  Test through guardrail layers?")
+    halt_on_critical = _confirm("  Halt on CRITICAL finding?", default=False)
+    capture_tool_traces = _confirm("  Capture tool call traces?")
+    slack_notify = _confirm("  Slack notification on completion?", default=False)
+
+    click.echo(_s("  Select scan depth:", dim=True))
+    depth = _pick(DEPTH_OPTIONS, "Choose depth")
+
+    click.echo(_s("  Select remediation mode:", dim=True))
+    remediation = _pick(REMEDIATION_OPTIONS, "Choose remediation mode")
+
+    click.echo(_s("  Schedule:", dim=True))
+    schedule = _pick(SCHEDULE_OPTIONS, "Choose schedule")
+
+    config = {
+        "concurrency": concurrency,
+        "timeout": timeout_ms,
+        "session_isolation": session_isolation,
+        "test_guardrails": test_guardrails,
+        "halt_on_critical": halt_on_critical,
+        "capture_tool_traces": capture_tool_traces,
+        "slack_notify": slack_notify,
+        "remediation_mode": remediation,
+    }
+    click.echo()
+
+    # Step 4: Review & Run
+    click.echo(_s("Step 4/4: Review & Launch", fg="green"))
+    mode_label = {
+        "agent": "Agent-Targeted",
+        "standard": "Standard Library",
+        "full": "Full Coverage",
+    }.get(scan_mode, scan_mode)
+    agent_name = agent.get("name", agent_id[:8])
+    conn_name = (
+        next(
+            (c.get("name", "?") for c in connections if c.get("id") == connection_id),
+            "None",
+        )
+        if connection_id
+        else "None"
+    )
+
+    click.echo(_s("\u250c" + "\u2500" * 47 + "\u2510", dim=True))
+    for line in [
+        f" Agent:      {agent_name}",
+        f" Connection: {conn_name}",
+        f" Mode:       {mode_label}",
+        f" Depth:      {depth}",
+        f" Remediation: {remediation}",
+        f" Concurrency: {concurrency}",
+        f" Isolation:  {'On' if session_isolation else 'Off'}",
+        f" Slack:      {'On' if slack_notify else 'Off'}",
+    ]:
+        click.echo(_s(f"\u2502 {line:<45}\u2502", dim=True))
+    click.echo(_s("\u2514" + "\u2500" * 47 + "\u2518", dim=True))
+    click.echo()
+
+    click.echo(_s("Choose action:", bold=True))
+    click.echo(
+        f"  [{_s('1', fg='green', bold=True)}] {_s('Launch Scan', fg='green', bold=True)}"
+    )
+    click.echo(
+        f"  [{_s('2', fg='yellow', bold=True)}] {_s('Save as Template', fg='yellow', bold=True)}"
+    )
+
+    action = click.prompt("Enter choice", type=int, default=1)
+    if action == 2:
+        _save_template(
+            cfg,
+            agent_id,
+            connection_id,
+            depth,
+            scan_mode,
+            remediation,
+            config,
+            agent_name,
+        )
+        return
+
+    click.echo()
+    click.echo(_s("\u2726 Starting scan...", fg="green", bold=True))
+    probe_str = ",".join(DEFAULT_PROBES)
+    _run_scan(agent_id, probe_str, "summary", 2, 600, None, connection_id, config)
+
+
+def _save_template(
+    cfg,
+    agent_id: str,
+    connection_id: str | None,
+    depth: str,
+    attack_suite: str,
+    remediation: str,
+    config: dict,
+    default_name: str,
+) -> None:
+    name = click.prompt("Template name", default=f"Scan - {default_name}")
+    template_config = dict(config)
+    template_config["remediation_mode"] = remediation
+    payload = {
+        "name": name,
+        "agent_id": agent_id,
+        "depth": depth,
+        "attack_suite": attack_suite,
+        "config": template_config,
+    }
+    if connection_id:
+        payload["connection_id"] = connection_id
+    try:
+        r = httpx.post(
+            f"{cfg.api_url}/v1/templates",
+            json=payload,
+            headers=cfg.auth_headers(),
+            timeout=cfg.timeout,
+        )
+        r.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(
+            _s(f"Error saving template: {fmt_http_error(exc)}", fg="red"), err=True
+        )
+        raise SystemExit(1)
+    data = r.json()
+    click.echo(
+        _s(f"\u2726 Template saved: {data.get('id', '?')[:8]}", fg="green", bold=True)
+    )

orithos_cli-0.1.0.dist-info/METADATA

@@ -0,0 +1,99 @@
+Metadata-Version: 2.4
+Name: orithos-cli
+Version: 0.1.0
+Summary: Orithos CLI — AI agent security testing from the terminal: scan deployed agents, MCP servers, and skill/plugin artifacts.
+Author: Orithos
+License: Proprietary
+Project-URL: Homepage, https://orithos.com
+Project-URL: Documentation, https://orithos.com/docs
+Project-URL: Repository, https://github.com/nishkmg/TraceShield
+Keywords: ai-security,agent-security,red-team,mcp,llm,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Requires-Dist: click>=8.1.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: pydantic>=2.0.0
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: pytest-mock>=3.14.0; extra == "dev"
+Requires-Dist: types-PyYAML>=6.0; extra == "dev"
+
+# Orithos CLI
+
+AI agent security testing from the terminal. Scan deployed agents and MCP
+servers against the Orithos probe catalog, vet skill/plugin artifacts before
+they run, and pull findings, compliance reports, and evidence packages — all
+from the command line.
+
+## Install
+
+```bash
+pip install orithos-cli
+```
+
+## Quick start
+
+```bash
+# Point the CLI at your Orithos account (or use ORITHOS_API_KEY / ORITHOS_API_URL env vars)
+orithos configure
+
+# Vet a skill or plugin before installing it — no account needed, fully offline
+orithos skill scan ./some-agent-skill
+
+# Scan a registered agent
+orithos scan run --agent-id <AGENT_ID>
+orithos scan status <SCAN_ID>
+orithos scan findings <SCAN_ID> --format sarif
+```
+
+## `orithos skill scan`
+
+Static vetting for agent skills, plugins, and MCP packages. Runs offline with
+zero outbound calls; archives (zip/tar.gz) are unpacked with traversal
+protection.
+
+```bash
+orithos skill scan <path|url> [--format text|json|sarif] [--fail-on critical|high|medium|low]
+```
+
+Seven check classes: manifest hygiene · declared-vs-implied permissions ·
+outbound destinations (exfil-prone endpoints, IP literals) · shell & install
+hooks · credential access · obfuscation · known-bad signatures. Every finding
+cites file, line, and evidence.
+
+Exit codes: `0` clean · `1` findings at/above `--fail-on` (default `high`) ·
+`2` error — ready for CI gates.
+
+## Commands
+
+- `orithos agent ...` — register and manage agent endpoints
+- `orithos scan ...` — run scans, fetch findings (`summary`/`json`/`sarif`/`junit`)
+- `orithos skill scan ...` — static skill/plugin vetting
+- `orithos mcp ...` — interact with the Orithos MCP policy server
+- `orithos compliance ...` — compliance mappings and reports
+- `orithos verify <package>` — offline evidence-package integrity check (hashes + Merkle root)
+- `orithos connection / discovery / graph / guardrail / probes / remediation / runtime ...` — platform workflows
+
+## Environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ORITHOS_API_KEY` | — | API key (`tsk_...`); overrides the config file |
+| `ORITHOS_API_URL` | `https://api.orithos.com` | API base URL |
+| `ORITHOS_ORG_ID` | — | Organisation ID (optional override) |
+| `ORITHOS_TIMEOUT` | `30` | Request timeout in seconds |
+
+## Development
+
+```bash
+pip install -e "apps/cli[dev]"
+pytest -q
+```