Tork CLI Reference

What is published, and what is not

The Tork CLI is the npm package @torknetwork/cli (Node.js 20+), with the eight commands listed below. An earlier version of this page documented a Python CLI installed by pip install tork-governance with tork scan, tork policy, MCP configuration scanning, SARIF output, custom security rules and batch scanning. None of that is published: the PyPI package ships no command-line entry point, and the npm CLI has no scan or policy command. Those sections were removed on 24 September 2026.

# Run without installing (Node.js 20 or newer)
npx @torknetwork/cli --help

# Or install globally
npm install -g @torknetwork/cli

# Or via Homebrew (wraps the same npm package)
brew install torkjacobs/tap/tork

# Check the installed version
tork --version

tork login    # 1. authenticate with your tork_ API key
tork init     # 2. install the SDK + write tork.config.json in your project
tork test     # 3. send a synthetic governed request end to end
tork doctor   # 4. verify the whole setup

# Interactive: prompts for the key with masked input,
# validates it live against the API, stores it in ~/.tork/config.json (mode 600)
tork login

# Non-interactive (CI, scripts)
tork login --key tork_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Read the key from 1Password (requires the op CLI; the key is never printed)
tork login --op "op://Vault/Tork/api_key"

# Machine-readable result
tork login --key "$TORK_API_KEY" --json

# Detects your stack (package.json -> Node, requirements.txt / pyproject.toml -> Python),
# asks how you want to govern, installs the matching SDK and writes tork.config.json
tork init

# Skip stack detection
tork init --lang node
tork init --lang python

# Skip the governance-mode prompt
#   cloud = governance via tork.network (receipts + dashboard, needs an API key; Node only)
#   local = on-device PII detection only (no key; the dashboard stays empty)
tork init --mode cloud
tork init --mode local

# Skip every prompt (defaults to Node and cloud mode when unspecified)
tork init --yes

{
  "org_id": "",
  "agent_id": "default-agent",
  "agent_role": "assistant",
  "session_tracking": true,
  "base_url": "https://tork.network"
}

# Runs every setup check and keeps going through failures.
# Exits 1 if anything failed.
tork doctor

# {checks: [...], summary: {...}} for CI and AI agents
tork doctor --json

Checks, in order

1. Config file exists with 600 permissions
2. API key present and format-valid
3. DNS + TLS reachability of the base URL
4. /api/v1/health reports healthy
5. Key accepted by the server
6. tork.config.json present in the current directory (warn only)
7. Tork SDK installed in the project — tork-governance (local) or @torknetwork/sdk (cloud), with version (warn only)
8. Node.js version 20 or newer

Ends with N passed, N warnings, N failed and exits 1 if anything failed.

# Recent governance decisions for your org (backed by GET /api/v1/receipts).
# Oldest first, so the latest decision is at the bottom.
tork logs

# Show more decisions (default 20)
tork logs --limit 50

# Poll every 5 seconds and print new decisions as they arrive (Ctrl+C to stop).
# --follow cannot be combined with --json.
tork logs --follow

# Machine-readable entries
tork logs --json

# List recent receipts (default 20)
tork receipts
tork receipts --limit 50

# Fetch one receipt by id and verify it
tork receipts tork_rcpt_xxx

# Full receipt / verification result as JSON
tork receipts tork_rcpt_xxx --json

# Plan usage for the authenticated org, from GET /api/v1/usage:
# plan name, usage bar, calls used / limit, calls remaining, billing period.
# Warns at 80% of the limit and again at 100%.
tork usage

# Raw API response plus the normalised summary
tork usage --json

# Active key (masked to tork_****last4), org, base URL and config path.
# The org is checked live; if the server rejects the key the command exits 1.
tork whoami
tork whoami --json

# Overrides the stored key — nothing is written to disk (ideal for CI)
export TORK_API_KEY=tork_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Overrides the API base URL (default https://tork.network)
export TORK_BASE_URL=https://tork.network

# Overrides ~/.tork (tests / sandboxes)
export TORK_CONFIG_DIR=/tmp/tork-ci

# Disables coloured output
export NO_COLOR=1

# .github/workflows/governance-check.yml
jobs:
  governance:
    runs-on: ubuntu-latest
    env:
      TORK_API_KEY: ${{ secrets.TORK_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: {node-version: 20}
      - run: npx @torknetwork/cli doctor --json
      - run: npx @torknetwork/cli test --json