greynoise-cli

greynoise

A command line for greynoise.

greynoise is a single pure-Go binary. It reads public greynoise data over plain HTTPS, shapes it into clean records, and prints output that pipes into the rest of your tools. No API key, nothing to run alongside it.

The same package is also a resource-URI driver, so a host program like ant can address greynoise as greynoise:// URIs.

Install

go install github.com/tamnd/greynoise-cli/cmd/greynoise@latest

Or grab a prebuilt binary from the releases, or run the container image:

docker run --rm ghcr.io/tamnd/greynoise:latest --help

Usage

greynoise page <path>                      # fetch one page as a record
greynoise page <path> -o json              # as JSON, ready for jq
greynoise page <path> --template '{{.Body}}'  # just the readable body text
greynoise links <path>                     # the pages it links to, one per line
greynoise --help                           # the whole command tree

Every command shares one output contract: -o table|json|jsonl|csv|tsv|url|raw, --fields to pick columns, --template for a custom line, and -n to limit. The default adapts to where output goes (a table on a terminal, JSONL in a pipe), so the same command reads well by hand and parses cleanly downstream.

This is a fresh scaffold. It ships one example resource type, page, wired end to end. Model the real greynoise records in greynoise/ and declare their operations in greynoise/domain.go; each one becomes a command, an HTTP route, and an MCP tool at once.

Serve it

The same operations are available over HTTP and as an MCP tool set for agents, with no extra code:

greynoise serve --addr :7777    # GET /v1/page/<path>  returns NDJSON
greynoise mcp                   # speak MCP over stdio

Use it as a resource-URI driver

greynoise registers a greynoise domain the way a program registers a database driver with database/sql. A host enables it with one blank import:

import _ "github.com/tamnd/greynoise-cli/greynoise"

Then ant (or any program that links the package) dereferences greynoise:// URIs without knowing anything about greynoise:

ant get greynoise://page/<path>   # fetch the record
ant cat greynoise://page/<path>   # just the body text
ant ls  greynoise://page/<path>   # the pages it links to, each addressable
ant url greynoise://page/<path>   # the live https URL

Development

cmd/greynoise/   thin main: hands cli.NewApp to kit.Run
cli/                 assembles the kit App from the greynoise domain
greynoise/                the library: HTTP client, data models, and domain.go (the driver)
docs/                tago documentation site

make build      # ./bin/greynoise
make test       # go test ./...
make vet        # go vet ./...

Releasing

Push a version tag and GitHub Actions runs GoReleaser, which builds the archives, Linux packages, the multi-arch GHCR image, checksums, SBOMs, and a cosign signature:

git tag v0.1.0
git push --tags

The Homebrew and Scoop steps self-disable until their tokens exist, so the first release works with no extra secrets.

License

Apache-2.0. See LICENSE.