CLI

lore is a single static binary: a demo you can run with no key and no cluster, a one-off investigator for your own stack, and the same engine that runs continuously as lore serve. This page covers the CLI front door — install, the two zero-ceremony commands, and how each one degrades when something isn’t configured.

Install

curl -fsSL https://runlore.io/install.sh | sh

The script downloads the release archive for your OS/arch from the GitHub release, verifies its SHA-256 against the published checksums.txt before extracting anything, and installs lore to /usr/local/bin — falling back to ~/.local/bin (no sudo, ever) if that isn’t writable. It’s a small, readable POSIX shell script; audit it yourself at website/static/install.sh.

Environment variables:

Prefer not to pipe a script into a shell? Build from source instead — no third-party trust beyond the Go toolchain and the module graph:

go install github.com/Smana/runlore/cmd/lore@latest

Verify the release signature (optional). Every release is keyless-signed with cosign in CI (id-token: write, no long-lived key) — the installer prints this command, or run it yourself:

cosign verify-blob --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github.com/Smana/runlore/.github/workflows/release-binaries.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt

Verifying checksums.txt transitively covers every archive it lists.

lore demo investigate --offline default

The fastest way to see RunLore reach a real root cause — no API key, no network, no cluster:

lore demo investigate --offline default

This replays a recorded transcript of a genuine investigation (examples/demo/harbor-chart-bump.transcript.json) through the real production loop — the same ReAct tool calls, verify pass, and verdict-card renderer that run in lore serve — over fake (but realistic) evidence for a Harbor chart-bump incident. Nothing about the reasoning is scripted for the demo: the model turns were captured once against a live model and are replayed byte-for-byte.

The card discloses its own provenance so you know exactly what you’re looking at:

== RunLore demo: investigating "harbor-chart-bump" (recorded model turns, fake providers, no cluster) ==
   model turns recorded 2026-08-02T07:48:52Z with openai/glm-4.5-air

That line is not decoration — it’s the honesty mechanism. A recording ages: model behavior on the same evidence can drift release to release, so the date and model tell you exactly how current the transcript is, rather than implying it’s live. Re-record it yourself against your own model with --record:

lore demo investigate --record my-transcript.json   # needs a model key; runs live
lore demo investigate --offline my-transcript.json  # replays it back, keyless

Without --offline, lore demo investigate [--scenario <name>] runs the same loop live against fake providers — it still needs no cluster, but it does need a model key (ANTHROPIC_API_KEY by default, or --config pointing at a runlore.yaml).

lore investigate

lore investigate --alert <name> [--message <text>] [--namespace <ns>] runs one on-demand investigation against your stack and prints the findings — no runlore.yaml required. With no --config, it reads its model from the environment, in this order:

A ./runlore.yaml, if present, is read automatically; --config <path> points at one explicitly (and a missing explicit path is a hard error — the flag is a promise, not a hint).

Flags override whatever the config resolved to, so you can point the CLI at your stack without writing a file at all:

What degrades, and what that notice means

investigate never refuses to run just because a signal is missing — it runs on whatever’s configured and says so on stderr:

note: running without metrics (query_metrics), logs (query_logs), knowledge catalog (kb_search, instant recall) — pass --metrics-url/--logs-url or a --config to enable them

This notice means “under-configured,” not “broken.” The investigation still runs to completion and still reaches a verdict — just over whatever evidence is available. Treat the notice as a checklist for widening the picture, not as an error to work around.

When to move to lore serve

The CLI is for a one-off look — a specific alert, right now, from your terminal. Once you want RunLore reacting to incidents continuously, delivering to chat, and writing what it learns back to a knowledge-base repo as pull requests, the same engine runs in-cluster as lore serve, deployed via Helm. See Getting Started for the full production install — GitOps engine wiring, the GitHub App for curation, credentials, and a complete values.yaml reference.