coregrc runs Core GRC tools from your terminal. It uses the same tools, permissions, and sign-in as the Claude connector, so anything Claude can do in your organization you can also script.

Install

You need Node.js 22 or later.

npm install -g coregrc
coregrc --version

To run it without installing:

npx coregrc --help

To update, run npm install -g coregrc again. To remove it, run coregrc logout and then npm uninstall -g coregrc.

Sign in

coregrc login
  1. Your browser opens on Core GRC. If it doesn't, copy the link the CLI prints.
  2. Sign in if you're asked to, then under Choose an organization to continue pick an organization. Only organizations you've already signed in to in that browser are shown.
  3. Check the details and choose Allow access. The terminal prints Signed in.

The CLI waits five minutes for you to finish. It receives the sign-in on your own computer at http://127.0.0.1:8788/callback, or the next free port up to 8798.

Check who you're signed in as:

coregrc whoami

This shows your user, role, organization, active modules, and whether you can view or manage each one.

One organization per sign-in

Each sign-in is for one organization. To switch, run coregrc logout and then coregrc login. To keep several organizations signed in, give each its own credentials file:

COREGRC_CREDENTIALS=~/.config/coregrc/acme.json coregrc login
COREGRC_CREDENTIALS=~/.config/coregrc/acme.json coregrc whoami

Signing in on a remote machine

The sign-in comes back to 127.0.0.1 on the machine running coregrc. Over SSH, forward the port first, then open the printed link in your local browser:

ssh -L 8788:127.0.0.1:8788 you@server
coregrc login

If the CLI picks a port other than 8788 because it's taken, forward that port instead. The port appears in the redirect_uri part of the printed link.

How long you stay signed in

The CLI refreshes your access automatically. You need to sign in again after 30 days without using it, 90 days after you signed in, if you leave the organization, or if your organization requires two-factor sign-in and you haven't set it up.

Sign-in needs a browser. There's no API key or unattended login for CI.

Sign out

coregrc logout

This revokes the sign-in with Core GRC and deletes the stored credentials.

Commands

Command What it does
coregrc login Sign in through your browser
coregrc logout Revoke the sign-in and delete stored credentials
coregrc whoami Show your user, role, organization, and active modules
coregrc tools List every tool you can use, one per line: name, a tab, then its description
coregrc tools --module <prefix> List one module's tools, for example --module rights
coregrc describe <tool> Show a tool's title, description, and input schema as JSON
coregrc call <tool> [json] Call a tool by its full name
coregrc <module> <action> [json] Call a tool by module and action
coregrc --version Print the CLI version
coregrc --help Show help

Calling tools

The module is the tool's prefix, and the action is the rest of its name in kebab-case or as separate words. These all call tprm_list_entities:

coregrc tprm list-entities '{"entityType":"vendor"}'
coregrc tprm list entities '{"entityType":"vendor"}'
coregrc call tprm_list_entities '{"entityType":"vendor"}'

Modules: tprm (third-party risk management), policy (privacy policies and notices), consent (cookie consent), rights (privacy rights), and webaccess (website accessibility). You only see modules your organization has active, and only the tools your role allows. The full list is on the Tools page, or run coregrc tools.

Short names that Core GRC recognises also work, for example coregrc tprm dashboard for tprm_get_dashboard.

Arguments are a single JSON object, always last. To see which arguments a tool takes:

coregrc describe tprm_list_entities

List tools page with page and pageSize. The record types in third-party risk management are singular: vendor, asset, service, element, processing-activity, ai-system.

Arguments from a file

For long arguments, such as an assessment template's questions, put the JSON in a file and pass @ and its path. @- reads from stdin.

coregrc tprm create-template @supplier-security.json
cat supplier-security.json | coregrc tprm create-template @-

supplier-security.json:

{
  "name": "Supplier security",
  "category": "Security",
  "questions": [
    { "question": "Do you encrypt customer data at rest?", "type": "yes-no" },
    { "question": "Which certifications do you hold?", "type": "multiple-choice", "options": ["ISO 27001", "SOC 2", "None"] },
    { "question": "Describe your incident response process.", "type": "textarea" }
  ]
}

Question types: text, textarea, number, single-choice, multiple-choice, yes-no, scale, date, and statement. Use the returned id as templateId in start-assessment-job.

Quoting JSON

Wrap the JSON in single quotes in bash, zsh, and PowerShell 7.3 or later. In Windows Command Prompt, use double quotes and escape the inner ones:

coregrc tprm list-entities "{\"entityType\":\"vendor\"}"

Changes that need confirm

Deleting, archiving, cancelling, restoring a previous version, publishing cookie consent settings, starting a cookie scan, and creating a website that uses a paid licence all need "confirm": true:

coregrc tprm archive-entity '{"entityType":"vendor","id":"<id>","confirm":true}'

Without it, nothing changes and the CLI prints what would have happened. Archive where you can: it can be undone, and delete can't.

Output and scripting

Results print to stdout as formatted JSON.

  • A successful call prints the tool's result and exits 0.
  • A failed tool call prints {"success": false, "error": "..."} and exits 1.
  • Problems before the call, such as not being signed in or invalid JSON, print a message to stderr and exit 1.

This makes the CLI easy to use with tools like jq:

coregrc tprm list-entities '{"entityType":"vendor","pageSize":100}' | jq -r '.items[].name'

Run a command once without jq to see the shape of its result.

Changes made through the CLI are saved with source cli, so they can be told apart from changes made in the app or through Claude.

Examples

# Third-party risk management
coregrc tprm dashboard
coregrc tprm list-risks
coregrc tprm create-vendor '{"name":"Acme Hosting","website":"https://acme.example"}'
coregrc tprm list-templates
coregrc tprm create-template @supplier-security.json
coregrc tprm start-assessment-job '{"templateId":"<id>","entityType":"vendor","entityId":"<id>"}'
coregrc tprm get-assessment-job-status '{"jobId":"<id>"}'

# Privacy policies and notices
coregrc policy list-policies
coregrc policy get-policy '{"id":"<id>"}'

# Cookie consent: preview, then publish exactly what you previewed
coregrc consent preview-publish '{"websiteId":"<id>"}'
coregrc consent publish-website '{"websiteId":"<id>","expectedDraftHash":"<draftHash from preview>","confirm":true}'
# Add "reconsent":true to ask visitors who already chose to choose again

# Privacy rights
coregrc rights list-requests
coregrc rights get-stats

# Website accessibility
coregrc webaccess start-scan '{"websiteId":"<id>"}'
coregrc webaccess list-scan-issues '{"jobId":"<id>","limit":10}'

Upload a document

Files go through a 15-minute signed upload link. You need manage permission for assets.

# 1. Get an upload link. Note signedUrl and objectPath in the result.
coregrc tprm create-document-upload-url '{"contentType":"application/pdf","originalName":"soc2.pdf"}'

# 2. Upload the file. Content-Type must match step 1.
curl -X PUT "<signedUrl>" -H "Content-Type: application/pdf" --data-binary @soc2.pdf

# 3. Attach it to a record.
coregrc tprm create-document '{"entityType":"vendor","entityId":"<id>","name":"SOC 2 report","type":"file","category":"Security","objectPath":"<objectPath>"}'

Documents also covers web links and attaching existing documents.

CLI-only tools

Core IQ full reviews are long-running research jobs that count against your plan's review quota, so they're available in the CLI and the app but not in Claude. They need the canManageCoreIq permission.

coregrc tprm start-full-review '{"entityType":"vendor","entityId":"<id>"}'
coregrc tprm get-full-review-status '{"jobId":"<jobId>"}'

Environment variables

Variable What it sets Default
COREGRC_CREDENTIALS Where credentials are stored ~/.config/coregrc/credentials.json
COREGRC_APP_ORIGIN The Core GRC app used for sign-in https://app.core-grc.com
COREGRC_MCP_URL The tools server. Overrides the address saved at sign-in https://mcp.core-grc.com/mcpHttp
COREGRC_OAUTH_URL The sign-in server. Overrides the address saved at sign-in https://mcp.core-grc.com/mcpOauthHttp

You only need the last three if Core GRC support asks you to use a different environment.

The credentials file holds your access and refresh tokens. The CLI creates it readable only by you (on Windows it's under %USERPROFILE%\.config\coregrc). Don't share it or commit it.

Troubleshooting

Message What to do
Not signed in. Run: coregrc login Run coregrc login, or check COREGRC_CREDENTIALS points to the right file
Refresh token is invalid or Session ended. Sign in again. Your sign-in has expired or you left the organization. Run coregrc login
Multi-factor authentication is required Your organization requires two-factor sign-in. Set it up in the Core GRC app, then run coregrc login
Sign-in timed out Finish signing in within five minutes, then run coregrc login again
Could not bind a loopback callback port Ports 8788 to 8798 are all in use. Free one and try again
Unknown command: <module> Your organization doesn't have that module active, or your role can't use it. Check coregrc whoami
Unknown tool: <name> Check the spelling with coregrc tools --module <module>. Tools that change data need manage permission
Module … is not enabled for this organization The module was paused or its subscription ended
Set confirm to true to run … Add "confirm": true to the JSON if you meant to make that change
Invalid JSON arguments Pass one JSON object, quoted for your shell (see Quoting JSON)

Still stuck? Email support@core-grc.com with the command you ran and the message you got. Don't include your credentials file.