jcli

Quick Start

Install jcli (one-liner)

curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash

This drops a single Rust binary at ~/.local/bin/jcli and verifies its SHA-256 (and Ed25519 signature, if signify is installed).

Manage the rest of the suite through jcli

jcli list                         # all available tools
jcli list --role blue             # filter by daily-use role (red / blue / dual)
jcli list --tag forensics         # filter by tag (siem, phishing, recon, …)
jcli install urlrecon phishprobe  # install one or more
jcli info urlrecon                # details + status
jcli run urlrecon -- --help       # exec an installed tool through jcli
jcli update --all                 # keep everything current
jcli doctor                       # environment health check
jcli rollback urlrecon            # restore the previous .bak

Investigation playbooks

jcli playbook                     # list the 6 canonical playbooks
jcli playbook incident-response   # show the step list with per-step rationale
jcli playbook phishing-triage     # phishprobe → urlrecon → socq, scored
jcli playbook external-recon      # urlrecon → darkrecon → webharvest → …

Uninstall

rm ~/.local/bin/jcli ~/.local/bin/jcli.bak 2>/dev/null
rm -rf ~/.jcli/                     # registry (chmod 600)

What it does

jcli is the suite manager for cli.johlem.net's Rust tooling line. It does for the security toolkit what cargo does for Rust crates or rustup does for Rust toolchains: one command-line to install, update, list, and run every sister tool in the suite.

• Catalogue-driven. jcli reads cli.johlem.net/catalogue.json to know what's available. Adding a new tool to the suite means adding one entry server-side — no client update.
• Signed releases. Every binary jcli installs is SHA-256 verified and, if signify is available, Ed25519-signature verified against johlem-release.pub before being placed on disk.
• Atomic install with backup. Every install / update moves the previous binary to <tool>.bak before placing the new one. jcli rollback <tool> restores it.
• Local registry. What jcli installed (with version + source + install timestamp) lives at ~/.jcli/installed.toml — chmod 600 because it can leak your monitored host list otherwise.
• Pipe-clean JSON. jcli list --output json and jcli info <tool> --output json produce stable JSON for scripting.

Subcommands

Playbooks

Each playbook is an ordered list of tools — one tool per step — with a one-line "why this step" annotation. They mirror socq's pack idea but at the suite level: a quick map from a real scenario (incident, hunt, engagement) to the tools that move it forward.

Roles & tags

The suite ships as one set of binaries, but daily-use mental models split into three roles. jcli list --role and --tag filter the catalogue without a server round-trip — the annotations are baked into the binary.

On-disk layout

~/.local/bin/<tool>       # the static binary itself
~/.local/bin/<tool>.bak   # previous version (rollback target)
~/.jcli/installed.toml    # registry (chmod 600)
~/.local/share/<tool>/    # per-tool data dir (config, state)

Two env vars override the defaults so jcli can be sandboxed for testing or used out of a shared user account:

• JCLI_HOME — overrides ~/.jcli (registry location)
• JCLI_INSTALL_DIR — overrides ~/.local/bin (install destination)