CLI

mamori (import path github.com/xavidop/mamori/cmd/mamori) is a standalone CLI built around the same source: tag conventions and Report shape the library uses. It has two halves that never mix:

• Static commands (explain, schema, policy, vet) read your Go source and never resolve anything.
• Live commands (doctor and status) query a running process’s admin endpoint and set an exit code.

flowchart TD
  CLI[mamori CLI]
  CLI --> S["Static: explain, schema, policy, vet"]
  CLI --> L["Live: doctor, status"]
  S -->|"read Go source, never resolve"| Src[("your config structs")]
  L -->|"GET / on the admin endpoint"| Proc[("a running process")]

Install

Both halves are the same binary. Homebrew tracks tagged releases; go install builds from source at whatever ref you name.

brew install xavidop/tap/mamori

go install github.com/xavidop/mamori/cmd/mamori@latest

Getting help

Every command prints its own usage, including the flags it accepts and, for the sensitivity-aware ones, the built-in secret-bearing schemes:

mamori --help          # the command list
mamori vet --help      # one command's flags (also -h)

Help goes to stdout and exits 0, so it pipes to a pager cleanly and a script checking the exit code does not read it as a failure. Errors are the opposite: the message and usage go to stderr with a non-zero exit.

Quick start

Static commands take a Go package pattern (./... for a whole module, a package path, or nothing for the current directory). Read what a config struct declares:

$ mamori explain ./... --type=Config
main.Config
FIELD           TYPE           CHAIN                   DEFAULT  OPTIONAL  SENSITIVE
Redis.Addr      string         env://REDIS_ADDR        -        false     false
Redis.Password  secret.String  aws-sm://prod/redis-pw  -        false     true

Live commands query a running process over its admin endpoint and set an exit code you can branch on:

$ mamori doctor --endpoint https://svc.internal:9090
HEALTHY: 2 field(s), snapshot 3 (live 3), generated 2026-07-26T10:00:00Z
$ echo $?
0

Next

• mamori explain - list every config struct and its source: refs.
• mamori schema - emit a JSON Schema for a config struct.
• mamori policy - emit a least-privilege access artifact.
• mamori vet - flag secret-bearing sources stored in plain string/[]byte.
• mamori doctor and status - check a running process, with exit codes.

See also

Observability covers the Report/FieldStatus shape the live commands render. Config server shares the same endpoint forms and Authenticator types. Concepts covers source chains, which explain’s CHAIN column and policy’s ref extraction read.