Hermai Cli

hermai-cli

English · 繁體中文 · 简体中文

Discover, contribute, and call structured website APIs from your terminal.

hermai is the open-source CLI for the Hermai registry — a community catalog of website API schemas for AI agents. Probe a site to document its endpoints, push the schema to the catalog, or pull an existing schema and call it — including authenticated writes with per-request signing.

Install

# macOS and Linux via Homebrewbrew install hermai-ai/hermai/hermai
# Anywhere Node is installed (no Go toolchain needed)npm install -g hermai-cli      # or: npx hermai-cli --help
# Go developersgo install github.com/hermai-ai/hermai-cli/cmd/hermai@latest
# Prebuilt binaries for every OS × arch# https://github.com/hermai-ai/hermai-cli/releases/latest

Already installed? Upgrade in place without re-running any of the above:

hermai update

Agent skill

Running in Claude Code, Codex, Cursor, or another agent? Install the Hermai skill so the agent knows how to use this CLI:

npx skills add hermai-ai/hermai-skills --skill hermai

One skill covers both audiences. When a user asks for data from a site, the agent pulls the schema and calls it. When a user wants to add a new site, the skill's contributor references (loaded on demand via progressive disclosure) walk the agent through discovery, schema authoring, and push.

Repo: hermai-ai/hermai-skills.

Call a site as an API

# Pull a schema (API key required, GitHub sign-in at hermai.ai/dashboard)hermai registry loginhermai registry pull x.com --intent "drafting a post from my agent"
# Read endpoints: call them directly with curl / fetch / any HTTP client.# Authenticated writes: `hermai action` handles sessions + signing for you.hermai action x.com CreateDraftTweet --arg text="drafted by hermai"

hermai action loads the schema, resolves the user's session (cookies from disk, or pulled from an installed browser on first run), runs any schema-declared bootstrap JS to compute per-session state, runs any per-request signer JS, fires via a Chrome-TLS fingerprinted HTTP client, and rotates Set-Cookie back on 2xx responses. Works against sites that require per-request signing (X's x-client-transaction-id, TikTok's X-Bogus) without opening a browser.

Useful flags:

• --dry-run — print the fully-signed request, don't hit the network
• --schema <file> — use a local schema JSON instead of the registry cache
• --arg key=value — repeatable, fills {{var}} placeholders in the schema's URL/body templates

Registry

hermai registry login                         # GitHub OAuth, stores API keyhermai registry list                          # browse the cataloghermai registry pull <site> --intent "..."    # download a schemahermai registry push schema.json              # contribute a schema

Discovery toolkit

Deterministic subcommands for composing a new schema. No LLM key — each prints JSON the next step can consume.

hermai detect <url>                          # platform + anti-bot classificationhermai wellknown <domain>                    # robots, sitemap, RSS, GraphQLhermai probe --body <url> | hermai extract   # 13 named embedded-data patterns plus                                             # any <script type="application/json" id="X">hermai probe --body <pdf-url> | hermai extract --state IL --url <pdf-url> --report-month 2026-02hermai enforcement --state IL <root-url>     # discover Illinois IDFPR PDFs and emit cited actionshermai intercept <url>                       # capture XHR in a browserhermai introspect <graphql-url>              # GraphQL schemahermai replay request.json                   # replay a captured requesthermai session bootstrap <site>              # warm a fresh browser sessionhermai session import <site>                 # import cookies from your current browser

Capturing authenticated write endpoints

Most interesting APIs are gated behind cookies. To capture a write flow (add-to-cart, save-draft, submit-review) without logging in a second time, combine headful intercept with session injection:

# 1. Pull cookies from the browser you're already signed in withhermai session import example.com
# 2. Open a visible Chrome, pre-loaded with those cookies, and capture what you clickhermai intercept https://example.com/product/123 \  --headful --session example.com \  --timeout 120s --wait 100s --ndjson > capture.ndjson
# 3. Grep/jq the captured JSON for the XHR of interestgrep -F 'CreateOrder' capture.ndjson | jq '.request.body'

The request body goes straight into your schema's body_template with {{var}} placeholders for user-varying fields. Capture, don't guess — inventing body fields is the #1 cause of rejected write schemas.

hermai introspect takes --header name=value (repeatable) for auth-gated GraphQL endpoints like Shopify Storefront or Estée Lauder's Stardust.

Import your existing browser session

When a schema requires login (post a tweet, add to cart, RSVP), you can use the session you already have in Chrome, Firefox, Safari, Edge, or Brave — no need to log in again:

hermai session import x.com# Reads cookies scoped to x.com from your installed browsers,# saves them to ~/.hermai/sessions/x.com/cookies.json

The first run surfaces an OS-level authorization prompt (macOS Keychain, Windows DPAPI, Linux libsecret) — Hermai can't read your cookies without your explicit consent at the OS level. Reads are always scoped to the single domain you name; we never touch cookies for other sites.

Use --dry-run to see the cookie names without writing values to disk:

hermai session import x.com --dry-run

Local cache

hermai catalog <url>                          # summarize cached endpoints for a URLhermai schema <url>                           # show the cached schema JSONhermai cache list                             # list cached domainshermai init                                   # create ~/.hermai/config.yamlhermai doctor                                 # verify your setup

hermai --help for the full command list.

Docs

• Concepts + schema spec — docs.hermai.ai
• Hosted registry + dashboard — hermai.ai
• Skill reference: hermai-ai/hermai-skills — architecture, runtime, CLI, contributing

License

AGPL-3.0. Running a modified version as a hosted service requires publishing your changes.