pyre

A terminal UI for Palo Alto firewalls. Answers the questions you'd otherwise click through thirty tabs of the PAN-OS web UI to find.

Why pyre?

The PAN-OS web interface turns every question into a sequence of clicks — system info, then policies, then sessions, then logs. Each view is a separate page load.

pyre combines those calls into unified terminal views: system health, HA, resource usage, and sessions in one dashboard; instant filter and sort on policies, sessions, and objects; no context switches. Built for network engineers who want answers fast.

Features

• Dashboards — system, network, security, VPN at-a-glance
• Policies, NAT, objects — browse, filter, sort, hit-count analysis, inline detail
• Sessions, routes, interfaces — live state with substring filter and per-view sort
• VPN — IPSec tunnel status + GlobalProtect connected users
• Logs — system / traffic / threat with cycle-on-key
• Panorama — connect to Panorama and target managed firewalls; the same views, scoped per device
• Multi-firewall — connection hub + quick picker (:)
• Command palette — Ctrl+P fuzzy-jumps to any view
• 10 themes — dark, light, nord, dracula, solarized, gruvbox, tokyonight, catppuccin, onedark, monokai (see docs/configuration.md)

Install

Download from Releases. Archives ship with an SPDX SBOM and a shared checksums.txt.

# macOS / Linux — set VERSION, OS (darwin|linux), ARCH (arm64|amd64)
VERSION=1.5.3 OS=darwin ARCH=arm64
curl -sSL "https://github.com/jp2195/pyre/releases/download/v${VERSION}/pyre_${VERSION}_${OS}_${ARCH}.tar.gz" | tar xz
chmod +x pyre
sudo mv pyre /usr/local/bin/pyre

Windows: extract the .zip, drop pyre.exe on your PATH.

Or build from source (Go 1.26+):

go install github.com/jp2195/pyre/cmd/pyre@latest

macOS: "cannot be opened because the developer cannot be verified"

pyre isn't notarized with Apple, so macOS may refuse to run it and send you to System Settings → Privacy & Security to click "Open Anyway".

Installing with curl (above) avoids this entirely. The quarantine flag that triggers Gatekeeper is applied by the downloading program — browsers set it, curl doesn't — so a curl-installed binary runs with no prompt.

If you already downloaded the archive in a browser, clear the flag instead of digging through System Settings:

xattr -d com.apple.quarantine ./pyre

go install is likewise unaffected, since nothing is downloaded through a browser.

Verifying releases

Every release is checksummed, signed, and attested at build time:

• checksums.txt — SHA-256 checksums covering every archive.
• checksums.txt.bundle — Sigstore cosign keyless signature bundle (signature, certificate, and transparency-log entry in one file), tied to this repo's release workflow identity.
• GitHub build provenance (SLSA) — ties each archive to the exact Actions run that built it.

# 1. Verify the checksum file's signature (requires cosign 2.6+ for the
#    Sigstore bundle format)
cosign verify-blob \
  --bundle checksums.txt.bundle \
  --certificate-identity-regexp 'https://github.com/jp2195/pyre/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# 2. Verify your downloaded archive against the signed checksums
sha256sum --check --ignore-missing checksums.txt

# 3. (Optional) Verify build provenance with the GitHub CLI
gh attestation verify pyre_<version>_<os>_<arch>.tar.gz --repo jp2195/pyre

Quick start

# one-off
pyre --host firewall.example.com --api-key YOUR_API_KEY

# env var
export PYRE_API_KEY=...
pyre --host firewall.example.com

# saved connection
cat > ~/.pyre.yaml <<'YAML'
default: 10.0.0.1
connections:
  10.0.0.1:
    insecure: true
YAML
pyre -c 10.0.0.1

Important

pyre does not persist credentials. Supply an API key at each invocation via --api-key, PYRE_API_KEY, or per-host PYRE_<HOST>_API_KEY. If none is provided, pyre prompts for username + password, runs keygen, and uses the resulting key for the current session only. ~/.pyre.yaml never contains credentials.

For private-CA firewalls, use ca_cert_path: /path/to/ca.pem in the connection config instead of --insecure.

What it looks like

Navigation

Three levels, three sets of keys:

• 1 Monitor (dashboards), 2 Analyze (list views), 3 Tools (config)
• Tab / Shift+Tab move between views in the active group
• [ / ] switch sub-tabs within a view (Objects, Routes, Logs)

Ctrl+P opens a fuzzy command palette that jumps anywhere.

Inside a list view: / filter, s cycle sort, Enter open detail, r refresh, ? help, q quit. Dashboards taller than your terminal scroll with j/k.

New to pyre? The "first 60 seconds" section of Getting Started walks the model in one read. Full key reference: docs/keybindings.md.

Documentation

• Getting Started — install, first connection, and a 60-second navigation walkthrough
• Configuration — ~/.pyre.yaml, env vars, CLI flags, credential resolution
• Keybindings & Navigation — every key in every view
• Panorama — managing devices through Panorama
• View reference — what each view shows and how its filter / sort / detail panel work

Contributing

Bug reports, feature ideas, and docs PRs all welcome. See CONTRIBUTING.md for the setup and PR process.

License

Apache 2.0. See LICENSE.