Hiroto

Your terminal, your agent. Write code, hunt bugs, automate workflows — all from the command line.

What is this

Hiroto is an AI agent that lives in your terminal. Not a web chatbot — it runs shell commands, opens browsers, scans code, hunts bugs, writes reports, and connects to Telegram. All from your keyboard.

Built from scratch in Go. No Python runtime needed for the core. 24MB binary, runs on Linux, macOS, and Windows.

Install

One command:

curl -fsSL https://raw.githubusercontent.com/hirotomasato/hiroto/main/install.sh | bash

That installs Hiroto, security tools, and 240+ skills automatically. Requires Go 1.26+, Node.js, Python 3, and Chrome.

Windows:

irm https://raw.githubusercontent.com/hirotomasato/hiroto/main/install.ps1 | iex

Or clone and build:

git clone https://github.com/hirotomasato/hiroto.git
cd hiroto
make install

Config lives in ~/.hiroto/config.yaml. API key goes in ~/.hiroto/.env.

Usage

hiroto                  # Interactive TUI
hiroto -q "who am i?"   # One-shot, prints answer
hiroto -c "prompt"      # Continue last session (one-shot)
hiroto --resume <id>    # Reopen a saved session in the TUI
hiroto gateway          # Telegram bot
hiroto --api            # OpenAI-compatible API server
hiroto --update         # Check for updates

TUI keyboard shortcuts

Key	What it does
`Enter`	Send message
`Ctrl+P`	Switch model
`Ctrl+R`	Resume old session
`Ctrl+L`	Clear screen
`Ctrl+S`	Force save session
`Ctrl+C`	Cancel / quit
`PgUp` `PgDn`	Scroll
`Home` `End`	Jump to top/bottom

Slash commands (31 commands)

Type / to open the scrollable command picker — arrow keys to navigate, Enter to select.

Session: /help /new /resume /compress /quit /branch /title

Model & config: /model /config /reasoning /verbose

Coding: /diff /review /explain /test /stop

Iteration: /retry /undo /steer

Tools & skills: /skills /memory /reload /usage

Productivity: /prompt /bg /goal /copy /image /todo

Update & rollback: /update /upgrade /rollback

Exit summary

Quitting (Ctrl+C or /quit) prints a resume recap — session id, title, duration, message counts — so you can pick the conversation back up from the shell:

Resume this session with:
  hiroto --resume 20260829_174120_39daaf
  hiroto -c "Fix the push error and protect main branch"

Session:        20260829_174120_39daaf
Title:          Fix the push error and protect main branch
Duration:       18m 24s
Messages:       81 (2 user, 77 tool calls)

Project context

When you open Hiroto in a project folder, it auto-detects context files (AGENTS.md, CLAUDE.md, .cursorrules, .hermes.md) and injects them into the system prompt. The agent follows your project conventions without being told.

The system prompt also includes your git working directory, skill index, memory, and any standing goal you've set.

OpenAI-compatible API server

hiroto --api

Opens http://localhost:20129/v1 — an OpenAI-compatible endpoint. Streaming + non-streaming, full tool access.

Use with VS Code (Continue, Cline, Cody), Aider, Open WebUI, LibreChat, or plain curl:

curl http://localhost:20129/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"tok/deepseek/deepseek-v4-pro","messages":[{"role":"user","content":"hello"}]}'

Port can be set in ~/.hiroto/config.yaml:

api:
  port: 20129

Endpoints: /v1/chat/completions, /v1/models, /health.

Telegram gateway

hiroto gateway

On first run, you're prompted for a Telegram bot token (from @BotFather). The token is stored in .env, never in config.yaml. The bot supports:

Per-chat isolated conversations (no context leakage)
Live text + tool activity streaming
Persistent sessions (survive restarts, resume via /resume)
Full command set: /model /resume /memory /skills /retry /undo /status /sessions

What it can do

Terminal & files: shell commands, read, write, edit, background processes, pipe chaining. LSP diagnostics auto-run after writes (go vet, py_compile, cargo check, tsc).

Browser: 9 tools — start, navigate, click, type, JS exec, screenshot, stop, fetch, DOM dump. Full Chrome headless session.

Code: execute_code (Python + tool RPC), execute_python. Scripts can call back into Hiroto's tools.

Safety: auto git checkpoint before write/patch/terminal. /rollback to undo. Dangerous command detection (rm -rf, git push --force, DROP, dd, chmod).

Security: scan secrets, 240+ skills (recon, exploit, reporting), merge reports.

Data: web search, extract page content, session search, vision (image analysis).

Automation: cron jobs, delegate to sub-agents, background prompt (/bg), standing goal (/goal).

Productivity: edit prompt in $EDITOR (/prompt), copy response to clipboard (/copy), attach images (/image), steer mid-run (/steer).

Built-in tools

Category	Tools
Shell	`terminal` `process` `smart_pipe`
Files	`read_file` `write_file` `patch` `search_files`
Web	`web_search` `web_extract` `web_fetch`
Browser	`browser_start` `browser_navigate` `browser_click` `browser_type` `browser_exec` `browser_screenshot_cdp` `browser_stop` `browser_fetch` `browser_screenshot`
Code	`execute_code` `execute_python`
Security	`secret_scan` `search_knowledge` `aggregate_reports`
Agent	`delegate_task` `cronjob` `clarify`
Memory	`memory` `todo`
Skills	`skill_view` `skill_manage`
Data	`session_search` `vision_analyze`

Skills

240+ skills included. Mention a skill name and the agent loads and runs it.

recon     → subfinder + dnsx + httpx
hunt-xss  → 174 XSS bug bounty patterns
hunt-sqli → SQL injection hunting
antislop  → anti-AI-slop output filter
...and 236+ more

Project layout

cmd/hiroto/          Entry point: TUI, one-shot, gateway, API server
internal/
  agent/             Agent loop, system prompt, compression, steer
  api/               OpenAI-compatible HTTP server
  llm/               OpenAI-compatible client (streaming + non-streaming)
  tools/             Tool implementations + registry + LSP + safety
  skills/            Skill discovery + parser
  memory/            Persistent memory (JSON)
  session/           Conversation persistence
  config/            YAML config + .env resolver
  web/               Web search + extract
  plugin/            Plugin loader + MCP client
  gateway/           Telegram bot
skills/              240+ bundled skills

Releases

go install github.com/hirotomasato/hiroto@latest — or install.sh. GitHub Releases are auto-created for every v* tag.

hiroto --update checks /releases/latest. Tags without a published Release are invisible to the updater.

Download: https://github.com/hirotomasato/hiroto/releases

Development

make build    # go build
make test     # go test ./...
make vet      # go vet ./...
make install  # install to ~/.local/bin

See CONTRIBUTING.md. Security reports: SECURITY.md. Changelog: CHANGELOG.md.

License

MIT — LICENSE

Built from scratch in Go. 24MB binary. 240+ skills. 26 tools. 31 slash commands. API server. Telegram gateway. No AI framework dependencies.

Navigation Menu

Repository files navigation

Hiroto

What is this

Install

Usage

TUI keyboard shortcuts

Slash commands (31 commands)

Exit summary

Project context

OpenAI-compatible API server

Telegram gateway

What it can do

Built-in tools

Skills

Project layout

Releases

Development

License

About

Releases

Packages

Contributors

Languages

Name		Name	Last commit message	Last commit date
.github		.github
assets		assets
cmd/hiroto		cmd/hiroto
internal		internal
skills		skills
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
SECURITY.md		SECURITY.md
go.mod		go.mod
go.sum		go.sum
install.ps1		install.ps1
install.sh		install.sh

Latest commit

History

Folders and files

Repository files navigation

Hiroto

What is this

Install

Usage

TUI keyboard shortcuts

Slash commands (31 commands)

Exit summary

Project context

OpenAI-compatible API server

Telegram gateway

What it can do

Built-in tools

Skills

Project layout

Releases

Development

License

About

Resources

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages