Trickest CLI v2.0: Simplified Workflow Execution and Observability

It’s now easier to run workflows, share them, and turn them into production-ready processes that feel intuitive and are easy to monitor.

Trickest CLI v2.0 is here. It was shaped by your feedback, real-world challenges, and everything we’ve learned along the way. It’s a big step forward in our mission to help security teams hit that sweet spot between reliable-but-rigid enterprise solutions and flexible-but-messy in-house setups.

Let’s take a look at what’s new and why it matters.

Built-In Help for Every Workflow

There was always this quiet gap between workflow creators and workflow users, even when they were the same person coming back a few weeks later.

When you’re in the zone building a workflow, everything’s clear: which inputs matter, how many machines to use, and where the useful outputs land. But fast forward a few weeks—or hand off the workflow to someone else—and suddenly it’s not so clear.

“I know this can help me… but I have no idea how to run it.”

– Your colleague (or future you), probably

That’s the flip side of using a platform that lets you do anything. If you’re not intentional about the UX, it slips. We heard that a lot. So we made it better.

Run:

trickest help --url "<https://trickest.io/editor/>..."

You’ll get an example command, along with details on inputs, outputs, recommended machine counts, and the author's notes.

If you’re the author, just drop your tips in the workflow README. Everything else gets generated automatically.

User-Friendly Input Names

Workflow inputs used to be tightly coupled to node IDs and parameter names. This makes sense while you’re building the workflow. It may feel cryptic later on, though. You’d have to dig through the workflow to figure out what inputs you need and how to reference them.

So we added input aliases.

You can define clear, readable names for your workflow inputs right in the editor. Those aliases show up in the trickest help output, and you can use them when executing the workflow.

What used to look like this:

cat config.yaml
inputs:
  enum-subdomains-1.domain: example.com

trickest execute --config config.yaml

Now looks like this:

trickest execute --input "domain=example.com"

One more step toward workflows that offer the simplicity of a command-line tool. And all without sacrificing the power under the hood.

Time-Specific Workflow Insights

Offensive security workflows can be inherently dangerous.

Let’s say a workflow triggers an alert on an asset at 1:15 PM, but the workflow was running both before and after that alert. You need to know exactly what was happening during that specific time around the alert—what jobs were running, for how long, and from which IP addresses.

Now you can run:

trickest investigate --from 13:00 --to 13:30 --url "<https://trickest.io/editor/>..."

You’ll get a breakdown of active sub-jobs (including distributed node iterations), how long they ran, and the IP addresses they used during that time window.

Task Group Analysis

For workflows that have distributed nodes, you can now run trickest get --analyze-task-groups to get stats on how they performed and if anything is lagging.

You’ll get a breakdown of:

• How many tasks were created
• What percentage succeeded or failed
• Duration stats: min, max, median
• Any major outliers from the median

NODE                                                                          STATUS     DURATION 
⛔ custom-script (custom-script-1)                                            stopped    15m 50s 
├── Task Group Info
│   ├── 3 tasks
│   │   ├── 2 succeeded (66.67%)
│   │   └── 1 stopped (33.33%)
│   └── Task Duration Stats
│       ├── Max: 15m 44s (task 3)
│       ├── Min: 6s (task 2)
│       ├── Median: 6s
│       │   └── Median Absolute Deviation: 1s
│       └── Outliers
│           └── Task 3: 15m 38s slower than median (duration: 15m 44s)

Average Duration and Run Insights

The same trickest get output now also gives you average duration stats across previous runs, so you know roughly what to expect. Plus, it summarizes how many sub-jobs ended up with each status.

Name:              My Workflow
Status:            RUNNING
Machines:          25
Fleet:             Managed fleet

Created:           Wed, 11 Apr 2025 13:32:33 EET (2h 30m ago)
Started:           Wed, 11 Apr 2025 13:32:34 EET (2h 29m ago)

Duration:          2h 29m
Average Duration:  2h 50m

Total Jobs:        10
Succeeded:         8/10 (80.00%)
Running:           2/10 (20.00%)

And if you’re automating all this (first of all, kudos), you’ll be happy to know the JSON output now includes everything: task group analysis, average duration, sub-job info, etc.

Time to Let Your Workflows Shine

Now is the time to update your CLI and try the new features. We’d love to hear what you think, and what you’d like to see next. You can find the release and full change log here.

If you’ve got workflows you’ve been perfecting, this is your moment. Share them with your team and other teams that might benefit from your expertise. Your workflows are easier to use, easier to trust, and easier to hand off.