Thor gives your Ruby scripts a usage banner and stops there
Thor is a toolkit for building powerful command-line interfaces.
At a glance
- What is it?
- A Ruby gem for self-documenting command line utilities with Rake-like syntax, published under the rails organization. Installation is one command, the README holds no Ruby at all and sends usage questions to the wiki, and the gem states it should not receive application user input.
- Who is it for?
- Thor fits a team that writes its own internal scripts and wants option parsing plus a usage banner without hand rolling them, and it fits anywhere the arguments come from people who already have shell access. It does not fit an endpoint where a stranger picks the values, because the gem itself warns that its open-uri dependency turns user input into a command injection path.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 131 days ago.
- What is it written in?
- Mainly Ruby, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on November 13, 2026, and from our analysis. They are not legal advice.
Star history
- rails/thor5,263 ★ · -4
| Repository | 2026-09-23 | 2026-11-13 |
|---|---|---|
| rails/thor | 5.3k | 5.3k |
-4 Stars in the last 51 days, measured from the daily GitHub snapshot. Compare with other projects
Editorial analysis
The open-uri warning tells you where Thor is allowed to run
Thor leads with a security note, and that note is the clearest statement of scope in the whole document. The README says that Thor, by design, is a system tool created to allow seamless file and url access, and that it should not receive application user input. The reason given is the dependency on open-uri: combined with application user input, that combination would provide a command injection attack vector. So the boundary is not a style preference but a placement rule. Thor belongs on a developer machine, in a CI script, on a deploy host, or behind an admin task whose arguments your own code wrote. It does not belong behind a web form, a chat command, or any endpoint where the values come from someone who does not already have a shell on the box.
Rake-like syntax, and Rake named as the thing it can replace
The gem describes itself as a simple and efficient tool for building self-documenting command line utilities, and its stated job is removing the pain of parsing command line options and writing USAGE banners. It also positions itself as an alternative to the Rake build tool, and says the syntax is Rake-like so it should feel familiar to most Rake users. That is the whole pitch in four sentences: you describe your commands, Thor derives the interface and the usage text. It ships on RubyGems as thor, and installation is a single command with no version pin and no bundler snippet:
gem install thorNo Gemfile line appears in the README, and no lockfile guidance appears either, so bundler users are left to add the gem the way their own project already declares dependencies.
The README has no Ruby in it, so the wiki carries the tutorial
Judged by what a newcomer can copy, the README is close to bare. It contains no code fences at all, no Ruby snippet, no example class, no option list, and no sample output. What it points to instead is the project wiki at https://github.com/rails/thor/wiki for basic usage and other documentation on using Thor. That wiki lives outside the repository, so the file listing gives you no way to read it offline, and no wiki revision is tied to a gem version. If you are weighing the gem for a build pipeline, read the wiki before you decide, and expect to confirm behavior against the installed gem's own output.
Thorfile, spec/ and a rubocop config share the repository root
The top level is small and shows how the gem is developed and checked. It holds a Thorfile, plus thor.gemspec and a Gemfile for the gem's own dependencies. A spec/ directory sits next to an .rspec file, and a .rubocop.yml covers Ruby style. Code lives in lib/ with executables in bin/, automation in .github/, and a .devcontainer/ directory for container based work. A documentation file named .document is present at the root, and its contents are not part of the listing. Contributions go through CONTRIBUTING.md, and the license is MIT in LICENSE.md. That is the entire visible shape of a library that lands in other people's toolchains: no examples directory, no documentation directory, and no changelog at the root to tell you what moved between versions.
v1.5.0 in January 2026, with an uneven gap before it
The release history is recent but spaced out. The newest tag is v1.5.0, dated 2026-01-06. Before it came v1.4.0 on 2025-07-18, a gap of roughly six months, and before that v1.3.2 on 2024-08-29, a gap of close to eleven months. The last push to the default branch, main, was on 2026-07-06, so commits have landed since v1.5.0 without a new tag going out. Spacing like that means a Gemfile.lock can sit on a version well behind the tip of the branch, and the branch is the only place where the most recent work is visible. Pin the version you test, and decide deliberately whether you follow tags or the branch.
No options list, no exit codes, no notes on moving between tags
Several things a reviewer normally reaches for are absent. The README does not document which options Thor derives from a method signature, nor how a name clash between an inherited task and your own is resolved. It does not document exit codes or what a failing task hands back to a shell. It does not document how to move back to an earlier version, and there is no changelog at the repository root to explain what changed between v1.3.2, v1.4.0, and v1.5.0. The wiki link is the single pointer for all of it, and CONTRIBUTING.md is where suggestions go. The consequence for a team whose scripts other people run in CI is that confirming a behavior means reading the installed gem under lib/ or the wiki, which is worth budgeting for rather than assuming four paragraphs of README cover it.
A rails organization gem that is not the Rails command line
The repository lives under the rails organization, but the gem is not the Rails command line. The README describes no project scaffolding, no generators, and no rails command of any kind; what it describes is a library you embed in your own Ruby program, plus a task runner whose syntax borrows from Rake. The project description calls Thor a toolkit for building command line interfaces, and the README says it can serve as an alternative to the Rake build tool. So if you arrived expecting something to replace a Rails console, that expectation belongs to a different tool. If you arrived wanting your own scripts to carry a usage banner and parse options, this is the gem, and the README is the whole pitch you get before the wiki.
Editorial conclusion
Thor fits a team that writes its own internal scripts and wants option parsing plus a usage banner without hand rolling them, and it fits anywhere the arguments come from people who already have shell access. It does not fit an endpoint where a stranger picks the values, because the gem itself warns that its open-uri dependency turns user input into a command injection path. Before adopting it, read the wiki, since the README carries no Ruby, no option list, and no version notes, then pin a tag: the newest is v1.5.0 from 2026-01-06 while the branch has moved since.
Frequently asked questions
What is a Thor tool?
Thor is a Ruby gem for building self-documenting command line utilities. It removes the work of parsing command line options and writing USAGE banners, uses Rake-like syntax, and can also be used as an alternative to the Rake build tool.
What is Thor software, in the rails repository?
It is the thor gem on RubyGems, MIT licensed and published from the rails organization. The README describes it as a system tool for file and url access through open-uri, which is why it says Thor should not receive application user input.
Where are the Thor usage examples after I install the gem?
The README sends you to the project wiki at https://github.com/rails/thor/wiki for basic usage and other documentation. It contains no Ruby code fences of its own, so the wiki is where the examples are.
Why does Thor warn about user input on the command line?
The README states that Thor relies on open-uri for file and url access, and that combining it with application user input would provide a command injection attack vector. Thor is meant for system use rather than for values typed in by end users.
Official sources
Add this badge to your README
If you maintain this project, the badge below links readers to this analysis and shows its maintenance status from the daily GitHub snapshot. Paste the markdown into your README; add ?metric=license or ?metric=stars to the image URL for a different field.
[](https://hysenlabs.com/projects/rails-thor)Star history chart for your README
[](https://hysenlabs.com/projects/rails-thor)Was this useful?