hydrasight 4.1.1

██╗  ██╗██╗   ██╗██████╗ ██████╗  █████╗ ███████╗██╗ ██████╗ ██╗  ██╗████████╗
██║  ██║╚██╗ ██╔╝██╔══██╗██╔══██╗██╔══██╗██╔════╝██║██╔════╝ ██║  ██║╚══██╔══╝
███████║ ╚████╔╝ ██║  ██║██████╔╝███████║███████╗██║██║  ███╗███████║   ██║
██╔══██║  ╚██╔╝  ██║  ██║██╔══██╗██╔══██║╚════██║██║██║   ██║██╔══██║   ██║
██║  ██║   ██║   ██████╔╝██║  ██║██║  ██║███████║██║╚██████╔╝██║  ██║   ██║
╚═╝  ╚═╝   ╚═╝   ╚═════╝ ╚═╝  ╚═╝╚══════╝╚═╝ ╚═════╝ ╚═╝  ╚═╝   ╚═╝

⚠️ Authorized use only. HydraSight is built for systems you own or test under explicit written permission. Unauthorized security testing is illegal and unethical. The maintainers accept no responsibility for misuse. The tool's safety architecture enforces authorization at runtime — but the attestation is an integrity gate, not a legality gate: you are responsible for what you attest.

What this is

HydraSight is a local, stateful operator console that sits between a privately-running LLM (via Ollama) and real security tools on a Kali Linux host (via the kali-linux-mcp REST bridge). It translates operator intent into proposed tool invocations, runs every proposal through a hard security gauntlet, executes only what passes, and writes an immutable record of the whole session.

It is not a chatbot, not a cloud service, and not an autonomous agent. The model plans; the gates decide; you confirm.

Where it differs from the rest of the field

How it works

flowchart LR
    OP["Operator input"] --> RT{"CommandRouter"}
    RT -- "bare chat" --> CHAT["ChatAIClient — no tool access, dispatch forbidden"]
    RT -- "builtin / /run / NL intent" --> PLAN["IntentClassifier → ActionPlanner → PendingAction"]
    PLAN --> POL["ExecutionPolicy — confirm / auto / never"]
    POL --> DISP{"Dispatcher: the single enforcement chokepoint"}
    DISP -- "attested scope ∩ ROE ∧ sanitized" --> KALI["Kali bridge → nmap, enum4linux, gobuster, hydra, msfconsole, john …"]
    DISP -- "any gate fails" --> BLOCK["Blocked + logged"]
    KALI --> FIND["Parsers → findings state → JSON / PDF report"]
    DISP -. "every allow/block decision" .-> AUD[("hydrasight_audit.jsonl — hash-chained, secret-redacted")]

Three properties are architectural, not aspirational:

1. Deny by default. No command reaches a target until an operator attests authorization for an explicit IP/CIDR scope — interactively (authorize 10.10.10.0/24 → type I AUTHORIZE) or via a pre-signed file for CI/CTF runs. No attestation, no execution — in every code path, including the engine's.
2. One chokepoint. ROE rules and the attested scope are enforced in a single place (Dispatcher.dispatch); neither can widen the other, and the AI has no route around it — routing decisions are pure regex, never LLM output.
3. Provable afterwards. Every proposal, approval, block, and outcome is appended to a SHA-256 hash-chained JSONL log with automatic credential redaction. Log integrity is verifiable at any time (AuditLogger.verify()), including detection of deleted lines.

Quick start

Requirements

Install & configure

pip install hydrasight

cp hydrasight.json.example hydrasight.json   # point kali_api_url at your bridge

ollama pull qcwind/qwen3-8b-instruct-Q4-K-M:latest   # or set "model" in hydrasight.json

Run your first engagement

hydrasight                    # or: python -m hydrasight

hydrasight › authorize 10.129.74.0/24          ── type "I AUTHORIZE" at the prompt
hydrasight › enumerate smb shares on 10.129.74.47

  Proposing   enum4linux -a 10.129.74.47 2>&1 | head -n 150
  Confirm? [y/N]  y
  ✔ Found 3 shares: IPC$, ADMIN$, Data

Chat is always safe: any question (what is smb signing?) never dispatches — a fake-execution guard rejects LLM role-play like “I will begin scanning.” Full walkthrough: Getting started.

The safety & accountability model

Five independent layers — any one of them can stop a command; the LLM can be wrong four times in a row and still hit a wall:

Execution modes: confirm (default — every action prompted) · auto (self-executes only at model confidence ≥ 80%) · never (explain-and-suggest only — the demo/supervisor mode).

The toolbelt covers recon → exploitation → post-access → credential work (nmap, enum4linux, smbclient, gobuster, nikto, whatweb, hydra, msfconsole RC, john, and the metasploit post-access handlers for SSH/FTP/web admin), each defined as a typed action in the registry. Complete list and how to add tools: Tools · Extending.

Documentation

Quality bar

CI enforces, on every push and pull request:

Local equivalent: make install && make lint typecheck test — see Makefile.

Versioning & releases

Semantic Versioning; the release flow and its guarantees are documented in RELEASING.md. Every published artifact is reproducible from the tagged commit, and CHANGELOG.md follows Keep a Changelog.

Security & responsible disclosure

Found a vulnerability in HydraSight itself (bypass of the sanitizer, scope or audit layer)? Please report privately per SECURITY.md — the safety architecture is the product, so these reports are treated with the highest priority. Contributions are welcome: CONTRIBUTING.md.

Acknowledgments

Built on Ollama, Rich, ReportLab, and the kali-linux-mcp bridge — and shaped by the HTB/CTF community's workflow.

License

MIT © 2026 Shyamprasanth04.