enchanter-ai/hydra

Pre-execution classification and blocking of dangerous Bash commands.

Comprehensive security event logging with rotation and reporting. Includes audit-verify skill for HMAC hash-chain tamper-evidence inspection.

Prompt-injection canary harness. Seeds per-session high-entropy tokens into WebFetch advisories; PostToolUse scan flags canary leakage in subsequent tool inputs/outputs as evidence of indirect injection.

Best-effort subagent-escape detection. PreToolUse hook compares the invoked tool against the active skill's allowed-tools frontmatter; logs out-of-lane invocations. Observability only — runtime sandboxing requires harness/SDK work.

Opt-in PreToolUse blocking capability allowlist. Sibling of capability-fence (advisory). When state/capability-policy.json sets enabled:true, blocks any tool call whose name is not in the active skill's declared allowed-tools frontmatter list. Default disabled. Closes F-010.

Session-start scanning for malicious repository configuration files.

PostToolUse advisory hook logging every WebFetch/WebSearch/Bash-network destination to append-only NDJSON. First-seen domains surface as stderr advisories.

Opt-in PreToolUse blocking egress allowlist. Sibling of egress-monitor (advisory). When state/egress-policy.json sets enabled:true, blocks WebFetch/WebSearch/Bash-network calls whose destination host is not in the allowlist. Default disabled. Closes F-005.

Meta-plugin. One install pulls in all 15 Hydra plugins via dependency resolution.

License compliance scanner over npm + pip dep trees against an allow/deny SPDX policy. Flags GPL/AGPL/SSPL as denied, MPL/EPL/CDDL as warned, MIT/Apache/BSD/ISC as allowed. CI-mode supports --fail-on-deny. Skill-invoked + release-workflow gate.

PreToolUse advisory hook on npm/pip/uv/cargo/go/gem install. Five risk signals: existence, age, maintainer churn, typosquat (Levenshtein), download cliff. 24h URL-hash cache. Closes the supply-chain pre-install gap.

Reachability-aware SCA post-filter. Consumes vuln-detector audit.jsonl + lich call-graph (when available) and emits a reach-classified subset distinguishing reachable vulnerabilities from present-but-unreachable. Operator-invoked. Closes F-039.

Generates CycloneDX SBOM (bom-npm.cdx.json / bom-pip.cdx.json) by detecting npm or pip ecosystem and shelling out to the matching tool. Wired into release.yml. Closes CISA SBOM / EU CRA 2027 procurement gap. Skill-invoked + release-workflow.

Real-time secret detection in written files. 200+ patterns, Shannon entropy, Aho-Corasick matching.

Defense-of-defense layer. Signs and verifies Hydra's own defense-state files (active-canaries.json, egress-policy.json, capability-policy.json, rate-policy.json, hooks.json) so adversarial corruption can't silently disable a guard. Closes R-020 (F-PT-11/12/13/17).

OWASP Top 10 and CWE-mapped vulnerability detection in code changes. SCOPE TRUTH: a single-line regex prefilter, not a dataflow engine - it cannot follow taint across lines or functions, and several rules are shape-bound to HTTP handlers. Emits COVERAGE alongside findings, so an empty result reports whether the code was actually analysed rather than implying it is clean.