| --- |
| license: other |
| pipeline_tag: text-classification |
| tags: |
| - shell |
| - bash |
| - cybersecurity |
| - safety |
| - classifier |
| --- |
| |
| # Kestrel |
|
|
| Kestrel is a compact local classifier for context-free cyber and system risk in |
| individual Bash tool calls. |
|
|
| ## Release |
|
|
| Version 0.1.0 publishes the portable JSON model artifact used for the Kestrel |
| evaluation. This repository does not include training code, training data, or a |
| detailed training recipe. |
|
|
| | File | Description | |
| |---|---| |
| | `classifier.json` | Portable Kestrel v0.1.0 model artifact | |
| | `SHA256SUMS` | Integrity checksum for the release artifact | |
|
|
| The model is custom and is not a Transformers checkpoint. Download the artifact |
| with `huggingface_hub`: |
|
|
| ```python |
| from huggingface_hub import hf_hub_download |
| |
| model_path = hf_hub_download( |
| repo_id="kontext-security/Kestrel", |
| filename="classifier.json", |
| ) |
| ``` |
|
|
| ## Evaluation |
|
|
| On the published ShellRisk-Bench v0.1 test split, Kestrel reaches 0.947 |
| precision, 0.922 recall, and 0.934 F1. The test split is a same-source, |
| in-distribution holdout; it is not evidence of transfer to a novel command |
| dialect. |
|
|
| See [ShellRisk-Bench](https://github.com/kontext-security/shellrisk-bench) for |
| the fixed split, evaluation methodology, prompts, scorer, aggregate results, |
| and per-example Kestrel verdicts. The dataset is available at |
| [kontext-security/ShellRisk-Bench](https://huggingface.co/datasets/kontext-security/ShellRisk-Bench). |
|
|
| ## Scope and limitations |
|
|
| Kestrel evaluates one submitted Bash command without user, task, or session |
| context. It does not infer intent or make a complete authorization decision. |
| It is intended as one signal layered underneath deterministic protections and |
| runtime authorization policy, not as the sole control for executing commands. |
|
|
| ## Try it |
|
|
| Kestrel is available as part of Kontext, where it evaluates the cyber risk of |
| agent tool calls locally. Learn more and try it at |
| [kontext.security](https://kontext.security). |
|
|
| ## Integrity |
|
|
| ```text |
| SHA-256 1df8b3e5f2bfc4e1fe95230ee9b3d37f63aaa461a8551982fcc0dd7103c8221b classifier.json |
| ``` |
|
|
| ## License |
|
|
| The artifact is published with `license: other`. The public benchmark sources |
| retain their own upstream terms; review the |
| [dataset provenance](https://github.com/kontext-security/shellrisk-bench/blob/main/DATASETS.md) |
| before reuse or redistribution. |
|
|
