---
license: other
pipeline_tag: text-classification
tags:
- shell
- bash
- cybersecurity
- safety
- classifier
---

# Kestrel

Kestrel is a compact local classifier for context-free cyber and system risk in
individual Bash tool calls.

## Release

Version 0.1.0 publishes the portable JSON model artifact used for the Kestrel
evaluation. This repository does not include training code, training data, or a
detailed training recipe.

| File | Description |
|---|---|
| `classifier.json` | Portable Kestrel v0.1.0 model artifact |
| `SHA256SUMS` | Integrity checksum for the release artifact |

The model is custom and is not a Transformers checkpoint. Download the artifact
with `huggingface_hub`:

```python
from huggingface_hub import hf_hub_download

model_path = hf_hub_download(
    repo_id="kontext-security/Kestrel",
    filename="classifier.json",
)
```

## Evaluation

On the published ShellRisk-Bench v0.1 test split, Kestrel reaches 0.947
precision, 0.922 recall, and 0.934 F1. The test split is a same-source,
in-distribution holdout; it is not evidence of transfer to a novel command
dialect.

See [ShellRisk-Bench](https://github.com/kontext-security/shellrisk-bench) for
the fixed split, evaluation methodology, prompts, scorer, aggregate results,
and per-example Kestrel verdicts. The dataset is available at
[kontext-security/ShellRisk-Bench](https://huggingface.co/datasets/kontext-security/ShellRisk-Bench).

## Scope and limitations

Kestrel evaluates one submitted Bash command without user, task, or session
context. It does not infer intent or make a complete authorization decision.
It is intended as one signal layered underneath deterministic protections and
runtime authorization policy, not as the sole control for executing commands.

## Try it

Kestrel is available as part of Kontext, where it evaluates the cyber risk of
agent tool calls locally. Learn more and try it at
[kontext.security](https://kontext.security).

## Integrity

```text
SHA-256  1df8b3e5f2bfc4e1fe95230ee9b3d37f63aaa461a8551982fcc0dd7103c8221b  classifier.json
```

## License

The artifact is published with `license: other`. The public benchmark sources
retain their own upstream terms; review the
[dataset provenance](https://github.com/kontext-security/shellrisk-bench/blob/main/DATASETS.md)
before reuse or redistribution.