Everything the model can reach before it answers.

Searches the public web and returns titles, URLs and page excerpts. Results from NVD, cve.org, CISA, GitHub, Seclists, PortSwigger and OWASP rank first. Use it for vendor advisories, PoC writeups and anything newer than the model.

Limit: Up to 10 results per call, cached for 15 minutes. Results can be wrong or out of date, so open the citation before you rely on it.

Fetches one public page as text: the disclosure, the patch notes, the program policy. Requests leave through a guarded egress that checks every address and redirect and pins the connection to the checked IP.

Limit: Public http(s) on ports 80 and 443, HTML, text, JSON or XML, 10 MB and 15 seconds. It honors robots.txt. In the chat it opens only URLs you typed or that a search, CVE, advisory or knowledge-base result returned, so links inside a page and .onion results stay closed.

Queries several Tor search indexes at once and returns the .onion title, URL and snippet, with the index each entry came from. Use it to find a ransomware group's leak site or a forum the public web does not list, then decide what to open yourself.

Limit: It opens only when you ask: your message has to say dark web, deep web, .onion or Tor, and naming a ransomware group is not enough. The harness never opens, crawls or downloads a listed page, so each entry is unverified and possibly hostile. Five searches a minute per user. Queries for child abuse material are refused and matching results are dropped.

One CVE consolidated: NVD description, CVSS 3.1 or 4.0 score and vector, CWE, affected CPEs with fix versions where NVD has them, references, EPSS score and percentile, CISA KEV status with date added and known ransomware use.

Limit: As current as the mirror, and each record shows when it was retrieved. An ID the mirror does not have is fetched from the sources once.

Filters by text, vendor, KEV status, minimum CVSS and minimum EPSS, then ranks by text match and EPSS. Feed it the products from a scan and see what is being exploited first.

Limit: Up to 20 hits per call. It goes to NVD by keyword only when the mirror finds nothing.

Known vulnerabilities for a package and version in any OSV ecosystem. Attach a lockfile and ask which pinned dependency is affected.

Limit: It reports what OSV lists for that name and version. Whether the vulnerable code is reachable in your build is still yours to prove.

OWASP WSTG, Cheat Sheets, ASVS, API Top 10, MASTG and MASVS. PayloadsAllTheThings, GTFOBins and LOLBAS. MITRE ATT&CK, CWE and CAPEC. Docs for Caido, Burp BChecks and Bambdas, nmap NSE, sqlmap and ffuf. NIST CSF and CISA advisories. Filter by domain, source or tool, then open the full document section by section.

Limit: Sources go in only when their licence allows it, and each hit carries that licence and its attribution. A niche technique may not be there; web search is the next step.

ELF, PE, Mach-O and DEX give SHA-256, entropy and strings. ELF and PE add format, entry point, sections and imported functions. High entropy and odd imports show up before you open a disassembler.

Limit: The disassembly is a preview: the first 4 KB of the file decoded as x86-64, at most 200 instructions. There is no decompiler and no control-flow graph, so keep yours open.

zip, tar, gzip, bzip2, xz, JAR and APK are walked entry by entry, and each entry goes through the same parsers. Encrypted entries and symlinks are flagged and skipped.

Limit: Depth 3, 10,000 entries, 2 GB expanded and a 100:1 ratio. A zip bomb stops with the reason.

Source, logs, JSON, minified bundles, PDF, Office files, HTML, XML and SVG arrive as text with a file and line locator. Word search runs across every attached file. AWS keys, GitHub tokens, Slack tokens and private keys raise a warning. Pickles are disassembled and never loaded.

Limit: 200 MB per file in the chat and 5 million characters of text. Images give dimensions only, with no OCR.

Reads, searches and edits your project and runs commands locally. By default it asks before every write and every command, showing the diff, and plan mode only reads. Reading outside the project asks first, opening a credential file needs the name typed back, and after a private read each outgoing query is shown to you before it leaves.

Limit: yolo asks only about credential files. It needs --yolo on every start and is off during an engagement.

notholy engage init writes the scope, exclusions, time window and authorization reference to your machine. While one is active the agent reads the targets out of each command before bash runs it, makes you type the host to go out of scope, and appends every decision to a hash-chained log. notholy connect claude installs the same check as a hook.

Limit: It reads the shell text and does not resolve DNS, so it catches operator mistakes and is no sandbox. A target known only at run time gets a warning for you to check.

Citations open beside the answer with the URL or the file locator, tagged as observed in a file, external source, knowledge base or dark web index.

Limit: A citation shows where a claim came from. Whether the source is right is still your call.

Each call shows its target and duration as it happens. The run lives on the server, so a reloaded page picks up the stream where it was.

Limit: 12 model steps, 5 tool calls at a time, 60 seconds per tool and 10 minutes per run.

Group chats by engagement. Instructions and scope notes are added to every run in the project.

Limit: Notes guide the model and do not grant authorization.