Every useful function in security software is buried inside a larger project. SecStreet extracts the useful parts into standard capabilities you can find, verify, install, and chain together.
Search by what a capability does, not by repository name. Every install is hashed. Every run is audited. Every output has a defined shape that other capabilities can consume.
Type "parse auth log" and get back the capabilities that do it, ranked by how well their output matches your next step's input.
Every capability is hashed the moment it lands in your project. Higher trust tiers require an ed25519 signature from a key you trust.
Output of one capability feeds the input of the next. When the shapes don't match, an adapter is inserted automatically.
Defensive tools are blue. Offensive tools are red. Neutral and dual-use tools are purple. You always know what you're looking at.
Every capability declares what it needs. Every tier permits a specific set of permissions. The runtime refuses to execute anything that exceeds its tier before a single process starts.
No special permissions. General purpose utilities and parsers.
Filesystem read, environment read, subprocess execution.
Adds filesystem write and network. Requires a trusted signature.
Every permission. Signed. For advanced authorized work.
Install the CLI. It works on any Linux or Mac. Nothing leaves your machine — capabilities run in a subprocess, under your policy, and every run goes into a local audit log you own.
The IDE is coming. Right now the workflow is: search on the web, install with the CLI, compose with JSON files. Clean and scriptable.
# install once $ npm i -g @secstreet/sdk # create a project $ secstreet init my-project # search the library $ secstreet search elf # install a capability $ secstreet add elf-header # run it $ secstreet run elf-header --input '{"path":"/bin/ls"}'
SecStreet is being built in layers. Each piece is designed to stand on the one before it, not to ship half-finished features.
Search, filter, inspect, install. 21 real capabilities from real tools, all verifiable.
Sign in with GitHub. Save capabilities to your profile. Bookmark, comment, and share.
A full browser IDE with the library docked to the side. Edit, run, compose, all in one place.
Ephemeral environments for testing capabilities safely. Real targets, isolated, disposable. Preview →
Publish research, projects, and writeups. Build reputation from the work you actually ship. Preview →
Organizations publish private capabilities. Developers maintain public ones. Everyone benefits.