Kestrel is a compact local classifier for context-free cyber and system risk in individual Bash tool calls.

Version 0.1.0 publishes the portable JSON model artifact used for the Kestrel evaluation. This repository does not include training code, training data, or a detailed training recipe.

The model is custom and is not a Transformers checkpoint. Download the artifact with huggingface_hub:

On the published ShellRisk-Bench v0.1 test split, Kestrel reaches 0.947 precision, 0.922 recall, and 0.934 F1. The test split is a same-source, in-distribution holdout; it is not evidence of transfer to a novel command dialect.

See ShellRisk-Bench for the fixed split, evaluation methodology, prompts, scorer, aggregate results, and per-example Kestrel verdicts. The dataset is available at kontext-security/ShellRisk-Bench.

Kestrel evaluates one submitted Bash command without user, task, or session context. It does not infer intent or make a complete authorization decision. It is intended as one signal layered underneath deterministic protections and runtime authorization policy, not as the sole control for executing commands.

Kestrel is available as part of Kontext, where it evaluates the cyber risk of agent tool calls locally. Learn more and try it at kontext.security.

The artifact is published with license: other. The public benchmark sources retain their own upstream terms; review the dataset provenance before reuse or redistribution.