hydra

Seeds per-session canary tokens into WebFetch advisories and scans every subsequent tool input/output for the canary's appearance. Use when the developer wants prompt-injection detection telemetry, or asks "is my session compromised?". Auto-fires on PreToolUse(WebFetch) and PostToolUse(*). Do not use for in-prompt sanitization (see deep-research's <untrusted_source> wrapping).

Detects subagent capability escapes by comparing the tool being invoked against the skill's declared allowed-tools list. Use when the developer asks about subagent escape, sees a tool fired from an unexpected skill, or audits delegation.md compliance. Auto-fires on PreToolUse. Best-effort observability only — does not block.

OPT-IN BLOCKING capability allowlist. Pairs with hydra-capability-fence (advisory). When state/capability-policy.json sets enabled:true, this shield blocks any tool call whose name is not in the active SKILL.md frontmatter allowed-tools list. Use when the developer asks why a tool call was blocked, wants to enable or tune the capability allowlist, or reviews a stderr "capability-shield (BLOCKED)" message. Default disabled — out of the box this shield does nothing. Do not use for observability without enforcement (see capability-fence).

Logs every WebFetch / WebSearch / Bash-network destination to an append-only NDJSON and surfaces first-seen domains as advisory warnings. Use when the developer asks "what did this session reach out to?" or "show me egress", wants a per-session list of contacted hosts, asks about an egress-monitor advisory, or wants to inspect state/log.ndjson. Auto-fires on PostToolUse for network tools. Do not use for in-process state inspection (see audit-trail).

OPT-IN BLOCKING egress allowlist. Pairs with hydra-egress-monitor (advisory). When state/egress-policy.json sets enabled:true, this shield blocks any WebFetch / WebSearch / Bash-network call whose destination host is not in the operator-curated allowlist. Use when the developer asks why a network call was blocked, wants to inspect or edit the egress allowlist, or asks about audit.ndjson policy_blocked events. Default disabled — out of the box this shield does nothing. Do not use for observability without enforcement (see egress-monitor).

Scans the project's dep tree for license compatibility against an allow/deny policy. Use when the developer asks "what licenses are in here?" or before a release. Reports denied (GPL/AGPL/SSPL), warned (MPL/EPL/CDDL), and allowed (MIT/Apache/BSD/ISC) classifications. Do not use for license-text generation (see SBOM).

Helps the developer interpret package-gate advisory findings and decide whether to proceed with a package install. Use when the developer asks about a package-gate warning, supply-chain risk on a specific package, slopsquat / typosquat / maintainer-churn / download-cliff signals, or whether an `npm install` / `pip install` / `pnpm add` / `yarn add` / `uv add` target is safe. Auto-triggers on: "is X safe to install", "package-gate flagged", "typosquat", "slopsquat", "supply-chain risk", "should I install", "this package looks suspicious". Do not use for: post-install vulnerability scans (see vuln-detector), secrets in installed code (see secret-scanner), or actually blocking installs — package-gate is advisory only and the install was not blocked.

Use when the developer asks about defense-state integrity, signed state files, meta-canary scans, integrity-events.ndjson, HMAC drift, "did anyone tamper with my canaries / egress policy / capability policy / audit log", or pentest finding R-020 / F-PT-11/12/13/17. Auto-triggers on: "state integrity", "signed state", "meta canary", "integrity drift", "verify state", "tampered policy", "defense of defense".

Post-filters vuln-detector findings by call-graph reachability from an entrypoint, so operators triage exploitable vulns first and dead-code or vendored-library hits last. Use when the developer wants to triage a vuln-detector audit.jsonl, runs /hydra:reach, asks "which of these findings are actually reachable?", or references Snyk/CodeQL/Semgrep reachability as a reference baseline. Currently scaffolded; full integration is blocked on lich exporting a persisted call-graph artifact — in graph-absent mode, every finding is preserved with reachable=null. Do not use for raw vuln scanning (see vuln-detector) or for first-pass CWE classification (see audit-trail).

Streams audit-trail events to OTLP-compatible backends (Datadog LLM Observability, Sentry AI Agent Monitoring) with full span fields per closure F-021/F-024. Use when the developer asks "how do I send audit events to Datadog/Sentry?", sets up production observability, wires an OTLP collector, or asks about exporting tool/policy spans. Auto-triggers on: "send audit to datadog", "sentry ai monitoring", "otlp exporter", "audit observability", "ship audit events", "production observability for hydra", "F-021", "F-024".

Routes HIGH and CRITICAL audit-trail events to an operator-configured webhook (PagerDuty, Opsgenie, Slack, generic). Reads new rows from state/audit.jsonl since the last cursor and POSTs a generic event payload. Use when the developer asks about on-call paging, alert routing, webhook setup, audit-event escalation, or wants to verify F-011 closure. Auto-triggers on: "page on-call", "wire pager", "paging config", "alert routing", "F-011", "send HIGH events to", "configure webhook". Do not use for crafting the audit log itself (see audit-awareness) or for verifying chain integrity (see audit-verify).

Generates a CycloneDX SBOM (bom-npm.cdx.json or bom-pip.cdx.json) for the current repo by detecting npm or pip ecosystem and shelling out to the matching tool. Use when the developer asks for an SBOM, runs the release workflow, or needs to satisfy CISA SBOM / EU CRA requirements. Auto-fires on tag push via release.yml. Do not use for license compliance scanning (see license-gate).

Verifies the tamper-evidence hash chain on audit-trail's JSONL log. Use when the developer asks to verify audit integrity, check whether the audit log has been tampered with, validate the hash chain, or investigate suspected log manipulation. Auto-triggers on: "verify audit", "check audit integrity", "tamper check", "validate hash chain", "audit log tampered", "hash chain broken".

Use when the developer asks about audit logs, security events, session history, or wants to generate a security report. Auto-triggers on: "audit log", "security events", "what happened", "security report", "show audit", "event history", "compliance".

Use when the developer asks about secrets, credentials, API keys, or tokens found in their code, or wants to understand secret scanning results. Auto-triggers on: "found secrets", "are there secrets", "credential scan", "API key detected", "what secrets", "leaked keys", "scan for secrets".

Use when the developer asks about vulnerabilities, OWASP issues, CWE findings, or security weaknesses in their code. Auto-triggers on: "vulnerabilities", "OWASP", "CWE", "security issues", "SQL injection", "XSS", "is this code safe", "security scan".

Use when the developer asks about blocked commands, safety checks, why something was blocked, or wants to adjust strictness mode. Auto-triggers on: "blocked", "was that safe", "why blocked", "action guard", "dangerous command", "safety mode", "strictness".

Use when the developer asks about repository config safety, malicious config files, or session-start scan results. Auto-triggers on: "config scan", "repo safety", "malicious config", "CVE-2025-59536", "config poisoning", "session start scan", "config-check".