Kodachi Binaries

kodachi-dashboardUnified GUI control center

Modern desktop application providing a unified graphical interface for all Kodachi security services. It ships five cockpits: Circle and Lite Classic (free, control), ColonyOps (premium, control), and Vitals and SOC (premium, monitoring). Built for native performance and an elegant user experience. Features comprehensive control panels for authentication management (online-auth), network routing configuration (routing-switch with 14 protocols plus the External VPN Providers tab covering VPN Gate, Riseup, NordVPN, IVPN, PIA, Surfshark, AirVPN, Mullvad-WG, Windscribe, ProtonVPN, ExpressVPN, TorGuard), Tor network operations (tor-switch with 121 commands), DNS management (dns-switch), and system health monitoring (health-control). Provides real-time status displays, visual feedback for operations, and streamlined workflows for complex security tasks. Eliminates the need for multiple terminal windows by consolidating all binary operations into an intuitive dashboard interface. Supports dark and light themes, system tray integration, and keyboard shortcuts for power users. Ideal for users who prefer graphical interfaces while maintaining full access to all CLI capabilities.

Key features

• Centralized authentication: visual monitoring and management of online-auth service status and API key validation.
• Network protocol control: easy switching between VPN, WireGuard, Shadowsocks, V2Ray, Xray, Hysteria2, and Tor routing.
• Tor management: GUI access to 121 tor-switch commands including circuit rotation, exit node selection, and load balancing.
• DNS configuration: visual DNS server selection, DNSCrypt management, and real-time leak detection.
• System health dashboard: emergency kill switches, panic modes, integrity verification, and security scoring.
• Centralized notification center: one place for every alert (admin messages, SOC findings, command queue results, auto command runner, hardening and emergency alerts, updates, device status), reached from a bell in the sidebar. Per item you can mark read, dismiss, snooze, or play a sound if it recurs; a settings panel controls which severities are kept and per-category muting.
• Modern tech stack: a Rust backend for security with a native desktop runtime for a responsive, reactive UI.

Use cases

• Quick access to all security features without memorizing CLI commands.
• Visual monitoring of system security status and active connections.
• Rapid protocol switching for different anonymity requirements.
• Dashboard-style overview of all Kodachi services in one window.
• Ideal for users transitioning from GUI-based privacy tools.

ai-cmdAI-powered command interface

Natural language command-line interface for Kodachi OS with 9 named engine paths: TF-IDF, ONNX intent classifier, ONNX semantic, Mistral.rs, GenAI/Ollama, legacy local LLM, Claude CLI, Codex CLI, and OpenCode. Translates plain English queries into Kodachi commands with real-time streaming responses and native tool calling. The built-in TF-IDF engine provides immediate local matching, while Mistral.rs supports local GGUF inference. GenAI/Ollama can stay local or use a configured external provider; external-provider selections can transmit prompts and context even when their network route uses VPN or Tor.

ai-gatewayUnified agent command gateway

Machine-facing gateway for AI agents and automation. Provides unified command discovery (list, search, help), machine invocation metadata in search results, policy-enforced execution, per-agent capability controls, audit logging, rate limiting, and trusted batch execution. Supports JSON argument payloads (--args-json) and explicit approval semantics for dangerous commands, while keeping dry-run planning available for safe automation.

Validated integration points

• search --json exposes invocation (service, command) for deterministic agent calls.
• run --args-json accepts object payloads for shell-quote-safe invocation.
• dangerous commands require explicit confirmation for live execution.
• dangerous --dry-run remains available for planning.
• recognized agent profiles include: nullclaw, agentzero, openclaw, picoclaw, nanoclaw, claude-code, gpt, gemini, open-interpreter (unauthenticated callers fall back to the anonymous default identity).

ai-trainerML model training and validation

Machine learning model management tool for the KAICS system. Downloads pre-trained ONNX semantic models, trains intent classifiers from training data, performs incremental updates, validates model accuracy, and exports trained models for deployment. Essential for upgrading from Tier 1 (TF-IDF) to Tier 2 (ONNX semantic) accuracy. All training happens locally with no cloud dependency.

ai-learnerLearning orchestration and analysis

Continuous improvement engine for the KAICS AI system. Learns from accumulated user feedback and command usage patterns to improve intent classification accuracy over time. Supports incremental learning, period-based analysis, and report generation in markdown or JSON format. Can be scheduled via ai-scheduler for automated periodic learning cycles.

ai-adminDatabase management and diagnostics

Administrative tool for KAICS AI infrastructure. Provides full system diagnostics, database statistics and integrity checks, backup and restore operations, and performance tuning capabilities. Essential for maintaining AI system health and troubleshooting issues.

ai-discoveryBinary watcher and auto-indexer

inotify-based binary watcher daemon that automatically detects and indexes new or updated Kodachi binaries. Maintains a real-time service registry used by ai-cmd for command resolution. Supports hot-reload of the AI command index without requiring service restart. Essential for keeping the AI system aware of all available commands.

ai-schedulerCron-based task scheduler

Cron-based task scheduler for automated Kodachi operations. Uses a strict command whitelist for security, supports standard cron expressions, and provides persistent task storage that survives service restarts. Ideal for scheduling recurring security checks, Tor circuit rotations, DNS leak tests, and AI learning cycles.

ai-monitorProactive system monitoring daemon

Background monitoring daemon that continuously tracks VPN connections, Tor circuit health, DNS leak status, and system security scores. Runs checks every 30 seconds and generates actionable suggestions categorized by network, DNS, Tor, and security domains. Provides early warning of potential issues before they impact privacy or security.

online-authAuthentication and heartbeat monitoring

Provides authentication services for Kodachi OS through cryptographic API validation and secure session management. Handles service heartbeats for connection monitoring and manages API keys for authorized access. Implements privacy-preserving authentication protocols with encrypted credential storage and secure token rotation. Protects communication between local services and authentication endpoints with authenticated, encrypted transport; this does not by itself make the channel anonymous. Maintains session persistence across restarts while adhering to anti-forensic principles.

routing-switchMulti-protocol network routing

Comprehensive encrypted routing service with 14 scored protocols (WireGuard, OpenVPN, Tor, Xray VLESS, Xray VLESS-Reality, Hysteria2, Xray Trojan, V2Ray, Shadowsocks, Mita, Dante, plus xray-vmess as a legacy factory fallback, plus the two opt-in obfuscated transports AmneziaWG and OpenVPN over Cloak). auto-select ranks the plain protocols by default; AmneziaWG and OpenVPN over Cloak only enter the ranking with --prefer-obfuscated. It provides tunnel management, obfuscation options, and route layering. These controls change route topology but do not guarantee anonymity; latency, endpoint trust, and traffic-correlation risks remain.

tor-switchAdvanced Tor network orchestration

Manages Tor network connections and circuit isolation for Kodachi OS. Provides control over Tor instances, exit node selection, and circuit rotation. Features multi-instance Tor management, load balancing across circuits, DNS leak prevention, and traffic routing configuration. Supports transparent proxy setup, bridge configuration, and country-based exit node selection. Includes monitoring capabilities for circuit health and connection status.

ip-fetchSecure IP geolocation

Fetches IP geolocation data with multi-provider support and fallback mechanisms. Retrieves current IP address information including location, ISP, and connection details. Features automatic provider rotation when services are unavailable, response caching for efficiency, and verification through multiple sources. Supports both IPv4 and IPv6 addresses with JSON output format. Integrates with VPN and Tor connections to verify routing status.

online-info-switchInformation hub and RSS feeds

Information aggregation service providing RSS feed monitoring and data collection. Manages various information sources including security feeds, cryptocurrency data, and paste services. Features scheduled feed updates, content filtering, and data categorization. Supports multiple RSS sources with configurable refresh intervals. Provides structured output for collected information with timestamp tracking and source attribution.

conky-statusUnified Conky telemetry gateway

Rust telemetry gateway that unifies data collection for Kodachi Conky desktop panels. Replaces fragmented shell polling with a single snapshot cache and compatibility aliases, while preserving Conky-friendly outputs. Supports JSON, panel batching, key lookup, and refresh and TTL controls for stable desktop monitoring without script storms.

health-controlEmergency kill switches and panic modes

System health monitoring and emergency control service for Kodachi OS. Provides network connectivity checks, panic mode operations, and system state management. Features multiple emergency response levels (soft, medium, hard), network kill switches using iptables and nftables, secure data wiping capabilities, and MAC address randomization. Includes system scoring for security posture assessment, hardware monitoring, and USB device protection. Supports recovery operations for restoring network connectivity after emergency procedures.

dns-switchDNS management with 336 resolvers

DNS management service supporting multiple secure resolver configurations. Manages system DNS settings with support for 336 bundled resolvers including privacy-focused options. Features DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and DNSCrypt protocol support. Provides automatic resolver switching, fallback mechanisms, and Pi-hole integration. Includes DNS cache management and resolver health monitoring. Supports custom resolver configuration and automatic optimal server selection.

dns-leakDNS leak detection and prevention

DNS leak detection and prevention service for network privacy verification. Performs comprehensive leak tests across all network interfaces to identify DNS configuration issues. Features real-time leak detection, multi-provider verification, and automated alert generation. Monitors DNS queries to ensure they route through configured secure channels. Provides detailed reports on DNS resolver usage and potential privacy issues.

kodachi-socHost security monitoring

Host security monitoring service that powers the SOC cockpit. Collects host-security telemetry across file and critical-binary integrity, boot-autoload monitoring, rootkit and account-integrity checks, and CIS hardening posture, tagging findings with MITRE ATT&CK techniques. It is hardening-aware, so Kodachi's own protections never read as compromise. Exposes five commands: snapshot (collect all SOC telemetry), refresh (re-run the expensive background scans), watch (the service-owned always-on host exposure watcher), exposure (read host exposure findings, qualification and acknowledgement state) and policy (review, approve, revoke, list and explain host exposure policy). policy approve and policy revoke change stored policy, so it is not purely read-only.

kodachi-soc-notifierHost exposure session notifier

Bounded local user-session notifier for Kodachi host exposure findings. It consumes only the bounded local summary written by kodachi-soc watch and raises visual warning, critical, degraded, untrusted and unsupported alerts while the dashboard is closed. It exposes no subcommands of its own and is driven by the kodachi-soc-notifier.service user unit. It never scores or acknowledges a finding, so it can add no privilege of its own.

integrity-checkCryptographic system verification

System integrity verification service using cryptographic checksums and digital signatures. Validates file integrity through BLAKE3 hashing (SHA-256 as fallback) and signature verification. Features binary authentication, configuration file monitoring, and tamper detection. Provides scheduled integrity scans and on-demand verification. Maintains baseline checksums for critical system files and detects unauthorized modifications. Supports custom file lists and exclusion patterns for targeted verification.

permission-guardReal-time permission monitoring

File permission monitoring and enforcement service for system security. Monitors file system permissions and ownership to detect unauthorized changes. Features real-time permission tracking, automated correction of insecure permissions, and privilege escalation detection. Provides scheduled scans and on-demand verification of critical directories. Maintains permission baselines and reports deviations. Supports custom permission policies and automated remediation workflows.

logs-hookCentralized logging infrastructure

Provides centralized logging infrastructure with secure log collection, rotation, and deletion capabilities. Features encrypted log storage, automatic rotation schedules, and secure deletion protocols. Supports multiple log levels, filtering algorithms, and privacy-aware logging practices. Includes log aggregation from all system services and real-time monitoring. Offers multi-pass secure deletion and log anonymization for privacy protection.

deps-checkerDependency validation and auditing

Validates system dependencies and performs security auditing of installed packages. Features automated dependency scanning, version conflict detection, and security vulnerability identification. Provides package relationship analysis, compatibility verification, and installation script generation. Includes system configuration validation and dependency tree analysis. Maintains databases of tested configurations for optimal system security.

global-launcherSystem-wide binary deployment

Deploys Kodachi binaries system-wide while maintaining proper execution contexts and security validation. Features intelligent shortcut creation, environment variable management, and working directory preservation. Provides binary integrity verification and automated rollback capabilities. Includes security validation protocols and comprehensive deployment logging. Enables global accessibility without compromising security isolation.

workflow-managerBatch command execution and automation

Comprehensive workflow automation service for batch command execution with advanced conditional logic and state management. Features template-based workflow creation and a hybrid conditional system combining success and fail states with pattern matching and JSON path evaluation. Provides interactive pause controls for manual checkpoints, comprehensive telemetry logging in JSONL format, and configurable timeout protection. Supports concurrent execution within workflows, retry logic for failed operations, and dry-run mode for safe testing. Enables complex multi-step automation with regex pattern matching, substring searching, and JSON response evaluation for precise control flow. Ships with 122 ready-to-use built-in profiles stored in dashboard/hooks/config/profiles/, and users can create custom profiles for their specific automation requirements. Critical for system maintenance workflows, batch operations, and automated diagnostic procedures requiring conditional execution paths.

kodachi-session-helperGlobal emergency shortcut daemon

Global emergency keyboard shortcut daemon for Kodachi OS. It listens for the configured panic key combination so an emergency action can be triggered without opening the dashboard. Exposes three commands: daemon (run in the foreground until signalled), status (query the running daemon over its Unix socket) and reload (send SIGHUP to reload its configuration). None of the three requires sudo.