{"id":"841f2458-aff3-4b0c-b614-b8f6cdce903e","slug":"script-kitty","kind":"mcp","name":"Script-kitty","summary":"Your Patch Cat","owner":"andrecodexvictor","repoUrl":"https://github.com/andrecodexvictor/Script-kitty","license":"MIT","licenseTier":"permissive","trust":"community","stars":4,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-07-25T16:56:08.000Z","addedAt":"2026-10-21T17:48:05.398Z","logoUrl":"https://avatars.githubusercontent.com/u/86633183?u=0231b84066ae1a06d7aecfab66a84fe414689366&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["utilities"],"tags":[],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-21T21:20:22.313Z","sample":false,"url":"https://conduits.dev/tools/script-kitty","language":"Python","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"

\n \"Script\n

\n\n

Script Kitty ๐Ÿฑ๐Ÿ›ก๏ธ

\n\n

\n Your Patch Cat โ€” Self-Hosted Enterprise Security Validation & AI Remediation Platform\n

\n\n

\n \"License\n \"PRs\n \"dotstack\"\n \"dotarchitecture\"\n \"dotcontext\"\n \"ZenPR\n \"MCP\n

\n\n\n---\n\n## ๐Ÿ’ป CLI Terminal Preview\n\n

\n \"Script\n

\n\n---\n\n## ๐Ÿ“– Overview\n\n**Script Kitty** is an open-source, self-hosted enterprise platform for authorized security validation, multi-language static application security testing (SAST), secret leak detection, HTTP security header evaluation, server log auditing, Web2/Web3 smart contract verification, and AI LLM guardrail testing.\n\nCombining a cyber detective cat identity (**Patch Cat**) with a rigorous operational governance model, Script Kitty provides automated vulnerability discovery, zero-trust policy enforcement, tamper-evident SHA-256 audit logging, and actionable remediation playbooks.\n\n---\n\n## โœจ Key Features & Capabilities\n\n- **๐Ÿš€ One-Word Global CLI (`sk` / `script-kitty`)**: Run `sk` without subcommands to launch the interactive arrow-key TUI menu.\n- **โšก Native ZenPR Integration Bridge**: Direct integration with [ZenPR](https://github.com/andrecodexvictor/ZenPR) to convert Script Kitty findings automatically into defensive Pull Requests.\n- **๐Ÿ•ธ๏ธ Persistent Knowledge Graph & LangGraph Memory**: Automatically indexes codebase architecture, files, and relationships into persistent graph nodes (`.context/graph/knowledge_graph.json`) upon installation.\n- **๐Ÿง  Self-Learning Adaptive Memory**: Automatically records codebase architecture patterns and user preferences into `.context/runtime/memory.json` as the agent navigates codebases.\n- **๐ŸŽฎ Interactive Checkbox Suite Selector**: Use arrow keys (`โฌ†๏ธ/โฌ‡๏ธ`) and Spacebar to select exactly which security modules to run.\n- **๐Ÿ’ฌ Direct Agent Conversation (`sk chat`)**: Direct natural language chat with the Detective Patch Cat agent (requires authenticated AI key/login).\n- **๐Ÿ”‘ Multi-Provider AI Key Manager & Codex Login**: Native support for OpenAI (GPT-4o), Google Gemini (2.5 Flash/Pro), NVIDIA NIM, OpenRouter, Anthropic Claude, xAI Grok, and ChatGPT Codex Subscription Tokens.\n- **๐Ÿค– AI LLM Guardrail & Anti-Hallucination Engine**: 5 defensive verification suites covering System Prompt Extraction, DAN Jailbreaks, Unsafe Tool Calls, Indirect RAG Poisoning, and Anti-Hallucination Grounding.\n- **โ›“๏ธ Web2 & Web3 Security Harnesses**:\n - **Web2 Harness**: Polyglot SAST (PHP, Ruby, Python, JS/TS), secret leaks, HTTP headers, Nginx/Apache log audit.\n - **Web3 Harness**: Solidity (`.sol`) smart contract auditing for reentrancy, `tx.origin` risks, unhandled calls, and weak randomness.\n- **๐Ÿ”‘ Secret & Credential Leak Engine**: Detects exposed AWS Access Keys, GitHub PATs, Slack tokens, SSH private keys, and JWT secrets.\n- **๐ŸŒ HTTP Security Header Evaluator**: Checks HSTS (`Strict-Transport-Security`), CSP, X-Frame-Options, and CORS configuration.\n- **๐Ÿพ Patch Cat Remediation Playbooks**: Produces step-by-step fix guides, hardening configurations, and copy-pasteable GitHub/GitLab Issues and Pull Requests.\n- **โ›“๏ธ Tamper-Evident Hash-Chained Audit Engine**: SHA-256 cryptographic logging in Rust with Merkle Root export.\n- **๐Ÿ›ก๏ธ Zero-Trust Policy Core & Approval Gates**: Enforces target allowlists (`scope.md`) and requires human approval for state-changing actions.\n- **๐ŸŒ Internationalization (i18n)**: Native support for English (`en` default), Portuguese (`pt`), and Spanish (`es`).\n\n---\n\n## ๐Ÿ—๏ธ Multi-Language Hybrid Stack\n\nScript Kitty's architecture is declared and governed by `.dotstack`, `.dotarchitecture`, and `.dotcontext`:\n\n```text\n โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”\n โ”‚ Script Kitty Dashboard โ”‚\n โ”‚ TypeScript / Vite / CSS โ”‚\n โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜\n โ”‚\n โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ–ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”\n โ”‚ Orchestrator, CLI & MCP Server โ”‚\n โ”‚ TypeScript โ”‚\n โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜\n โ”‚ โ”‚\n โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ–ผโ”€โ”€โ” โ”Œโ”€โ”€โ”€โ–ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”\n โ”‚ Agent PREVC Runtime โ”‚ โ”‚ Zero-Trust Policy Core โ”‚\n โ”‚ Python (Scanners/Validators)โ”‚ โ”‚ Rust (Hash Audit Log) โ”‚\n โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜\n```\n\n| Component | Technology | Responsibilities |\n+|---|---|---|\n+| **Frontend & UI** | TypeScript, Vite, Vanilla CSS | Sleek cyberpunk defensive dashboard, 3D Motion Mascot, i18n selector |\n+| **CLI & MCP Server** | TypeScript, Commander, MCP SDK | Operator command shell (`sk`) and stdio MCP server |\n+| **Agent Runtime & Tools** | Python 3.11+, Pydantic | Web2/Web3 harnesses, polyglot SAST, log auditor, guardrail validator |\n+| **High-Trust Core** | Rust 2021 | Zero-Trust Policy Engine, cryptographic SHA-256 Merkle audit logger |\n\n---\n\n## ๐Ÿพ Operating Modes\n\n| Mode | Purpose | Risk Level | Approval Required |\n|---|---|---|---|\n| **Scout** | Passive exposure discovery, asset fingerprinting, header checks | Low Risk | No |\n| **Verify** | Controlled confirmation of likely findings | Medium Risk | **Yes (Human-in-the-Loop)** |\n| **Patch** | Produce actionable remediation playbooks & PR diffs | Low Risk | No |\n| **Recheck** | Run regression checks to confirm fix closure | Low Risk | No |\n| **Lab** | Aggressive educational testing inside isolated containers/VMs | High Risk | **Yes (Lab Mode Only)** |\n\n---\n\n## ๐Ÿš€ Quick Start\n\n### Prerequisites\n- **Node.js** >= 18.0\n- **Python** >= 3.11\n- **Rust (Cargo)** >= 1.75 *(Optional for local Rust crate compilation)*\n\n### Installation & Global Link\n\n```bash\n# Clone the repository\ngit clone https://github.com/andrecodexvictor/Script-kitty.git\ncd Script-kitty\n\n# Install monorepo dependencies\nnpm install\n\n# Build all TypeScript applications\nnpm run build\n\n# Link Global CLI command (run once)\ncd apps/cli && npm link\n\n# Launch the interactive navigable CLI shell anywhere\nsk\n```\n\n---\n\n## ๐Ÿ’ป CLI Commands\n\n```bash\n# 1. Open Interactive Navigable TUI Shell (Default)\nsk\n\n# 2. Run full enterprise security audit\nsk audit\n\n# 3. Direct Chat with Detective Agent\nsk chat\n\n# 4. Configure AI Key / ChatGPT Codex Subscription Token\nsk auth --set-openai sk-... --provider openai\nsk auth --set-codex-token your_token --provider codex\n\n# 5. Run passive discovery scan on authorized target\nsk scout http://localhost:3000\n\n# 6. Scan codebase for hardcoded credentials & secret leaks\nsk scan-secrets ./src\n\n# 7. Evaluate HTTP security headers\nsk scan-headers http://localhost:3000\n\n# 8. Test AI application guardrails against prompt injection\nsk verify-guardrails http://localhost:3000/api/llm\n\n# 9. Generate Patch Cat remediation playbook\nsk patch SK-2026-001\n\n# 10. Execute follow-up regression recheck\nsk recheck http://localhost:3000 SK-2026-001\n```\n\n---\n\n## ๐Ÿ”Œ One-Command MCP Installations (AI Agent CLIs & IDEs)\n\nScript Kitty's stdio MCP server can be installed into all major AI coding agents with a single command:\n\n```bash\n# Register Script Kitty MCP Server in all detected agents on your system\nnpx -y script-kitty mcp install all\n```\n\n### Direct AI Agent CLI Setup\n\n#### 1. Claude Code CLI\n```bash\nnpx script-kitty mcp install claude\n```\n\n#### 2. Grok Build CLI\n```bash\nnpx script-kitty mcp install grok\n```\n\n#### 3. OpenCode CLI\n```bash\nnpx script-kitty mcp install opencode\n```\n\n#### 4. Google Antigravity Agent\n```bash\nnpx script-kitty mcp install antigravity\n```\n\n#### 5. Codex CLI\n```bash\nnpx script-kitty mcp install codex\n```\n\n#### 6. Cursor IDE & Windsurf Editor\n```bash\nnpx script-kitty mcp install cursor\nnpx script-kitty mcp install windsurf\n```\n\n---\n\n## ๐Ÿค– Automated Security Bot Deployment\n\nDeploy Script Kitty as a self-hosted background security monitoring bot in Docker:\n\n### Linux / macOS Deployment\n```bash\nchmod +x scripts/deploy-bot.sh\n./scripts/deploy-bot.sh\n```\n\n### Windows PowerShell Deployment\n```powershell\n.\\scripts\\deploy-bot.ps1\n```\n\n### Docker Compose\n```bash\ndocker-compose up -d\n```\n\n---\n\n## ๐Ÿ“ Repository Structure\n\n```text\nScript-kitty/\nโ”œโ”€โ”€ .dotstack # Technology stack specification & runtime bounds\nโ”œโ”€โ”€ .dotarchitecture # Trust boundaries, permissions matrix & data flows\nโ”œโ”€โ”€ .dotcontext # Defensive agent identity & PREVC workflow rules\nโ”œโ”€โ”€ scope.md # Target allowlist & forbidden environments\nโ”œโ”€โ”€ agent-spec.md # Master agent & subagent specification\nโ”œโ”€โ”€ LICENSE # MIT License\nโ”œโ”€โ”€ README.md # Project documentation & mascot artwork\nโ”œโ”€โ”€ assets/ # Mascot banner & CLI terminal preview images\nโ”œโ”€โ”€ scripts/ # Bot deployment scripts (deploy-bot.sh, deploy-bot.ps1)\nโ”œโ”€โ”€ apps/\nโ”‚ โ”œโ”€โ”€ ui/ # Vite + Vanilla CSS modern defensive dashboard\nโ”‚ โ”œโ”€โ”€ cli/ # Commander CLI shell (script-kitty / sk)\nโ”‚ โ””โ”€โ”€ mcp-server/ # Model Context Protocol stdio server\nโ””โ”€โ”€ packages/\n โ”œโ”€โ”€ agent_runtime/ # Python Web2/Web3 PREVC execution harnesses & Harness Engine\n โ”œโ”€โ”€ scanners/ # Polyglot SAST (Solidity, PHP, Ruby, Python, JS/TS), Secret & Log scanners\n โ”œโ”€โ”€ validators/ # AI Guardrail & anti-hallucination tester\n โ”œโ”€โ”€ remediation/ # Patch Cat playbook & GitHub Issue/PR generator\n โ”œโ”€โ”€ plugin_sdk/ # Community Plugin SDK loader\n โ”œโ”€โ”€ policies/ # Rust Zero-Trust Policy Engine & Crypto Auditor\n โ””โ”€โ”€ audit/ # Rust SHA-256 Hash-Chained Audit Logger\n```\n\n---\n\n## ๐Ÿ”’ Security & OWASP Compliance\n\nScript Kitty strictly adheres to OWASP guidelines for AI Agents and Model Context Protocol:\n- **Mandatory Scope Allowlist (`scope.md`)**: Actions stop immediately if a target IP/domain is not declared in scope.\n- **Input & Tool Distrust**: Tool outputs and external model completions are treated as untrusted data.\n- **Human-in-the-Loop Approval Gates**: State-changing operations pause for operator confirmation.\n- **Tamper-Evident Audit Logging**: Cryptographic SHA-256 hash chains guarantee auditable records.\n\n---\n\n## ๐Ÿค Contributing & License\n\nContributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) and respect `scope.md` safety boundaries.\n\nDistributed under the **MIT License**. See [`LICENSE`](LICENSE) for details.\n\n---\n\n

\n Crafted with โค๏ธ by Andrรฉ Victor A. O. Santos & the Open Source Security Community.\n

\n"}