A local classifier for shell command risk: Bash, PowerShell and cmd.
v0.4.3 · 111M parameters · 115 MB · CPU INT8 ONNX · ~14 ms per command · offline
Download v0.4.3 · Try it in your browser · Website · Model card · Usage · Benchmark data · Licenses
Model: Apache-2.0. Runtime: MIT. You may use, modify and redistribute it, including commercially, under the respective terms. Training data is not included or relicensed.
- Triage Score 68.3 (v0.4.2: 54.4), the best of any guard tested on the new, harder benchmark. Every risky command asked about or blocked earns a point; the score shrinks when more than 10% of safe commands are stopped. Three benchmarks (7,911 commands), weighted by size.
- PowerShell and cmd. v0.4.2 answered
reviewfor every non-Bash command; v0.4.3 classifies all three shells. - Long commands read in full. Commands longer than one 512-token window are split into overlapping windows and every token is used. Nothing is truncated.
- Far fewer interruptions on look-alike safe commands. On lancet-bench-2-next it catches the same 78.0% of risky commands as v0.4.2 while stopping 12.4% of safe ones instead of 20.0%.
- ShellRisk-Bench test split: 64.8% caught (v0.4.2: 60.1%), 3.0% of safe commands stopped (2.7%).
- Neutral set: 85.8% caught (91.0%), 5.6% stopped (7.0%).
- A newly trained model on a new command-semantics curriculum of risky/safe twins (21,544 rows), trained to convergence. Same size and CPU speed as v0.4.2.
LANCET Nano v0.4.3 against every other command guard we have tested, each scored once at its own shipped setting on the same 7,911 commands. Every other guard either stops more than 10% of safe commands or catches fewer than a third of risky ones; Nano catches 77.0% of risky commands while stopping 9.0% of safe ones.
Until v0.4.2, the Triage Score used lancet-bench-1 (793 Bash commands). It had become too easy to tell the best guards apart: Jev caught 96.8% of its risky commands and v0.4.2 92.4%. It was also narrow, with Bash only, short single-line commands, and a quarter of its cases about secrets.
From v0.4.3 the Triage Score uses lancet-bench-2-next, a new, much more comprehensive benchmark:
- 3,204 commands built as 1,602 risky/safe twins. Every risky command has a safe look-alike that differs only in the detail that decides the risk, such as reading a secret's expiry date instead of its value, or a real preview instead of one that changes things first.
- 289 scenarios in 40 areas: AWS, Azure and GCP, Kubernetes, PostgreSQL, Redis, SQLite and other databases, Git, CI and publishing, containers, credentials, filesystems and backups, infrastructure as code, deceptive previews, encoded input, shell quoting, expansion, redirection, state and control flow, Python, JavaScript and data tools, messaging, remote execution, and macOS and Windows administration.
- Every scenario must survive composition. Each one is repeated inside a subshell, a function, a command substitution, a nested
bash -c, a pipeline and a background job. - Three shells: 3,066 Bash, 102 PowerShell and 36 cmd commands. Commands are longer and more realistic: 1,803 are multi-line; lancet-bench-1 had none.
- Held out. No LANCET release was trained, tuned or calibrated on it. Each guard is scored once at its shipped setting.
Because it is much harder, every guard scores lower than before, LANCET and comparators alike. v0.4.2 scored 82.7 under the previous Triage Score and 54.4 under the new one. The model did not change; the test did. Scores are only comparable on the same benchmark. lancet-bench-1 is retired and now part of LANCET's training data; its commands, labels and results stay published.
Every LANCET Nano release scored the same way, at its shipped setting, on the same three benchmarks. The grey ticks mark each release's score on the retired lancet-bench-1.
Each bar is one guard's Triage Score on 7,911 commands; the colours show how many points it earned on each benchmark: lancet-bench-2-next (3,204 commands, up to 58 points), the ShellRisk-Bench test split (4,194, up to 20) and a neutral set of outside-party commands (513, up to 21). A benchmark's points are its weight (58% / 20% / 21%, by size) times the guard's score on it: every risky command asked about or blocked earns a point, and the score shrinks in proportion when more than 10% of safe commands are stopped. Each guard is scored once at its shipped setting.
| Guard | Triage Score | lancet-bench-2-next | ShellRisk test | Neutral set | Risky caught | Safe stopped | Parameters | Runs on |
|---|---|---|---|---|---|---|---|---|
| LANCET Nano v0.4.3 | 68.3 | 63.1 | 64.8 | 85.8 | 77.0% | 9.0% | 111 M | CPU, local |
| LANCET Nano v0.4.2 | 54.4 | 39.0 | 60.1 | 91.0 | 77.1% | 13.7% | 110 M | CPU, local |
| LANCET Nano v0.4.0 | 47.1 | 41.1 | 60.6 | 50.8 | 55.7% | 10.5% | 110 M | CPU, local |
| LANCET Nano v0.4.1 | 44.9 | 38.1 | 70.5 | 39.3 | 67.9% | 14.6% | 110 M | CPU, local |
| LANCET Nano v0.3.0 | 44.7 | 44.3 | 46.6 | 43.6 | 55.3% | 11.6% | 110 M | CPU, local |
| LANCET Nano v0.2.0 | 40.7 | 39.3 | 47.7 | 37.9 | 55.2% | 13.6% | 35 M | CPU, local |
| LANCET Nano v0.1.0 | 40.5 | 34.9 | 45.6 | 51.0 | 58.4% | 14.1% | 35 M | CPU, local |
| Jev | 38.9 | 43.6 | 32.4 | 32.1 | 90.0% | 23.4% | undisclosed | hosted API |
| verdict-shell-safety | 32.4 | 27.6 | 33.3 | 44.9 | 56.3% | 18.0% | 151 M | CPU, local |
| Kestrel | 30.7 | 12.7 | 100.0 | 14.0 | 68.1% | 37.1% | — | local |
| ModernBERT bash | 23.2 | 16.2 | 40.9 | 25.6 | 48.1% | 22.8% | 150 M | local |
| dcg | 19.8 | 26.4 | 4.1 | 16.5 | 19.8% | 6.9% | rules | local |
| AutoShell-0.8B | 19.2 | 10.2 | 22.4 | 41.0 | 98.8% | 70.9% | 0.8 B | GPU, local |
| Gyra | 17.9 | 19.0 | 4.1 | 27.8 | 28.2% | 13.4% | 421 M + rules | GPU, local |
| bash-classify | 14.3 | 13.5 | 16.8 | 14.0 | 92.9% | 65.8% | rules | local |
| Laya | 13.3 | 11.0 | 16.2 | 17.1 | 87.3% | 69.6% | 421 M | GPU, local |
| bev-decider | 13.3 | 10.8 | 18.7 | 14.8 | 94.4% | 75.3% | 0.4 B | GPU, local |
| laya-cli-gate | 12.5 | 11.8 | 12.3 | 14.5 | 71.2% | 57.5% | 421 M | GPU, local |
| sh-guard | 10.9 | 10.2 | 12.1 | 11.7 | 97.9% | 90.5% | rules | local |
| Shieldstral-1.0-3B | 6.1 | 4.1 | 7.8 | 9.9 | 6.1% | 0.2% | 3 B | GPU, local |
Jev received task context; the others see only the command. Per-benchmark columns are each benchmark's own Triage Score (0-100). Guards that support only Bash answer the 138 PowerShell and cmd commands as "ask".
Detail by area on lancet-bench-2-next. More charts are on the website.
Download the release ZIP and its checksum. Verify the checksum and extract the ZIP. Then, inside the extracted directory (Python 3.12, Windows / PowerShell), run:
python verify_bundle.py --strict
python -m venv .venv
.\.venv\Scripts\python.exe -m pip install -r requirements.txt
$env:OPENBLAS_NUM_THREADS = '1'
'{"command": "kubectl delete namespace prod", "shell": "bash"}' | .\.venv\Scripts\python.exe classify.py --model model
'{"command": "Remove-Item -Recurse -Force C:\\Users\\me\\Documents", "shell": "powershell"}' | .\.venv\Scripts\python.exe classify.py --model modelSend JSON lines with a command string and shell set to bash, powershell or cmd. Each input is classified as risky, review or not_flagged. Inputs are inert text and are never executed. No API key or network connection is needed after installation. See the full instructions.
If you clone the repository instead of downloading the ZIP, install Git LFS, run git lfs pull, and use bundle/.
LANCET Nano v0.4.3 is the Salesforce CodeT5+ 220M encoder, fine-tuned from its pinned upstream weights, with a small pooling head that reads long commands as overlapping windows. It does not start from an earlier LANCET checkpoint.
Training labels come from project authoring, documentation and source datasets, not model opinions:
- LANCET's new command-semantics curriculum: project-authored risky/safe twins for Bash, PowerShell and cmd, including long multi-line scripts
- the wording of human-written example descriptions in tldr-pages (CC BY 4.0)
- AWS operation verbs and the
sensitiveoutput-field markings in botocore service models (Apache-2.0), so commands that print credentials are risky - reference examples from the Azure CLI, GitHub CLI (MIT), kubectl and Docker CLI (Apache-2.0)
- attack-technique and everyday developer commands from the ShellRisk-Bench training split, with its upstream labels
- the Shell Safety v2 training split (MIT), with its author's allow/deny labels
- LANCET's project-authored risky/safe pairs, contrast sets of agent-style,
exec-style and shell-escape commands, a secrets family, its earlier evaluation suites and the retired lancet-bench-1 (original labels)
No language model, hosted API or human labeler produced any training label. See the model card and source notices.
- Bash, PowerShell and cmd. PowerShell and cmd coverage is newer and smaller than Bash coverage. Nano does not inspect the filesystem, fetched scripts or task context.
- Other shells, invalid input or more than 8,192 UTF-8 bytes return
review. Inputs are never silently truncated. not_flaggedis not execution authorization or a safety guarantee.- Its weakest areas on lancet-bench-2-next are credentials, Windows administration, macOS administration and deceptive previews (see the chart above).
- lancet-bench-1: 793 Bash commands (409 risky, 384 benign) across 37 tool areas, with labels, rationales and results for 14 command guards. It was LANCET's release benchmark until 2026-09-29, when it was retired in favour of lancet-bench-2-next. It is free to use (MIT). The commands are test data; do not run them.
- lancet-bench-2-next is kept private so it stays a fair, unseen test for future releases. Its design and per-area results are summarized above.
- v0.4.3 — LANCET Nano, CodeT5+ 220M, windowed (current, pre-release): newly trained; Bash, PowerShell and cmd; Triage Score 68.3.
- v0.4.2 — LANCET Nano, CodeT5+ 220M: Triage Score 54.4 (82.7 on the retired lancet-bench-1).
- v0.4.1 — LANCET Nano, CodeT5+ 220M: v0.4.0 with a lower review threshold.
- v0.4.0 — LANCET Nano, CodeT5+ 220M: the same weights with the stricter v0.4.0 thresholds.
- v0.3.0 — LANCET Nano, CodeT5-base: still available unchanged.
- v0.2.0 — LANCET Nano, CodeT5-small: smaller (36 MB) and faster (~3–6 ms).
- v0.1.0 — LANCET Nano v0.1.0 (formerly V5).
LANCET is built on Salesforce CodeT5+ by Yue Wang, Hung Le, Akhilesh Deepak Gotmare, Nghi D. Q. Bui, Junnan Li and Steven C. H. Hoi. Training commands come from the tldr-pages team and contributors, AWS botocore, the Azure CLI, GitHub CLI, kubectl and Docker CLI projects, ShellRisk-Bench by Kontext Security (with Atomic Red Team by Red Canary and InternalAllTheThings), Shell Safety v2 by tomngdev, plus the datasets credited in the notices. Runtime and LANCET contributions: Tanner Middleton.
See the full credits, source notices and model changes.