Shell execution
subprocess, os.system, shell=True, and command argument patterns.
Signals, not verdicts.
Krahanos uses deterministic Python AST analysis to surface capabilities. A finding is a reason to review code and intent, not proof that a vulnerability exists.
Database writes
Database execute, insert, update, delete, and write SQL signals.
Destructive operations
File deletion and other operations that can remove resources.
Network and secrets
Outbound network clients plus environment and secret access.
Dynamic code
eval, exec, and compile capabilities.
Agent tooling
MCP capabilities, destructive tools, and tool registration.
What Krahanos does not claim.
- It does not execute, import, install, or transmit repository code.
- It cannot prove that a capability is exploitable or that an approval boundary is absent.
- Dynamic behavior that is not visible in source may be missed.
- Scores and blast radius are deterministic heuristics, not guarantees.