ShadowStack v0.2

ShadowStack v0.2.0

Discovery & risk analytics for shadow-AI infrastructure.

This release adds an interactive terminal to ShadowStack — build up a scan step by step instead of assembling one long command line — along with a set of colour themes.

Highlights for v0.2.0

• New: interactive terminal (REPL) mode. Run shadowstack with no arguments (or pass -i/--interactive) to get a shadowstack> prompt: set <option> <value> to configure a scan, show to preview the resolved argv, scan/run to execute it, unset/reset to roll back, help for the full option list. The command vocabulary is generated from the same clap definitions as the one-shot CLI, so every flag is reachable and validated exactly as it is on the command line.
• New: colour themes. Six palettes for the terminal chrome — dark (default), light, matrix, ocean, amber, and mono. Set one at launch with --theme <name> or switch live inside the terminal with theme <name>. Colour auto-disables off a TTY or under NO_COLOR, and the scan report on stdout is never coloured — pipelines stay byte-clean.

Changed

• Bare invocation now opens the terminal. In 0.1, running shadowstack with zero arguments ran a one-shot MCP scan against the 127.0.0.1/32 default target. In 0.2, a bare invocation opens the interactive terminal instead. Any invocation that passes at least one flag is unaffected — existing scripted/CI usage (shadowstack --protocol mcp ..., etc.) behaves exactly as before. If you have automation that calls shadowstack with no arguments and expects a scan, add --target 127.0.0.1/32 (or your intended flags) explicitly.

Install

Download the static binary for x86-64 Linux, verify the checksum, and run:

download

curl -LO (URL) /shadowstack-0.2.0-x86_64-linux
curl -LO (URL) /shadowstack-0.2.0-x86_64-linux.sha256

verify

sha256sum -c shadowstack-0.2.0-x86_64-linux.sha256

install

chmod +x shadowstack-0.2.0-x86_64-linux
sudo mv shadowstack-0.2.0-x86_64-linux /usr/local/bin/shadowstack

shadowstack --help

The binary is statically linked (musl) — no glibc or OpenSSL required, runs on any x86-64 Linux distribution.

Quick start

Interactive terminal (new)

shadowstack
shadowstack> set protocol skills
shadowstack> set format json
shadowstack> scan

One-shot usage

shadowstack --protocol mcp --target 192.168.1.0/24
shadowstack --protocol skills --format json --output skills.json
shadowstack -p skills --fail-on high -f sarif -o results.sarif

Pick a terminal colour theme

shadowstack --theme ocean

Supported platforms

• x86-64 Linux — prebuilt static binary

Known limitations

• Discovery targets IPv4 (CIDR/host/DNS→IPv4). IPv6 ranges are not yet enumerated.
• Live MCP process inventory requires Linux /proc access

License

Apache License 2.0. See LICENSE.