C11 · POSIX · OPEN SOURCE

Small tools.
Rebuilt properly.

Focused command-line tools in native C11 and readable Python—with bounded inputs, Unix administration, threat hunting, and a read-only interface for local AI troubleshooting.

Build the toolkit View source ↗

C + Py: independent editions
bounded: input budgets
0: shell calls

pydev — zsh

$ git clone https://github.com/drmbios/pydev
$ cd pydev && make
✓ built 32 native tools

$ bin/cntr README.md
a 131
b 12
c 38
▋

STRICT WARNINGS · ASAN · UBSAN

C11 ◆ PYTHON 3.9+ ◆ SQLITE ◆ POSIX ◆ ADDRESSSANITIZER ◆ MAKE ◆ ZERO SHELL INJECTION

01 / THE TOOLBOX

One job. One binary.

Each utility stays deliberately small, composable, and predictable—the Unix philosophy without the mystery behavior.

cntr

Fast, case-insensitive ASCII letter frequency analysis for any text file.

cntr FILE

••••

codebreaker

A Mastermind-style four-digit terminal game with secure randomness and feedback.

codebreaker [ATTEMPTS]

<a>

parser_html

Extract quoted link destinations from bounded HTML input in linear time.

parser_html FILE

pip

qpipper

Search or install packages through a shell-free, injection-resistant launcher.

qpipper ACTION PACKAGE

{ }

JSON viewers

Inspect compact or formatted JSON with explicit input and nesting limits.

readjson FILE

sql

Store and update question-answer entries using prepared SQLite statements.

sql DB add NAME ANSWER

contacts

Pull names and telephone numbers from vCard files into a clean summary.

contacts FILE.vcf

X/O

ttt

A complete local two-player tic-tac-toe game with guarded input.

ttt

write2file

A bounded, error-aware text writer for quick terminal workflows.

write2file FILE TEXT

CRC

checksum

Calculate standard CRC-32 values for fast file integrity comparisons.

checksum FILE...

hexview

Inspect binary data as aligned hexadecimal bytes and printable ASCII.

hexview FILE [MAX_BYTES]

str

stringsx

Extract meaningful printable runs from bounded binary input.

stringsx FILE [MIN_LENGTH]

***

randpass

Generate secure passwords from unbiased operating-system randomness.

randpass [LENGTH]

SYS

syscallx

Translate Linux x86-64 syscall numbers into names and plain-language explanations.

syscallx NUMBER...

lsx

List files with numeric permissions and true recursive directory sizes.

lsx [-aSr] [PATH]

traceflow

Trace syscalls and forked process dependencies as an indented tree.

traceflow COMMAND [ARG...]

CPU

syswatch

Combine CPU, memory, load, disk, and network graphs with separate CSV logs.

syswatch --count 10 --log logs

USR

sessionx

Map logged-in users to their processes and safely dry-run session termination.

sessionx --terminate USER

PID

procexp

Inspect process owners, memory, threads, executables, and open descriptor counts.

procexp [PID]

CPU

coreinfo

Summarize kernel, architecture, processor, page size, CPU count, and physical memory.

coreinfo

CLK

clockres

Report the real resolution of available POSIX realtime, monotonic, and CPU clocks.

clockres

numconv

Convert integers among decimal, hexadecimal, octal, and binary with overflow checks.

numconv NUMBER

linkscan

Discover all hard links sharing a target file's device and inode.

linkscan FILE [ROOT]

RUN

autostartx

Inventory standard Linux and macOS startup entries without loading or executing them.

autostartx

WHO

whoisx

Query WHOIS services with input validation, timeouts, and a bounded response.

whoisx example.com

antivermis

Hunt malware, miners, risky persistence, and rootkit indicators with bounded heuristics and hash-verified signature updates.

antivermis --check-update URL DB

NEW / QUANTUM HOSTS + PQC

Real capabilities.
Clear boundaries.

Five new C11 and Python tools for classical Linux/macOS hosts: OpenSSL-backed post-quantum keys, bounded circuit validation, ideal simulation, and memory planning. No physical QPU or quantum RNG is implied.

pqcheck

Inventory local OpenSSL KEM and signature algorithms. Check for ML-KEM and ML-DSA; availability is not a security certification.

pqcheck

KEY

pqkey

Generate ML-KEM or ML-DSA keys with OpenSSL 3.5+. New owner-only directory, no overwrite, no classical fallback. Private keys are unencrypted: protect them.

pqkey ML-KEM-768 pq-keys

QASM

qasmcheck

Validate a documented OpenQASM 2 subset and report qubits, gates, and dependency depth. Bounded to 20 qubits and 2,048 gates.

qasmcheck examples/bell.qasm

|ψ>

qsim

Simulate ideal circuits on a CPU and print basis-state probabilities. Up to 10 qubits; no shots, noise model, or hardware backend.

qsim examples/bell.qasm

RAM

qbudget

Estimate dense complex128 statevector memory without allocating it. Thirty qubits need 16 GiB of payload, before runtime overhead.

qbudget 30

UPGRADED

256

randpass --quantum

Generate 256 bits of OS-random entropy as 64 hex characters. A high-entropy secret—not a quantum RNG, cipher, or automatic protocol upgrade.

randpass --quantum

For Linux control hosts, pair these with coreinfo, syswatch, procexp, clockres, lsx, Antivermis, and structured file/system evidence. They inspect classical resources, not qubits or laboratory pulse timing.

GUIDEExamples, safety & host selection → CIRCUITBell-state example → TESTSParity & PQ interoperability →

02 / STRUCTURED EVIDENCE

Useful to humans.
Safe for local agents.

The optional pydev AI adapter produces versioned JSON with evidence IDs, explicit coverage, units, capability discovery, and honest unsupported states.

JSON 1.0

{ }

Evidence contract

Stable status, timestamps, platform, measurements, evidence, warnings, errors, and coverage for every collector.

python3 -m pydev_ai capabilities

MCP

Read-only server

Twelve bounded stdio tools with strict filesystem roots and no shell, mutation, termination, installation, or network access.

python3 -m pydev_ai.mcp_server --root PATH

FLOW

CPU

Pressure diagnosis

Correlates correctly sampled host and process rates while separating facts, hypotheses, missing evidence, and next checks.

pydev-ai diagnose-pressure

FLOW

File investigation

Connects file identity, bounded inspection, Antivermis indicators, startup metadata, and running-path observations.

pydev-ai --root PATH investigate-file FILE

OPTIONAL LOCAL MCP

$ python3 -m pip install -e '.[mcp]'
$ python3 -m pydev_ai.mcp_server --root "$PWD"
✓ read-only stdio tools · no API key required

GUIDEStructured interface → MCPConfiguration and boundaries → SECURITYRule inventory → SCHEMAJSON contract 1.0 →

03 / PLATFORM SUPPORT

Portable where honest.
Explicit where limited.

Cross-platform collectors work on Linux and macOS. Linux-only counters report unsupported on other systems instead of returning made-up measurements.

LINUX + MAC

Files and security

Rooted file inspection, checksums, directory usage, hard-link discovery, startup inventory, and bounded Antivermis scanning.

inspect_file · scan_files · find_hardlinks

LINUX

/proc

Live system evidence

Delta-based CPU, disk, network, and process rates with PID identity, reset detection, explicit units, and bounded samples.

sample_system_metrics · list_processes

OPTIONAL

GPU

AI infrastructure

NVIDIA metrics use nvidia-smi when available. Inference telemetry requires an exact configured host and explicit network permission.

pydev-ai ai-health

BOUNDARY

Read-only by design

The AI interface cannot run a shell, install packages, alter files, terminate processes, or expose process environments and credential stores.

get_capabilities

04 / RECENT UPDATES

Built in layers.
Verified at boundaries.

The project now maintains matching Python and C11 editions, with security boundaries documented and exercised in both.

OCT 05

Quantum-host toolkit

Five bounded C/Python additions, post-quantum OpenSSL key interoperability, high-entropy secret generation, and a curated host-tool guide.

pqcheck · pqkey · qasmcheck · qsim · qbudget

OCT 04

SAFE

Security review

Fixed scan budgets, descriptor races, telemetry logic, and redaction gaps. Enabled GitHub security scans and protected-branch checks.

CodeQL · secret scanning · dependency review

SEP 13

Operations interface

Added structured evidence collectors, deterministic workflows, correct sampled metrics, strict filesystem roots, and optional local MCP.

make python-check · make mcp-check

AUG 23

Python parity

Added independent Python 3.9+ counterparts for every user-facing native tool, including Antivermis and the Linux administration suite.

make python-check

AUG 19

Threat hunting

Added Antivermis signature updates with HTTPS-only remote feeds, SHA-256 verification, parser validation, and atomic installation.

antivermis --update-db URL DB

AUG 15

SYS

Unix utility suite

Added Linux administration plus six cross-platform Sysinternals/NirSoft-inspired terminal tools.

traceflow · syswatch · coreinfo

AUG 11

SAFE

Hardening pass

Added binary tools, optional SQLite builds, parser limits, abuse tests, and sanitizer CI.

make sanitize

AUG 09

C11

Native foundation

Converted the repaired Python sketches into strict C11 tools and launched the GitHub Pages site.

make && make check

05 / BUILT DEFENSIVELY

Inputs are hostile.
Tools should be calm.

These utilities assume files can be oversized, strings malformed, and arguments malicious. Limits are part of the product—not an afterthought.

Explore the abuse tests ↗

16–64 MiB
Bounded file reads
General readers cap input at 16 MiB; Antivermis defaults to 32 MiB and hard-caps files at 64 MiB.
128
Validated JSON depth
Grammar, nesting, and output growth are checked before rendering.
execvp
No command shell
Package arguments never become executable shell syntax.
ASAN
Memory checked
Sanitizers, special-file rejection, and symlink tests run across the suite.

06 / GET STARTED

Three commands.

You need a C11 compiler and Make. SQLite is optional; Python 3.9+ runs the Python and structured tools, while MCP needs Python 3.10+.

BUILD

$ git clone https://github.com/drmbios/pydev.git
$ cd pydev
$ make && make check

READMEFull documentation → LICENSEApache 2.0 → CHANGELOGDevelopment history → CONTRIBUTEOpen a pull request →

Small tools.Rebuilt properly.

One job. One binary.

cntr

codebreaker

parser_html

qpipper

JSON viewers

sql

contacts

ttt

write2file

checksum

hexview

stringsx

randpass

syscallx

lsx

traceflow

syswatch

sessionx

procexp

coreinfo

clockres

numconv

linkscan

autostartx

whoisx

antivermis

Real capabilities.Clear boundaries.

pqcheck

pqkey

qasmcheck

qsim

qbudget

randpass --quantum

Useful to humans.Safe for local agents.

Evidence contract

Read-only server

Pressure diagnosis

File investigation

Portable where honest.Explicit where limited.

Files and security

Live system evidence

AI infrastructure

Read-only by design

Built in layers.Verified at boundaries.

Quantum-host toolkit

Security review

Operations interface

Python parity

Threat hunting

Unix utility suite

Hardening pass

Native foundation

Inputs are hostile.Tools should be calm.

Three commands.

Small tools.
Rebuilt properly.

Real capabilities.
Clear boundaries.

Useful to humans.
Safe for local agents.

Portable where honest.
Explicit where limited.

Built in layers.
Verified at boundaries.

Inputs are hostile.
Tools should be calm.