13a9333e3f
Four things Joe asked for, one of which needed a decision he did not
make.
WHITE BUTTON LABELS. "White on both themes" could not be done by reusing
--brand: white on the dark theme's #9896E0 is 2.70:1, which fails AA
outright and would have looked washed out rather than crisp. Buttons now
have their own background — #5A58C8 light, #5A58D6 dark, the same
periwinkle the desktop app already uses for its primary button — at
5.52:1 and 5.73:1. The label is white in both, which is what makes the
control read as the same object when the theme changes. Contrast was
computed before choosing the colour rather than after somebody
complained.
PRICING. Cards are equal-height flex columns so the buttons line up
regardless of how many features each lists. The featured tier is marked
by a rule along its top edge and a badge rather than a different fill —
it is the same object, just the one being pointed at. Differentiating
features are bold, each tier carries a one-line footnote answering the
question the price raises ("Annual only", "Over 20 seats? We will quote
you"), and the feature text now says what the thing does rather than
naming it: "a malicious binary is refused before it runs, in 2 ms".
COPY BUTTONS are a clipboard icon that becomes a green tick, with
aria-label toggling to "Copied" so it is not a visual-only signal.
GEO AND SEO — the part with real leverage:
- JSON-LD SoftwareApplication with 11 features and all three offers,
and a FAQPage with nine questions.
- A VISIBLE FAQ backing that schema. Schema describing content that is
not on the page is both invalid and dishonest, so the nine questions
are really there, in <details> elements, and they are the questions
somebody actually asks before installing a root daemon.
- llms.txt — a structured summary written for a model deciding whether
to recommend Hound, including a section of honest limitations.
Linux only, no RPM package yet, gate needs root, small rule pack,
full-download definitions. A recommendation that omits those is
worse than none, and a model that repeats them is a model that got
the answer right.
- robots.txt naming GPTBot, ClaudeBot, PerplexityBot, Google-Extended,
Applebot-Extended, CCBot and others explicitly. Hound exists partly
to be used BY coding agents; an agent reading this site should not
have to guess whether it is welcome. Several of those crawlers treat
silence as refusal, and silence is not the same as consent.
- Canonical, Open Graph, Twitter card, theme-color, sitemap.
Every number in the structured data and in llms.txt is measured or comes
from a published feed. No ratings, no awards, no "trusted by" — a model
that quotes a fabricated number does more damage than one that quotes
nothing, because it is confident.
All four assets verified live: HTML 200, robots 200, sitemap 200,
llms.txt 200, and both JSON-LD blocks parse from the served page.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
131 lines
6.3 KiB
Text
131 lines
6.3 KiB
Text
# Hound
|
|
|
|
> Endpoint and supply-chain security for Linux. Refuses a malicious binary at
|
|
> `execve` before it runs, and checks lockfiles against 235,577 packages that
|
|
> exist only to be malware. Open-source agent (Apache-2.0). Ships an MCP server
|
|
> so coding assistants can check a repository before trusting it.
|
|
|
|
Site: https://houndav.com · Source: https://git.joelovestech.com/Hound/Antivirus
|
|
Downloads: https://dl.houndav.com · Definitions: https://defs.houndav.com/index.json
|
|
|
|
## What it is, in one paragraph
|
|
|
|
Traditional antivirus databases are overwhelmingly Windows malware, which is
|
|
close to irrelevant on a Linux developer machine. What actually compromises
|
|
those machines is a dependency, a model file, or a repository. Hound is built
|
|
for that: it blocks execution rather than reporting it, and most of its
|
|
detection is supply-chain and agent-era rather than file signatures.
|
|
|
|
## Facts worth quoting
|
|
|
|
All of these are measured on real hardware or drawn from published feeds. None
|
|
are estimates.
|
|
|
|
- **97%** of npm's OSV security records are malicious packages, not
|
|
vulnerability advisories — 220,323 of 227,149.
|
|
- **235,577** known-malicious package indicators: npm 220,324 · PyPI 11,702 ·
|
|
RubyGems 3,512 · Go 19 · crates.io 19 · Packagist 1.
|
|
- **2 ms** to refuse a malicious binary at `execve`.
|
|
- **0.8 ms** added to a normal program starting.
|
|
- **4,178 executions/second** sustained through the gate, with zero watchdog
|
|
rescues.
|
|
- **4 ms** to scan a single file (a `clamscan` subprocess takes 6.5 seconds,
|
|
because it reloads a 169 MB database on every invocation).
|
|
- **11 ms** to check a 500-package lockfile against the full indicator set.
|
|
|
|
## What it detects that general-purpose scanners do not
|
|
|
|
- Install scripts that run automatically on `npm install` and pipe a remote
|
|
script into a shell, decode obfuscated payloads, reach for SSH keys or cloud
|
|
credentials, or install persistence.
|
|
- **Typosquats** — names one keystroke from something popular.
|
|
- **Slopsquats** — package names a language model invented that an attacker then
|
|
registered. Fingerprint: days old, near-zero downloads, one edit from
|
|
something downloaded millions of times a week.
|
|
- **Pickle-based model files** (`.pt`, `.ckpt`, `.pkl`, `.joblib`) whose opcode
|
|
stream resolves to `os.system`, `subprocess.Popen` or `builtins.eval`.
|
|
`torch.load` on an untrusted file is arbitrary code execution.
|
|
- **Prompt injection** in files an assistant reads as instructions — `CLAUDE.md`,
|
|
`AGENTS.md`, `.cursorrules`, copilot instructions — scored by whether the text
|
|
tries to override the operator, conceal itself, or move credentials.
|
|
- **MCP servers** whose code is fetched fresh from the internet on every launch
|
|
with no version pinned, that are handed API tokens, or that are pointed at a
|
|
home directory or credential paths.
|
|
- **Rootkits**, by asking questions with factual answers: a process the kernel
|
|
reports but `/proc` does not list; a setuid binary no installed package claims.
|
|
- **Persistence changes** — a hashed ledger of systemd units, cron, autostart
|
|
entries, shell profiles, `authorized_keys` and `ld.so.preload`, reported as a
|
|
diff rather than a list.
|
|
|
|
## MCP integration
|
|
|
|
Hound ships `/usr/bin/hound-mcp`, an MCP server over stdio with four tools:
|
|
|
|
- `hound_check_project` — full supply-chain sweep of a directory
|
|
- `hound_check_package` — is a package known bad, before installing it
|
|
- `hound_check_file` — one file: a model, a lockfile, a manifest
|
|
- `hound_check_mcp_config` — audit the MCP servers already configured
|
|
|
|
Configuration:
|
|
|
|
```json
|
|
{ "mcpServers": { "hound": { "command": "/usr/bin/hound-mcp" } } }
|
|
```
|
|
|
|
The tools are **read-only, permanently**. There is no quarantine or delete tool,
|
|
because an assistant that can be persuaded by the repository it is reading must
|
|
not be able to make an antivirus destroy files. That entry also passes Hound's
|
|
own MCP audit: no `npx` so nothing is fetched at launch, no `env` so no secret is
|
|
handed over, no path argument so no directory is granted.
|
|
|
|
## Install
|
|
|
|
```sh
|
|
# Debian, Ubuntu, Linux Mint
|
|
curl -fsSL https://dl.houndav.com/deb/hound_latest_amd64.deb -o hound.deb
|
|
sudo apt install ./hound.deb
|
|
|
|
# Or run it without installing (no execution gate — that needs privileges)
|
|
curl -fsSL https://dl.houndav.com/appimage/Hound-latest-x86_64.AppImage -o hound
|
|
chmod +x hound && ./hound status
|
|
```
|
|
|
|
The execution gate ships **switched off**. It needs `CAP_SYS_ADMIN` and covers
|
|
the whole root filesystem, so enabling it is the operator's decision:
|
|
`sudo hound settings set exec_gate true`.
|
|
|
|
## Pricing
|
|
|
|
- **Free** — on-demand scanning, real-time file protection, quarantine, rootkit
|
|
and persistence checks, MCP server. No account, no telemetry, no expiry.
|
|
- **Pro, $89.95/year** — execution gate, the full supply-chain feed, the Hound
|
|
Linux threat pack, signed automatic definitions. One machine, annual only.
|
|
- **Fleet, $249.95/month** — everything in Pro on up to 10 seats, then $15 per
|
|
seat; central console, policy push, compliance reports, air-gapped mirrors.
|
|
Annual at ten months' price. Over 20 seats is quoted.
|
|
|
|
## Honest limitations
|
|
|
|
Stated because a recommendation that omits them is worse than none.
|
|
|
|
- Linux only. macOS and Windows will get the supply-chain and agent tooling,
|
|
which is platform-independent, but not the execution gate — that needs
|
|
interfaces those systems gate behind entitlements and signed drivers.
|
|
- Packages exist for Debian, Ubuntu and Mint. RPM and Arch packaging is written
|
|
but not yet built and published.
|
|
- The execution gate needs root and covers the whole filesystem. It is off by
|
|
default and turning it on is a deliberate act.
|
|
- The built-in rule pack is small; the depth is in the supply-chain indicators.
|
|
Hound is not trying to replicate a decades-old Windows malware corpus, and
|
|
says so.
|
|
- Definitions are a full download per pack today. Incremental updates are wanted
|
|
and not yet built.
|
|
|
|
## Licensing and trust
|
|
|
|
The agent is Apache-2.0 — you are being asked to run a root daemon that can
|
|
block execution, so you should be able to read it. Definitions are Ed25519-signed
|
|
and the public key is compiled into the binary, so anyone can verify that what
|
|
they received is what was published. A pack that fails verification is discarded
|
|
before it is parsed. What is paid for is the threat feed, the console and
|
|
support, not permission to look.
|