Basanos · the touchstone for AI systems
Prove the injection lands.
Basanos is an intercepting proxy and injection lab for LLM apps and agents. Conceal an instruction in a page, a document, or a tool description, deliver it to your target, and watch on a live beacon as the model ingests it, acts on it, and gives up the secret.
Native desktop · offline · per-seat · installs via apt01 Workflow
One engagement, five moves.
Every engagement runs the same chain: get inline with the target, build a concealed instruction, deliver it the way a real one would arrive, prove whether it landed, and write it up — end to end, with the evidence kept.
Intercept
Put the target's traffic through Basanos. TLS interception with its own certificate authority sits you inline with OpenAI, Anthropic, Gemini, Ollama, or an MCP server — full History, scope, and site-map.
$ basanos proxy --listen 127.0.0.1:8080 --ca install
Craft
Generate a concealed instruction across delivery channels — hidden text, structured data, invisible-Unicode smuggling, split-RAG chunks, poisoned tool descriptors, document metadata — wrapped in a believable cover document.
artefact: poisoned-invoice.pdf · channel: PDF metadata · canary a7f3c9
Deliver
Serve the artefact from the built-in host so a remote agent fetches it in the ordinary course of its work — or replay it straight into the target with Repeater.
$ basanos host ./artefacts --serve · GET /invoice/acme-0442.pdf 200
Prove
A canary token and an out-of-band beacon give you a live Ingested → Triggered → Exfiltrated timeline. You learn whether it actually landed — not whether it might.
beacon :9099 · canary a7f3c9 · MATCH 14:22:11.318
Report
File each finding once — severity, the beacon evidence, reproduction as a replayable artefact — and export the whole engagement, scope and captures intact.
→ findings-acme-0721.md · 6 findings · 21.4 KB
02 Capabilities
The toolkit, tuned for models.
Intercepting proxy
Sit inline with the target.
Capture, inspect, and rewrite the traffic between the application and its provider. Full request History, TLS interception with its own certificate authority, target scope, and site-mapping — the workaday surface of an engagement, tuned for the shapes and failure modes of language models and agents rather than ordinary web apps.
Repeater
Replay and modify any call.
Take a captured request, change a header, a message, a tool result, a parameter — and fire it again. Iterate against the target by hand until you understand exactly what moves it.
Intruder
Automate the sweep.
Mark positions, load a set, and let Basanos drive the request thousands of times — sorting the responses so the one that behaves differently stands out.
Indirect prompt injection
Instructions hidden in what the model reads.
The centre of gravity. Basanos generates concealed instructions across delivery channels — hidden text, accessibility-tree attributes, JSON-LD, invisible-Unicode smuggling, RAG chunks split so none looks malicious alone, poisoned tool descriptors, document and image metadata — and wraps each in a believable cover document. What a human opens looks ordinary; what the model reads carries the instruction.
Beacon & canary
Proof it landed, out of band.
A canary token plus an out-of-band listener give you a live Ingested → Triggered → Exfiltrated timeline. A CSP and sink model helps you reason about where a landed injection can actually reach.
Jailbreak lab
Evolve a prompt until the guardrail gives.
Run an automated loop that mutates a prompt against the target's defence, generation after generation, until one gets through — and keeps the winning transcript as evidence you can replay.
Any provider. Every engagement, saved.
Point it at OpenAI, Anthropic, Gemini, local models via Ollama, or an MCP server — anything the application talks to. Project files park an engagement with its scope, findings, and captures intact, so you can close the laptop and resume exactly where you were.
03 The intercept
Read the instruction the user never sent.
A retrieved document, a tool description, a page the agent fetches — the model reads far more than the user ever types, and it rarely tells you which words it obeyed. Basanos shows both sides of every exchange byte for byte, and marks the content that carried an instruction.
- Request and response bodies, unabridged
- Retrieved documents with concealed content flagged
- Tool calls traced to the content that caused them
- Inline annotations that become findings
Hold a request on the wire, edit it in Repeater, and send it on — or let it through and watch what the model does next.
04 Findings
Written once. Read by everyone.
A screenshot in a chat thread is not a finding. In Basanos every finding is filed in the same structure — severity, title, evidence pulled straight from the beacon and the capture, reproduction as a replayable artefact, status. No reconstruction from memory.
Because reproduction ships as the artefact and its delivery, whoever reads the report can re-run it and watch the canary come back for themselves. When it is time to hand over, export the whole engagement — for the client, for the remediation team — without rewriting a word.
severity, title,
evidence: [beacon, capture],
reproduction: artefact + delivery,
status
}
05 Local-first
Your engagement data is some of the most sensitive you hold.
Client systems, the artefacts you crafted, findings that are not fixed yet. Basanos treats that accordingly: it is a native desktop app with no server side, built to run air-gapped.
- Runs entirely on your machine — engagements stored on disk at ~/.basanos/engagements, scope and captures with them
- No cloud dependency, no account, no telemetry — and no setting to enable it
- The beacon listens out-of-band on a loopback port you control; the only traffic that leaves is the request you point at the target
- Air-gap friendly and per-seat licensed; installs via apt
$ basanos audit --egress
What leaves your machine: nothing.
~/.basanos/engagements/acme-0721.bsn · 18.6 MB · local
~/.basanos/engagements/rag-review-0715.bsn · 9.4 MB · local
beacon · 127.0.0.1:9099 · loopback only
connections opened by basanos · 0
analytics events sent · 0 · crash reports sent · 0
06 · Access
Put your AI system to the stone.
Basanos is in private release for security teams testing LLM apps, agents, and retrieval systems. Native desktop, per-seat, installs via apt, runs offline. Leave an email and we will send a build and a setup guide.
Write to hello@basanos.io for a build.