Install, point it at a target, run the chain.

Install

Basanos ships as a Debian package from its own apt source. Add the signing key and the source, then install.

# add the Basanos apt source
curl -fsSL https://apt.basanos.io/key.gpg | sudo gpg --dearmor \
  -o /usr/share/keyrings/basanos.gpg
echo "deb [signed-by=/usr/share/keyrings/basanos.gpg] https://apt.basanos.io stable main" \
  | sudo tee /etc/apt/sources.list.d/basanos.list
sudo apt update && sudo apt install basanos

Activate your seat from the licence file you were sent. Activation is offline — it verifies a signature and writes a local licence; there is no server to reach.

# activate this seat (offline)
basanos license activate ./basanos-seat.key

Get inline

Start the intercepting proxy and export its certificate authority. Trust the CA in the target's environment so Basanos can read the TLS traffic between the application and its provider.

# start the proxy, export the CA
basanos proxy --listen 127.0.0.1:8080
basanos ca export ./basanos-ca.pem   # trust this where the target runs

Point the application's provider traffic at 127.0.0.1:8080 — an HTTPS_PROXY variable, a client setting, or a container's network config. Requests appear in History as they happen; set your scope so only the hosts you are testing are captured.

Run the chain

An engagement runs the same five moves. Each has a place in the app and a command, so you can drive it by hand or script it.

• Intercept — capture and read the traffic; hold a request on the wire to edit it
• Craft — generate a concealed instruction in the channel you are testing, wrapped in a cover document
• Deliver — serve the artefact from the built-in host, or replay it straight in with Repeater
• Prove — a canary and the out-of-band beacon give you a live Ingested → Triggered → Exfiltrated timeline
• Report — file findings with the beacon evidence and export the engagement

# serve an artefact so a remote agent fetches it
basanos host ./artefacts --serve
# watch the out-of-band beacon
basanos beacon --listen 127.0.0.1:9099

Providers

Basanos sits in front of anything the application talks to — hosted APIs or a model on the same machine. It understands the request shapes for each so History, Repeater, and Intruder read the messages, tools, and parameters rather than raw bytes.

• OpenAI, Anthropic, Gemini — hosted chat and tool-use APIs
• Ollama — local models on localhost, no external route needed
• MCP servers — tool descriptors and calls, where poisoned descriptors are tested

Project files & offline

An engagement is a single project file — ~/.basanos/engagements/name.bsn — holding its scope, History, findings, and captures. Close the laptop and resume exactly where you were.

Everything runs on your machine. Review, crafting, and export work with the network cable unplugged; the only traffic that leaves is the request you point at the target, and the beacon listens on a loopback port you control. Suitable for air-gapped and confidential work.

# open a saved engagement
basanos open ./acme-0721.bsn
# confirm nothing else is talking to the network
basanos audit --egress