alter-zero is a Rust terminal agent that reads, edits, and debugs code alongside the operator, aimed at authorized development, security research, and automation workflows.
| Tool | linuztx/alter-zero — open-source AI coding agent for the terminal, written in Rust |
| Category | AI coding agent / terminal UI (TUI) harness |
| Primary Use | Reading, editing, debugging, and reviewing code with an agent you supervise live; also authorized security review, technical investigation, and automation via MCP servers and skills |
| Safe Use | Use during authorized assessments, code audits of systems you own or are contracted to test, and local labs; permission modes and /trust gate what the agent may execute |
| Telemetry Note | Credentials land in ~/.alter-zero/.env; commands stream visibly into the session, checkpoints snapshot working files, and provider-side prompt caching may leave request traces on the model backend |
alter-zero positions itself as a coding agent that lives entirely in your terminal: a single Rust binary for Linux (x86_64, arm64) and macOS (Intel and Apple silicon) that reads files, makes edits, runs commands, and checks its own results while you watch. The README is explicit that coding is the focus, with cybersecurity research, technical investigation, and automation as adjacent use cases for the same harness. That framing matters for the audience of this blog: rather than a point-and-shoot exploit gadget, this is a supervised workspace agent — closer to Claude Code or Codex CLI in spirit, delivered as a native ratatui-style TUI with persistent sessions and keyboard-driven controls.
The pitch table in the README highlights five pillars: work you can follow (live command output, readable diffs, a task checklist), control over execution (permission modes and change review), model choice (subscription, API key, or local Ollama), extensibility (subagents, skills, lifecycle hooks, MCP servers), and a native terminal experience. The current release is 0.10.0 under Apache-2.0, with 24 stars — an early-stage project, but one whose documentation depth suggests a maintainer thinking seriously about operator safety rather than raw autonomy.
Installation is a one-liner: curl -fsSL https://raw.githubusercontent.com/linuztx/alter-zero/main/install.sh | sh. The README explains that the script selects the build for your architecture, verifies its SHA-256 against the checksum published with the release, installs alter-zero into ~/.local/bin, and warns you if that directory is not on your PATH. Environment variables ALTER_ZERO_INSTALL_DIR and ALTER_ZERO_VERSION let you relocate or pin the install, and the CHANGELOG.md tracks deltas. For teams that distrust pipe-to-shell, each release lists every archive with its checksum so you can download and verify by hand — a small detail, but one that signals the author understands the threat model of distributing binaries to security practitioners.
There is also a container path that will interest this audience: docker/ builds a small headless Kali Rolling image around the latest release with a working set of command-line tools, runnable via Docker or Podman with docker/build.sh. The container guide covers workspaces, published ports, pasting images, and adding tools, and there are careful notes on terminal passthrough — inside tmux you enable allow-passthrough and select the outer terminal's image protocol so inline pictures render properly. Wrapping the agent in a disposable Kali container is a sensible containment pattern for anyone letting an LLM drive a shell near anything sensitive.
What separates alter-zero from thin LLM wrappers is the permission architecture. There are four modes: manual asks before file changes and commands, edit allows file changes, auto adds a reviewer for routine commands, and master runs unattended. You cycle them with Shift+Tab, and rules persist per project. At the approval prompt you inspect proposed file content, diffs, and commands before approving; you can approve once, allow a session rule, or reject with instructions via Tab. Ctrl+E asks for a command explanation mid-review. For an authorized assessment context, the manual default and the ability to reject-with-feedback are exactly the control surface you want between a model's suggestions and your keyboard.
Rewind and trust features deepen that story. Checkpoints can be enabled per directory to snapshot working files into a separate store; Esc Esc returns to an earlier message and restores the files with it — a poor-man's transactional rollback for agentic edits. /trust gates project-defined agents, hooks, and MCP servers so a malicious repository cannot silently arm its own tooling against you the moment you open it. Given how many supply-chain attacks now hide in repo-level agent configuration files, having the harness surface hooks.json and AGENTS.md definitions for explicit review is a defensive feature as much as a workflow one.
Model provisioning is unusually broad. /login connects to Agent Zero API, Venice, GitHub Copilot (device-code subscription flow), ChatGPT Codex (browser sign-in or device code, no API key), Anthropic (key or Console sign-in), OpenRouter, Ollama, and Ollama Cloud. Sign-ins are stored in ~/.alter-zero/.env, outside your repository — a deliberate choice that avoids leaking credentials into a directory the agent itself can edit and that you might later commit or share. /model remembers the selection per directory, and ALTER_ZERO_PROVIDER / ALTER_ZERO_MODEL environment variables configure everything pre-launch for scripted setups. The footer exposes active model, thinking mode, speed tier, and context usage; Ctrl+T cycles reasoning levels, and vision support is checked before any image is sent.
The security-research use case in the README is worth quoting for what it does and does not claim: "Review this repository for security vulnerabilities. Trace each finding to the code and suggest a fix." That is a code-audit prompt, not an attack workflow — the tool's value here is triaging unfamiliar codebases, tracing authentication paths, and drafting fixes, with the operator validating every finding. Similarly instructive prompts include tracing how access checks happen in a project and writing scripts that summarise logs and flag recurring errors — investigation and automation, squarely in authorized-auditor territory.
Extensibility comes through three mechanisms. Subagents (general-purpose and editable built-ins like explore) carry their own context, model, and tool access, and you can open a running subagent's session to steer or stop it. Skills are reusable SKILL.md folders invoked with $ and browsable via /skills, with a built-in skill-creator and a jina-reader skill for consuming public webpages and PDFs. MCP servers connect over stdio, HTTP, or SSE, including remote servers with OAuth, managed via /mcp or alter-zero mcp. hooks.json lets you approve, reject, or adjust tool calls programmatically — effectively a policy layer over the agent's hands.
Session continuity rounds out the feature set: /resume opens a searchable session picker, --continue reopens the latest session in the directory, and --resume <id> targets a specific one. Running commands can be pushed to the background with Ctrl+B and inspected or stopped from an empty composer with Down; queued follow-ups ride on Tab, and inline multiple-choice questions let the agent ask for decisions mid-turn. Tool batches are announced before execution, which keeps the operator's mental model intact when the agent parallelizes work.
Caveats for a professional adoption decision: the project is young (24 stars, version 0.10.0), the README's memory section truncates mid-sentence in the provided material, and some provider choices — notably the Venice "uncensored" models — deserve policy consideration before use in regulated environments. None of that undermines the engineering; the Rust build is reproducible via cargo install --path . with a pinned toolchain, and the offline demo mode that opens without a configured provider is a thoughtful touch for evaluating the UI before any credentials change hands.
For defenders watching the telemetry side: everything the agent runs streams visibly into its sessions, checkpoints live in a separate store on the host, and provider traffic depends on prompt caching where supported — meaning both local logs and the model backend's own records will reflect usage. On balance, alter-zero reads as a well-considered entry in the crowded coding-agent space, and its permission modes, /trust gate, and containerized Kali option make it one of the more defense-aware harnesses an authorized assessor could hand a model.
linuztx/alter-zero.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.