Cyber-first local AI agent for terminal-driven security work.
Farai is a local AI agent built for CTFs, lab automation, security research, and long-running technical workflows. It runs from the terminal, keeps sessions resumable, executes tools locally or inside a Kali Docker runtime, and preserves tool output, artifacts, usage, and evidence so work can be reviewed instead of only trusted from a final answer.
For CSI/CyBench materials and exploratory benchmark artifacts, see farai-csi-bench.
npm install -g farai
Requirements:
Configure Farai and prepare the local runtime:
farai setup
Open the interactive:
farai
Config and auth files live under:
~/.local/pajarori/farai/
Farai checks the separate farai-data content channel before opening the TUI. Each commit to that repository is built into an immutable, commit-pinned bundle; when a validated bundle publishes new knowledge or skills, Farai asks before downloading it. The current content can be inspected or managed without starting a session:
farai update status
farai update check
farai update apply
farai update rollback
Set FARAI_CONTENT_MANIFEST_URL for a private channel or local file:// manifest, and FARAI_CONTENT_DIR to isolate the local content store. Set FARAI_DISABLE_CONTENT_UPDATE=1 to disable the channel.
Farai is under active development.
The current defensible claim is that Farai has substantial implementation validation and an evidence-oriented agent architecture. Stronger claims require clean benchmark campaigns, stronger isolation, canonical scoring, and larger empirical evaluations.
Early benchmark artifacts should be treated as exploratory unless the run artifact, oracle, isolation policy, model selection, and challenge materials are frozen and auditable.
Apache License 2.0
FAQs
Cyber-first freestyle local AI agent
The npm package farai receives a total of 2,542 weekly downloads. As such, farai popularity was classified as popular.
We found that farai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.