Run a safe, non-destructive Talos security scan of an authorized website. Checks HTTPS/TLS, security headers, cookies, exposed files, DNS/email security, and basic fingerprinting. Returns a graded report with remediation.

Look up known public vulnerabilities for a software product and optional version, such as nginx 1.18.0.

Analyze an authentication log for brute-force or password-guessing attacks. Reports attacking IPs, attempt counts, targeted usernames, ML confidence, and anomaly flags.

Search academic literature across OpenAlex, Semantic Scholar, and CORE. Call this whenever the user asks for research papers, citations, academic papers, studies, references, or literature about a security topic.

Find real academic research papers and citations for security scan findings or vulnerability topics. Use this when the user says research papers, papers, citations, studies, academic literature, references, arXiv, Semantic Scholar, OpenAlex, CORE, IEEE-style evidence, or asks for papers about found bugs/findings like HSTS, CSP, X-Frame-Options, clickjacking, MIME sniffing, or Referrer-Policy.

Check whether a URL/link is safe to open or enter information into. Use this whenever the user asks "is this link safe", "is this phishing", "check this URL", "can I open this", "is this scam/malware", "detect phishing link", or shares a suspicious link. Detects phishing, social engineering, brand impersonation, malware, unwanted software, scams, risky downloads, shorteners, suspicious redirects, typosquatting, homograph/punycode, unsafe HTTP, private-network redirects, and provider threat-intel matches. Returns a verdict, risk score, reasons, safe points, and recommendation.

Generate ready-to-review defensive firewall rules for attacking IPs. Does not execute the rules.

Send a security alert to configured Gmail/SMTP email or Slack channels. Use only when the user wants an alert sent.

Forward, email, share, or send information to the user or another recipient using the configured Gmail SMTP sender. Call this when the user says things like "send this to me", "forward these points", "email this report", or gives an email address. If no recipient is provided, sends to the configured SECURITY_ALERT_EMAIL or ALERT_EMAIL.

Generate a consolidated Talos security report from website scan, CVEs, research, and optional auth-log analysis. By default this ONLY returns the report. Do not email, forward, or send it unless the user explicitly asks for email/send/forward/share, or send_email is true.

Email the latest generated Talos report, or a report by id. Use this only when the user explicitly asks to email, send, forward, or share the report.

Run a Nitro-compatible health check across Talos tools and runtime assumptions. Does not send email unless include_email is explicitly true.

Analyze password strength, entropy, estimated crack time, common issues, and known breach exposure using k-anonymity where configured.

Generate a strong random password.

Compute MD5, SHA-1, SHA-256, or SHA-512 hashes of text.

Decode a JWT header and payload without signature verification.

Look up geolocation, ISP, ASN, reverse DNS, and reputation indicators for an IP address.

Get Talos self-defense status: blocked IPs, attack counts, attack type breakdown, and recent events.

Search Talos built-in security tools by keyword and optional category. Use this before run_security_tool.

Run one of Talos built-in security tools by exact name. Discover names with list_security_tools first. Defensive use only on authorized systems.

Search the local uploaded resource library by keyword and return matching page snippets with citations.

Fetch the full text of one page from a book in the local resource library.

List books and documents available in the local Talos resource library.