Safety

Feintkit exists to be detected. If an artifact would cause harm when pointed at a real target, it does not go in the suite.

What it never does

• No real payloads. No functional malicious code of any kind. Where an attack involves running a command, the suite prints a "would run" line and never starts a process with it.
• No real code execution. Scenarios do not execute attacker-supplied code.
• No real credential access or exfiltration. Scenarios use obviously fake decoys and never read real credentials, keys, tokens or personal files.
• No non-loopback network traffic. Network use is a listener or request on 127.0.0.1; the harness refuses any other host.
• No persistence, no evasion, no exploit code, nothing that attacks a third party. These are the seven capabilities the project's non-goals page says will never be added, not even behind a flag or in an "advanced" edition.

The two maintenance tools, the installer (downloads a release file from an https address you give it) and the fact re-check tool (reads public documentation pages), act only when a person runs them.

The benign marker

Every artifact carries a marker so it is trivially identifiable and searchable:

FEINTKIT::<scenario id>::<run id>::DEFENSIVE-TEST-ONLY

The run id is 8 lowercase hexadecimal characters, or RUN0000 with --deterministic. The only instruction a scenario places in front of an agent asks it to emit a harmless acknowledgement token.

How the rules are enforced

• A static safety linter (feintkit-guard) scans package and scenario sources, tests included: no process spawn, no non-loopback network, no direct file writes in scenarios. It is a fail-closed tripwire, not a sandbox.
• A litmus table records, for every scenario and package, why it is harmless, which guard rule and test enforce that, and what effect remains on a real target.
• Documentation: a README safety banner, an Apache-2.0 license, and a NOTICE with the defensive-testing notice in every scenario.

These are design goals that the project checks with automated tests. They are not a guarantee.

What it does do

Running the suite is ordinary software execution on your machine. A scenario may show a desktop notification, write marker files under the output folder you choose, bind fixed loopback ports (47100 to 47799 by category) and use processor time. Read what you run and try it first in a disposable environment such as a virtual machine, with tools that can reach real data disconnected.

Responsible use

Test only systems, accounts, agents and products that you own or have explicit permission to test. Read Responsible use and the disclaimer in full.