Instructions to use random1st/secguard-models with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Notebooks
Google Colab
Kaggle
Local Apps Settings

How to use random1st/secguard-models with llama.cpp:

Install (macOS, Linux)

curl -LsSf https://llama.app/install.sh | sh
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf random1st/secguard-models
# Run inference directly in the terminal:
llama cli -hf random1st/secguard-models

Install from WinGet (Windows)

winget install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf random1st/secguard-models
# Run inference directly in the terminal:
llama cli -hf random1st/secguard-models

Use pre-built binary

# Download pre-built binary from:
# https://github.com/ggerganov/llama.cpp/releases
# Start a local OpenAI-compatible server with a web UI:
./llama-server -hf random1st/secguard-models
# Run inference directly in the terminal:
./llama-cli -hf random1st/secguard-models

Build from source code

git clone https://github.com/ggerganov/llama.cpp.git
cd llama.cpp
cmake -B build
cmake --build build -j --target llama-server llama-cli
# Start a local OpenAI-compatible server with a web UI:
./build/bin/llama-server -hf random1st/secguard-models
# Run inference directly in the terminal:
./build/bin/llama-cli -hf random1st/secguard-models

Use Docker

docker model run hf.co/random1st/secguard-models

LM Studio
Jan
Ollama
How to use random1st/secguard-models with Ollama:
```
ollama run hf.co/random1st/secguard-models
```

Unsloth Studio

How to use random1st/secguard-models with Unsloth Studio:

Install Unsloth Studio (macOS, Linux, WSL)

curl -fsSL https://unsloth.ai/install.sh | sh
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for random1st/secguard-models to start chatting

Install Unsloth Studio (Windows)

irm https://unsloth.ai/install.ps1 | iex
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for random1st/secguard-models to start chatting

Using HuggingFace Spaces for Unsloth

# No setup required
# Open https://huggingface.co/spaces/unsloth/studio in your browser
# Search for random1st/secguard-models to start chatting

How to use random1st/secguard-models with Pi:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf random1st/secguard-models

Configure the model in Pi

# Install Pi:
npm install -g @mariozechner/pi-coding-agent
# Add to ~/.pi/agent/models.json:
{
  "providers": {
    "llama-cpp": {
      "baseUrl": "http://localhost:8080/v1",
      "api": "openai-completions",
      "apiKey": "none",
      "models": [
        {
          "id": "random1st/secguard-models"
        }
      ]
    }
  }
}

Run Pi

# Start Pi in your project directory:
pi

OpenClaw new

How to use random1st/secguard-models with OpenClaw:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf random1st/secguard-models

Configure OpenClaw

# Install OpenClaw:
npm install -g openclaw@latest
# Register the local server and set it as the default model:
openclaw onboard --non-interactive --mode local \
  --auth-choice custom-api-key \
  --custom-base-url http://127.0.0.1:8080/v1 \
  --custom-model-id "random1st/secguard-models" \
  --custom-provider-id llama-cpp \
  --custom-compatibility openai \
  --custom-text-input \
  --accept-risk \
  --skip-health

Run OpenClaw

openclaw agent --local --agent main --message "Hello from Hugging Face"

Docker Model Runner
How to use random1st/secguard-models with Docker Model Runner:
```
docker model run hf.co/random1st/secguard-models
```

Lemonade

How to use random1st/secguard-models with Lemonade:

Pull the model

# Download Lemonade from https://lemonade-server.ai/
lemonade pull random1st/secguard-models

Run and chat with the model

lemonade run user.secguard-models-{{QUANT_TAG}}

List all available models

lemonade list

Hermes Agent

How to use random1st/secguard-models with Hermes Agent:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf random1st/secguard-models

Configure Hermes

# Install Hermes:
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
hermes setup
# Point Hermes at the local server:
hermes config set model.provider custom
hermes config set model.base_url http://127.0.0.1:8080/v1
hermes config set model.default random1st/secguard-models

Run Hermes

hermes

Atomic Chat

random1st commited on Apr 18

Commit

4f88278

verified ·

1 Parent(s): 96c7493

Update model card: Qwen3-0.6B fine-tuned v2

Browse files

Files changed (1) hide show

README.md +60 -11

README.md CHANGED Viewed

@@ -1,25 +1,74 @@
 ---
-license: other
-license_name: apache-2.0-commons-clause
-license_link: https://github.com/diana-random1st/secguard/blob/main/LICENSE
 ---
-# secguard-models
-GGUF models for [secguard](https://github.com/diana-random1st/secguard) — 3-level security toolkit for AI agents.
-## Models
-| File | Size | Purpose |
-|------|------|---------|
-| secguard-guard.gguf | 774MB | Destructive command classifier (Qwen3.5-2B-Q8) |
-## Install
 ```bash
 secguard model
 ```
 ## License
-Apache 2.0 + Commons Clause. See [LICENSE](https://github.com/diana-random1st/secguard/blob/main/LICENSE).

 ---
+language: en
+license: apache-2.0
+tags:
+  - security
+  - shell-commands
+  - safety-classifier
+  - gguf
+  - qwen3
+datasets:
+  - ML4Net/SSH-Shell-Attacks
+  - TellinaTool/nl2bash
+pipeline_tag: text-classification
 ---
+# secguard-guard — Shell Command Safety Classifier
+Binary classifier for shell commands: **safe** vs **destructive**.
+## Model Details
+| Property | Value |
+|----------|-------|
+| Base model | [Qwen/Qwen3-0.6B](https://huggingface.co/Qwen/Qwen3-0.6B) |
+| Fine-tuning | LoRA (rank 8, 1.4M trainable params / 596M total) |
+| Quantization | Q8_0 (GGUF) |
+| Size | 610 MB |
+| Context | 512 tokens |
+| Inference | llama.cpp / llama-cpp-rs |
+## Training
+- **Dataset**: 21,430 labeled examples (balanced 50/50)
+  - **Destructive** (10,715): SSH-Shell-Attacks honeypot commands (ML4Net, 408K sessions) + synthetic SaaS CLI patterns
+  - **Safe** (10,715): NL2Bash corpus (12.6K real admin commands) + synthetic dev/ops commands
+- **Method**: MLX LoRA, 8 layers, batch 4, lr 1e-4, 750 iterations
+- **Loss**: Train 0.43, Val 0.428 (best checkpoint at iter 400)
+- **Hardware**: Apple Silicon (M-series), ~5 minutes training
+## What it detects
+Commands the model learns to classify as **destructive**:
+- File deletion (`rm -rf`, `find -delete`, `shred`)
+- Git history rewriting (`push --force`, `reset --hard`, `rebase`, `filter-branch`)
+- Database destruction (`DROP TABLE`, `FLUSHALL`, `db.dropDatabase()`)
+- Cloud resource deletion (`aws s3 rm`, `gcloud delete`, `terraform destroy`)
+- Remote code execution (`curl | bash`, `wget | sh`)
+- Container/k8s cleanup (`docker system prune`, `kubectl delete namespace`)
+- SaaS destructive ops (`stripe cancel`, `heroku apps:destroy`)
+## Usage with secguard
+This model is Phase 3 (ML brain) in secguard's three-phase guard:
+1. **Policy allowlist** — known-safe commands (zero latency)
+2. **Heuristic rules** — 40+ regex patterns (zero latency)
+3. **ML brain** — this model (catches what rules miss)
 ```bash
+# Download
 secguard model
+# The model is used automatically when built with --features ml
 ```
+## Limitations
+- Trained on English commands only
+- SSH honeypot data may not represent all attack vectors
+- 0.6B model — may miss nuanced or novel destructive patterns
+- Confidence threshold: 85% (tunable in secguard config)
 ## License
+Apache 2.0