Skip to content
NotHolyDocs

Chat

Knowledge base

A curated, licensed security knowledge base the models read on their own, with a source and licence on every citation.

View as Markdown

The chat has a built-in security knowledge base. It is part of the models, not a switch you turn on: the model searches it when a question calls for testing methodology, a technique or payload, a tool's options, a weakness or attack pattern, or incident-response guidance.

Every passage keeps the licence and attribution of its source, and the evidence panel shows them next to the quote. The sources are picked by hand and refreshed on their own schedule, so answers point at something you can open and check.

What is in it

  • Web, API and mobile testing from OWASP (WSTG, Cheat Sheet Series, ASVS, API Security Top 10, MASTG and MASVS)
  • Offensive technique from PayloadsAllTheThings, GTFOBins and LOLBAS
  • MITRE ATT&CK, CWE and CAPEC, with the copyright notice MITRE requires
  • Tool documentation for Caido, Burp BChecks and Bambdas, nmap NSE, sqlmap and ffuf
  • Incident response and framework guidance from NIST and advisories from CISA

Sources are added over time. A source goes in only when its licence allows it and it carries attribution.

Using it elsewhere

The same search is available through the API and the CLI, so your own tools can read it:

  • GET /v1/kb/search — search the base
  • GET /v1/kb/{id} — read one document, paginated by section
  • notholy kb "ssrf prevention" and notholy kb read <id> in the CLI
  • The kb_search and kb_read tools over MCP

See the Research API for the request and response shapes.

Next