Guide · v1.0

Documentation

Everything you need to run the released Cobra Systems toolkit on Windows, Linux, and ChromeOS.

Introduction

Cobra Systems builds PC-first security tools that run locally on your machine. The full toolkit is now released: CobraVault protects credentials, CobraShield protects endpoints, CobraAudit checks configurations, CobraBreach helps investigate exposure, CobraSweep automates scans, and CobraWatch monitors security signals.

All six tools are free and open source — grab them from GitHub. More tools will be coming later.

Install

The released toolkit is six pure-Python projects. Clone the repository you need, then follow its README and the command guides below.

install

# CobraVault (requires Python 3.10+ and the cryptography package)
$ git clone https://github.com/CobraSystems-LLC/CobraVault
$ python3 -m pip install cryptography

# CobraShield (pure stdlib — zero dependencies)
$ git clone https://github.com/CobraSystems-LLC/CobraShield

Quickstart

Run your first security check with either product.

# Open the CobraVault password manager
$ python3 cobravault.py

# The encrypted vault is stored next to the script as vault.enc

# Launch the CobraShield Protection Center (opens in your browser)
$ python cobra_shield_ui.py

# Headless CLI scan — ideal for Chromebooks
$ python cobra_shield_ui.py --cli --quick

Troubleshooting

Both tools fail loudly and tell you what to fix. A typical example:

tool output

[!] cryptography is not installed. Run: python3 -m pip install cryptography

Issue	Message
Missing dependency	Install it with `python3 -m pip install cryptography` (CobraVault only).
Command not found	Run the script with `python3` from inside the cloned repo folder.
Browser didn't open	Start CobraShield with `--cli`, or open the local URL it prints.
Blocked paths during a scan	Check the scan report's access-tracking section for skipped locations.

CobraVault

RUNpython3 cobravault.py

Single-file offline password manager. Opens the interactive vault UI and stores your encrypted data in vault.enc next to the script — nothing ever leaves your machine.

Requirement	Detail
Python	3.10 or newer.
Dependency	`cryptography` — install with `python3 -m pip install cryptography`.
Vault file	Encrypted `vault.enc`, created automatically on first run.

cobravault

python3 cobravault.py --generate-password --length 24
Generated password: fj8K!9kL#2tZx1P5wQ7mN3vB

CobraVault options

FLAGScobravault.py

Useful command-line options for scripting and quick password generation.

Option	Type	Description
--vault	path	Use a different encrypted vault file, e.g. `--vault /path/to/vault.enc`.
--clipboard-timeout	seconds	Change the clipboard auto-clear timer, e.g. `--clipboard-timeout 60`.
--generate-password	flag	Print a generated password without opening the interactive vault UI.
--length	number	Length of the generated password, e.g. `--length 24`.
--no-symbols	flag	Generate a password without punctuation.

--generate-password works without cryptography; the full vault UI requires it.

CobraShield

RUNpython cobra_shield_ui.py

Desktop antivirus that serves its Protection Center UI locally and opens it in your browser — no display server, Qt, or WebKit required. Works identically on Windows, Linux, and ChromeOS (Crostini).

Page	What it does
Overview	Device-health ring, stat cards, and the live protection timeline.
Threats	Smart/full scans, auto-actions, per-detection quarantine/delete/safe, and the allowlist manager.
Vault	Restore or permanently destroy quarantined files.
Live Guard	Honeyfile tripwires and real-time file interception with an activity log.
System	Scheduled scans, signature packs, and startup/extension/network/process audits.

Option	Description
--no-browser	Don't auto-open a browser tab.
--port	Serve the UI on a fixed port, e.g. `--port 8080`.

CobraShield CLI

RUNpython cobra_shield_ui.py --cli

Headless mode — ideal for Chromebooks and displayless terminals. CobraShield also falls back to CLI mode automatically when no display is available.

cli mode

# Full scan in the terminal
$ python cobra_shield_ui.py --cli

# Quick scan of high-traffic user folders only
$ python cobra_shield_ui.py --cli --quick

# Automatically handle detections
$ python cobra_shield_ui.py --cli --auto-quarantine
$ python cobra_shield_ui.py --cli --auto-delete  # destructive: deletes without prompting

CobraShield features

PROTECTIONfull-system

Highlights of the detection and protection stack:

Feature	Description
Quarantine Vault	Isolates detected threats into a neutralized read-only vault — restore or destroy them later.
Entropy Radar	Heuristic engine that flags high-entropy packed payloads and double-extension masquerades like `invoice.pdf.exe`.
Honeyfile Tripwires	Plants decoy password/wallet files; any modification or deletion raises an instant ransomware alarm.
Live Guard	Real-time interception — every new or changed file in watched folders is scanned the moment it lands.
Signature packs	Drop `.txt` signature lists into `~/.cobrashield/signatures/` to load community feeds or custom IOCs.
System audits	Startup persistence, browser extension permissions, network connections, and suspicious process heuristics.
Reports & history	Shareable dark-themed HTML threat reports plus a persistent JSON timeline of scans and detections.
Allowlist	Mark known-safe files by SHA-256 or path so they're never flagged again.

CobraAudit

RUNpython3 cobraaudit.py

Read-only security posture audit for Linux, ChromeOS, and Windows. It ranks findings and grades the machine without modifying anything.

cobraaudit

python3 cobraaudit.py
python3 cobraaudit.py --list-checks
python3 cobraaudit.py --only sshd-config,accounts,sudo-nopasswd
python3 cobraaudit.py --json audit.json --html audit.html

Use sudo for full coverage. Exit code 1 means high or critical findings are present.

CobraBreach

RUNpython3 cobrabreach.py

Check passwords with HIBP k-anonymity, use a local hash list offline, batch-check files, or look up an email with an HIBP API key.

cobrabreach

python3 cobrabreach.py password
python3 cobrabreach.py password --local-db pwned-passwords-sha1.txt
python3 cobrabreach.py batch passwords.txt --yes
HIBP_API_KEY=YOUR_KEY python3 cobrabreach.py email alice@example.com
python3 cobrabreach.py password --json report.json

Passwords never leave the machine; online checks send only the first five SHA-1 characters. Exit code 1 means a breach was found.

CobraSweep

RUNpython3 cobrasweep.py

Privacy sweep and secure deletion utility. Dry run is the default; destructive operations require explicit flags and confirmation.

cobrasweep

python3 cobrasweep.py list
python3 cobrasweep.py sweep
python3 cobrasweep.py sweep --execute
python3 cobrasweep.py sweep --execute --shred
python3 cobrasweep.py shred secret.docx --yes

Read the dry-run report before using --execute. Physical erasure cannot be guaranteed on SSDs or cloud-synced folders.

CobraWatch

RUNpython3 cobrawatch.py

Snapshot processes, listening ports, and persistence entries, then compare later snapshots to find security drift.

cobrawatch

python3 cobrawatch.py snapshot
python3 cobrawatch.py diff
python3 cobrawatch.py diff --json drift-report.json
python3 cobrawatch.py show

New listeners are high severity, new persistence entries are medium, and process churn is low. Diff exits 1 when drift is detected.

The released toolkit

Every current Cobra Systems tool is available now. Each project is free, open source, and designed to run locally with a small footprint.

Tool	Purpose	Repository
CobraVault	Offline encrypted password management.	GitHub
CobraShield	Desktop antivirus and endpoint protection.	GitHub
CobraAudit	Security auditing and configuration checks.	GitHub
CobraBreach	Breach-awareness and exposure investigation.	GitHub
CobraSweep	Fast automated security sweep workflows.	GitHub
CobraWatch	Lightweight monitoring for security signals.	GitHub

All current tools have been released. More tools will be coming later.

Ready to secure your PC?

Clone either repo and run your first check in under a minute.

Get the tools See pricing