tool.json

{
  "schemaVersion": 1,
  "name": "tui-secure",
  "binary": "tui-secure",
  "tagline": "The machine's security posture, with the command behind every verdict",
  "description": "A terminal UI for the security posture of one Linux machine. Eight probes — Secure Boot, the MAC layer, the firewall, sshd, pending updates, accounts, kernel hardening and listening ports — each answered `ok`, `warn`, `bad` or `unknown`, with a score across the lot.\n\nEvery verdict shows its work. Open a probe and you get the exact command that was run, the line it judged, the full raw output underneath, and a fix that names either the sibling tool that owns the change (`tui-firewall`, `tui-update`) or the command to run yourself.\n\nIt reads first and asks second. Nothing escalates beyond `sudo -n`, which never prompts, so a probe that needs root it cannot get degrades to `unknown` with the reason instead of hanging on a password. The fixes it offers are the one-liners it can preview in full: turning on ufw, firewalld or nftables, setting one kernel key or one sshd keyword through a drop-in, enabling the update timer, stopping the service behind an open port. A change that would leave nothing able to log in over ssh is refused.\n\nRun `tui-secure --demo` to drive a sample machine: every key works, every command is built and previewed for real, and nothing touches your system.",
  "category": "security",
  "homepage": "https://github.com/tui-tools/tui-secure",
  "repo": "https://github.com/tui-tools/tui-secure",
  "license": "MIT",
  "platforms": [
    "linux/amd64",
    "linux/arm64"
  ],
  "icon": "assets/icon.svg",
  "logo": "assets/logo.png",
  "screenshots": [
    {
      "path": "docs/screenshots/tui-secure-main.png",
      "caption": "The posture: one row per probe, its verdict, and the score across all of them"
    },
    {
      "path": "docs/screenshots/tui-secure-ssh.png",
      "caption": "The sshd probe in full: the settings it judged, the command it read them with, and the raw output"
    },
    {
      "path": "docs/screenshots/tui-secure-updates.png",
      "caption": "Pending updates, whether a reboot is needed, and the state of the unattended update timer"
    },
    {
      "path": "docs/screenshots/tui-secure-fix.png",
      "caption": "A fix, previewed: setting one kernel hardening key and the drop-in that makes it persist"
    },
    {
      "path": "docs/screenshots/tui-secure-filter.png",
      "caption": "Filtering the probes by name, verdict or summary"
    },
    {
      "path": "docs/screenshots/tui-secure-help.png",
      "caption": "The help screen, generated from the same key table as the hint bar"
    }
  ],
  "keys": [
    {
      "key": "enter",
      "action": "Open the probe: evidence, raw output and the fix"
    },
    {
      "key": "a",
      "action": "Apply an offered fix, previewed and confirmed first"
    },
    {
      "key": "r",
      "action": "Re-run every probe"
    },
    {
      "key": "R",
      "action": "Re-run the selected probe"
    },
    {
      "key": "/",
      "action": "Filter the probes by name, verdict or summary"
    },
    {
      "key": "?",
      "action": "Help"
    },
    {
      "key": "q",
      "action": "Quit"
    }
  ],
  "backends": [
    {
      "name": "systemd",
      "binary": "systemctl",
      "versionCommand": [
        "systemctl",
        "--version"
      ],
      "versionRegex": "systemd ([0-9]+)",
      "minimum": "245",
      "searchPaths": [
        "/usr/bin/systemctl",
        "/bin/systemctl"
      ],
      "features": [
        {
          "name": "journal-grep",
          "since": "246"
        }
      ],
      "notes": [
        {
          "range": "<246",
          "impact": "`journalctl --grep` does not exist, so the denial and failed-login counts are read by filtering the journal here instead of in journalctl, which is slower on a large journal"
        }
      ],
      "tested": [
        "255",
        "257",
        "259",
        "261"
      ]
    },
    {
      "name": "openssh",
      "binary": "sshd",
      "versionCommand": [
        "ssh",
        "-V"
      ],
      "versionRegex": "OpenSSH_([0-9]+\\.[0-9]+)",
      "minimum": "8.2",
      "searchPaths": [
        "/usr/bin/ssh",
        "/bin/ssh"
      ],
      "features": [
        {
          "name": "sshd-test-config",
          "since": "8.2"
        }
      ],
      "notes": [
        {
          "range": "<8.2",
          "impact": "`sshd -T` predates several of the keywords this probe reads, so the settings come from parsing sshd_config and its drop-ins instead, which does not resolve Match blocks"
        }
      ],
      "tested": [
        "9.6",
        "9.9",
        "10.2",
        "10.5"
      ]
    },
    {
      "name": "ufw",
      "binary": "ufw",
      "versionCommand": [
        "ufw",
        "--version"
      ],
      "versionRegex": "ufw ([0-9][0-9.]*)",
      "minimum": "0.36",
      "searchPaths": [
        "/usr/sbin/ufw",
        "/sbin/ufw"
      ],
      "notes": [
        {
          "range": "<0.36",
          "impact": "`ufw status verbose` prints no default policy line, so the incoming and outgoing policies are reported as unknown and only the active state is judged"
        }
      ],
      "tested": [
        "0.36.2"
      ]
    },
    {
      "name": "firewalld",
      "binary": "firewall-cmd",
      "versionCommand": [
        "firewall-cmd",
        "--version"
      ],
      "minimum": "0.9",
      "searchPaths": [
        "/usr/bin/firewall-cmd",
        "/bin/firewall-cmd"
      ],
      "tested": [
        "2.3.2",
        "2.4.4"
      ]
    },
    {
      "name": "sbctl",
      "binary": "sbctl",
      "versionCommand": [
        "sbctl",
        "version"
      ],
      "versionRegex": "([0-9]+\\.[0-9]+(\\.[0-9]+)?)",
      "searchPaths": [
        "/usr/bin/sbctl",
        "/bin/sbctl"
      ],
      "notes": [
        {
          "range": ">=0.1",
          "impact": "sbctl is optional: without it the Secure Boot probe reports what `bootctl status` knows and says nothing about enrolled keys or signed files"
        }
      ],
      "tested": []
    }
  ],
  "install": {
    "repo_url": "https://pkgs.tui.tools",
    "pacman": {
      "available": true,
      "package": "tui-secure",
      "repo": "tui-tools",
      "requires_repo_setup": true,
      "command": "sudo pacman -S tui-secure",
      "url": "https://pkgs.tui.tools/arch",
      "note": "Upgrades then arrive with the rest of your system updates."
    },
    "aur": {
      "available": false,
      "package": "tui-secure-bin",
      "repo": "aur",
      "command": "paru -S tui-secure-bin",
      "url": "https://aur.archlinux.org/packages/tui-secure-bin",
      "note": "The -bin package installs the released static binary."
    },
    "apt": {
      "available": true,
      "package": "tui-secure",
      "repo": "tui-tools",
      "requires_repo_setup": true,
      "command": "sudo apt install tui-secure",
      "url": "https://pkgs.tui.tools/deb",
      "note": "Upgrades then arrive with the rest of your system updates."
    },
    "dnf": {
      "available": true,
      "package": "tui-secure",
      "repo": "tui-tools",
      "requires_repo_setup": true,
      "command": "sudo dnf install tui-secure",
      "url": "https://pkgs.tui.tools/rpm",
      "note": "Upgrades then arrive with the rest of your system updates."
    },
    "zypper": {
      "available": false,
      "package": "tui-secure",
      "repo": "tui-tools",
      "requires_repo_setup": true,
      "command": "sudo zypper install tui-secure",
      "url": "https://pkgs.tui.tools/rpm",
      "note": "The rpm repository is shared with dnf; zypper support is not tested yet."
    },
    "binary": {
      "available": true,
      "pattern": "tui-secure_{version}_linux_{arch}.tar.gz",
      "command": "curl -fsSL https://github.com/tui-tools/tui-secure/releases/download/v{version}/tui-secure_{version}_linux_{arch}.tar.gz | tar -xz tui-secure\nsudo install -m0755 tui-secure /usr/local/bin/tui-secure",
      "url": "https://github.com/tui-tools/tui-secure/releases",
      "note": "One static binary. Verify it against checksums.txt from the same release."
    },
    "source": {
      "available": true,
      "command": "git clone https://github.com/tui-tools/tui-secure\ncd tui-secure && make build\nsudo install -m0755 bin/tui-secure /usr/local/bin/tui-secure",
      "url": "https://github.com/tui-tools/tui-secure",
      "note": "Needs Go 1.27 or newer."
    }
  },
  "security": {
    "needs_sudo": "Most probes read unprivileged. Escalation is `sudo -n`, which never prompts: it covers the reads only root can do (`ufw status`, `sshd -T`, /etc/shadow, `sudo -l`, the nftables ruleset) and the offered fixes. A probe that cannot escalate reports unknown with the reason.",
    "preview_before_run": true,
    "no_daemon": true,
    "no_network": false,
    "no_network_note": "The update probe runs the distribution's own update check (`checkupdates`, `apt-get -s upgrade`, `dnf check-update`), which contacts the configured package repositories. tui-secure itself opens no connection.",
    "static_binary": true,
    "signed_releases": true,
    "config_paths": [
      "/etc/tui-secure/config.toml",
      "~/.config/tui-secure/config.toml"
    ]
  },
  "maintainers": [
    {
      "name": "Edimar Cardoso",
      "github": "edimarlnx"
    }
  ],
  "since": "2026-08-30",
  "keywords": [
    "security",
    "hardening",
    "posture",
    "secure-boot",
    "selinux",
    "apparmor",
    "firewall",
    "sshd",
    "updates",
    "sysctl",
    "tui",
    "bubbletea",
    "ssh-hardening"
  ]
}