Our take
Inactiveno commits in over a year- Activity
- 20
- Community
- 63
- Issues
- 21
- Pull requests
- 21
Arsenal is a focused terminal helper for pentest command recall, but its lack of recent development means adoption should include a compatibility check and a plan for maintaining it.
Good fit if
- You are a penetration tester who wants to search and launch command templates from a terminal.
- Your workflow benefits from reusable variables, custom cheatsheets, or tmux pane integration.
- GPL-3.0 licensing works for your intended use, and you can validate the project in your environment.
Look elsewhere if
- You need an actively maintained tool: the repository is marked inactive, with no commits or releases in over a year.
- You need a pentest engine that performs scanning or exploitation rather than a command inventory and launcher.
- Your environment blocks terminal input injection, since the README documents a TIOCSTI-related failure and a system-level workaround.
All health signals
| Last commit | 2024-11-29 (1.9 years ago) |
|---|---|
| Commits, last 90 days | 0 |
| Releases, last 12 months | 0 |
| Contributors | 29 (top contributor: 48% of commits) |
| Issues closed, last 90 days | 0 |
| Pull requests merged, last 90 days | 0 |
| Project age | 6 years |
Checked on 2026-11-04 with the GitHub API.
Overview
Arsenal is a Python command-line inventory, reminder, and launcher for penetration testers. It addresses the friction of remembering and retyping complex pentest commands: search its cheatsheets, select a command, fill in arguments, and Arsenal sends the result to the terminal as user input so it works across shells and appears in command history.
It is designed for terminal-based workflows rather than as a scanner or exploitation engine. Global variables can fill recurring values such as a target IP across commands, and optional tmux modes send commands to another pane. The project is inactive, so teams should assess its current compatibility before relying on it.
Key Features
- Search pentest command cheatsheets and launch a selected command in the terminal.
- Fill command arguments interactively, including cheatsheet-defined defaults.
- Set global variables such as
ipfor reuse across commands. - Read Markdown and reStructuredText cheatsheets, with YAML support noted among the project features.
- Add personal cheatsheets from local directories, including
my_cheatsor~/.cheats. - Send generated commands to another tmux pane, with an option to execute them directly there.
- Prefix generated commands, for example with
proxychains -q.
Use Cases
- A penetration tester wants a searchable reminder for tool syntax during an engagement instead of keeping command fragments in separate notes.
- A tester repeatedly uses the same target values and wants to substitute a shared variable into relevant commands.
- A terminal-focused operator wants to select commands in Arsenal while keeping work visible in a separate tmux pane.
- A security team wants to maintain its own Markdown or reStructuredText command sheets alongside the included pentest references.
What you need
Detected in the repository
- Python (from pyproject.toml)
- Automated checks on GitHub Actions
License in plain words
GPL-3.0strong copyleft
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license notice
- Share your changes: yes, the full source of anything you distribute that includes it, under the GPL
- Includes an explicit patent grant from the contributors:
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
Install from PyPI and launch:
python3 -m pip install arsenal-cli
arsenal
See the README for manual and Arch Linux installation, tmux options, and cheatsheet configuration.
Considerations
Arsenal emulates terminal input to place commands into the active shell. The README describes a TIOCSTI-related error on some systems and suggests changing a kernel setting, including a persistent system configuration change; review that workaround carefully before using it. The project has had no commits or releases in over a year, although its contributor base is not concentrated in a single person. Python is the stated runtime, and the supplied requirements data reports no test suite. GPL-3.0 terms should also be reviewed for the way you plan to use or distribute the software.
Found this useful?
Share it with someone who would like arsenal.