01 Portable rescue shell

When the system has nothing useful left.

AXE is one executable with an interactive shell, Unix tools, host diagnostics, certificate-only SSH and a verified on-demand tool store. Run it on the host you need to inspect.

[ Download AXE ] See the tools

targets: Linux {amd64, arm64}
macOS {arm64}
bundled: 185 commands
on-demand: 52 tools

incident@unknown:/#

root@unknown:/# env -i HOME=/tmp PATH=/nonexistent ./axe --norc --noprofile

bundled registry ready

axe% doctor

Self-exec: works
Degradations: none

axe%

NO PATHNO LOADERNO PACKAGE MANAGERSTILL A SHELL

02 Failure modes

When parts of the host fail

A failed execution route does not take down the shell or disable verification. AXE keeps the capabilities that still work.

SHELL

// No shell

Brush is built in, with interactive Reedline and a minimal backend for scripts and pipes.

interactive shell

PATH

// No coreutils

Bundled applets run without PATH. If the BusyBox-style PATH bridge cannot be published, direct dispatch still works.

local toolbox

PROC

// No procfs

Missing or masked /proc removes one execution route. On Linux, AXE retains its executable descriptor so children can start without procfs.

fd-backed self-exec

EXEC

// Broken filesystem

AXE tries descriptor exec, then a probed private relay and an inode-checked path. Single-file Store tools can run from a sealed memfd.

checked fallback

// Binary deleted

On Linux, a retained descriptor pins the original inode across unlink or replacement, keeping bundled children, workers and SSH sessions launchable.

image continuity

SPAWN

// No child exec

If self-exec fails, child launches fail, but shell builtins, aliases, functions and doctor remain available. AXE does not fall through to PATH.

controlled degradation

NET

// Network gone

Bundled applets stay available. A fresh AXE Store cache keeps working offline.

offline recovery

UID

// No root

Inspection works without root. Operations that require privileges still fail.

unprivileged insight

03 Host inspection

Inspect the host

AXE reports virtualization, containers, sandboxing and restrictions relevant to recovery.

Isolation

Recognizes virtual machines, containers—including Porto—and sandboxed environments.

Restrictions

Surfaces capabilities, seccomp, namespaces and resource boundaries visible to the current process.

Evidence and confidence

Heuristic conclusions include confidence levels and supporting evidence.

axe doctor passive inspection

axe% doctor

Container indicator:: heuristic match — porto (high confidence)
Sandboxing:: heuristic match — bubblewrap (high confidence)
No new privileges:: enabled
Seccomp:: filtering enabled (2 filters)

doctor

Human-readable diagnostics for the current AXE process.

vzik collect

Bounded, structured evidence for incident analysis.

04 One file

No host loader required

The primary Linux release is a static musl ELF executable. It needs no loader, shell or coreutils on the target.

$ file axe

ELF 64-bit LSB executable,
statically linked, stripped

$ readelf -lW axe | grep INTERP

# no output

$ readelf -dW axe | grep NEEDED

# no output

axeELF / EXEC

Remote accesssshd · sftp · relay client

AXE Storesigned · hashed · cached

NO DYNAMIC LOADER REQUIRED

05 Command inventory

Bundled and on-demand tools

Bundled commands work immediately. AXE Store downloads specialist tools into a private, verified cache.

— commands

Available AXE commands
Command	Description	Source	Category
`[`	Evaluate expressions and file predicates	bundled	Administration
`arch`	Print the machine architecture	bundled	Coreutils
`arp`	Inspect and modify the ARP cache	bundled	Network
`awk`	Process text with pattern-action programs	bundled	Text
`b2sum`	Compute and verify BLAKE2 checksums	bundled	Coreutils
`base32`	Encode or decode Base32 data	bundled	Coreutils
`base64`	Encode or decode Base64 data	bundled	Coreutils
`basename`	Strip directory and suffix components from paths	bundled	Coreutils
`basenc`	Encode or decode data with printable base encodings	bundled	Coreutils
`binwalk`	Analyze firmware images and embedded files	store	Security
`blkid`	Inspect block device attributes and filesystem signatures	bundled	Storage
`blockdev`	Inspect and configure block device parameters	bundled	Storage
`bpftool`	Inspect and manage Linux eBPF objects	store	Debugging
`bunzip2`	Compress or decompress bzip2 data	bundled	Compression
`bzcat`	Compress or decompress bzip2 data	bundled	Compression
`bzip2`	Compress or decompress bzip2 data	bundled	Compression
`capsh`	Inspect and modify Linux capability state	store	Security
`cat`	Concatenate files and write them to standard output	bundled	Coreutils
`chgrp`	Change file group ownership	bundled	Administration
`chmod`	Change file permission modes	bundled	Administration
`chown`	Change file owner and group	bundled	Administration
`chroot`	Run a command with a different root directory	bundled	Administration
`cksum`	Compute and verify file checksums	bundled	Coreutils
`clean-tools`	Remove managed AXE Store cache entries	bundled	Control
`cmp`	Compare two files byte by byte	bundled	Text
`comm`	Compare sorted files line by line	bundled	Coreutils
`commands`	List commands available through AXE	bundled	Control
`cp`	Copy files and directories	bundled	Coreutils
`csplit`	Split files at context-defined boundaries	bundled	Coreutils
`curl`	Rock solid HTTP client	store	Network
`cut`	Select fields or byte ranges from input lines	bundled	Coreutils
`date`	Display or set the system date and time	bundled	Coreutils
`dbus-monitor`	Monitor messages on D-Bus buses	store	Debugging
`dd`	Copy and convert raw data streams	bundled	Coreutils
`df`	Report filesystem space usage	bundled	Coreutils
`diff`	Compare files line by line	bundled	Text
`diff3`	Compare three files line by line	bundled	Text
`dir`	List directory contents	bundled	Coreutils
`dircolors`	Generate color settings for directory listings	bundled	Coreutils
`dirname`	Strip the final component from paths	bundled	Coreutils
`dmesg`	Inspect the kernel message buffer	bundled	System
`dnsx`	Resolve and enumerate DNS records	store	Network
`docker`	Manage Docker containers through a remote daemon	store	Containers
`doctor`	Diagnose the current AXE runtime, shell, isolation, and restrictions	bundled	Control
`du`	Estimate file and directory space usage	bundled	Coreutils
`dumpcap`	Capture packets for Wireshark command-line tools	store	Network
`echo`	Write arguments to standard output	bundled	Coreutils
`env`	Inspect or modify the environment for a command	bundled	Coreutils
`expand`	Convert tabs to spaces	bundled	Coreutils
`expr`	Evaluate arithmetic and string expressions	bundled	Coreutils
`factor`	Print prime factors of integers	bundled	Coreutils
`false`	Return an unsuccessful exit status	bundled	Coreutils
`fd`	Find filesystem entries by name and attributes	store	Search
`ffuf`	Fuzz web application paths and parameters	store	Security
`file`	Identify file formats from their contents	bundled	Binary
`find`	Search directory trees and apply predicates	bundled	Filesystem
`findmnt`	Find and describe mounted filesystems	store	Containers
`fmt`	Reformat text paragraphs	bundled	Coreutils
`fold`	Wrap input lines to a specified width	bundled	Coreutils
`free`	Report system memory usage	bundled	Process
`fzf`	Filter and select items interactively with fuzzy matching	store	Search
`gdb`	Debug native programs and inspect process state	store	Debugging
`gdbserver`	Expose native programs to a remote GDB debugger	store	Debugging
`getcap`	Print Linux file capabilities	store	Security
`getpcaps`	Print Linux process capabilities	store	Security
`goblin`	Inspect ELF, PE, Mach-O, and archive binaries	bundled	Binary
`gobuster`	Enumerate web paths, DNS names, and virtual hosts	store	Security
`grep`	Search text for matching patterns	bundled	Text
`groups`	Print group memberships	bundled	Administration
`grpcurl`	Call and inspect gRPC services	store	Network
`gzip`	Compress or decompress gzip data	bundled	Compression
`head`	Print the beginning of files	bundled	Coreutils
`hexdump`	Display file contents in hexadecimal and other formats	bundled	System
`host`	Resolve DNS names and addresses	bundled	Network
`hostid`	Print the numeric host identifier	bundled	Administration
`hostname`	Display or set the system hostname	bundled	Coreutils
`http`	Make bounded HTTP requests with structured output	bundled	Network
`httpx`	Probe HTTP services and identify live web targets	store	Network
`hugetop`	Report huge page usage by process	bundled	Process
`id`	Print user and group identifiers	bundled	Administration
`ifconfig`	Inspect and configure network interfaces	bundled	Network
`inotifywait`	Wait for filesystem events	bundled	Filesystem
`inotifywatch`	Collect filesystem event statistics	bundled	Filesystem
`install`	Copy files while setting attributes	bundled	Administration
`iostat`	Report CPU and device I/O statistics	bundled	Inspection
`ip`	Inspect and configure Linux networking	bundled	Network
`ipaddr`	Inspect and configure network addresses	bundled	Network
`ipcalc`	Calculate IPv4 and IPv6 network parameters	bundled	Network
`ipcs`	Report System V IPC resources	bundled	Inspection
`iplink`	Inspect and configure network links	bundled	Network
`ipneigh`	Inspect and configure neighbor tables	bundled	Network
`iproute`	Inspect and configure network routes	bundled	Network
`iprule`	Inspect and configure routing policy rules	bundled	Network
`join`	Join lines from files on a common field	bundled	Coreutils
`jq`	Process and transform JSON data	bundled	Data
`kill`	Send signals to processes	bundled	Administration
`kubectl`	Manage Kubernetes clusters from the command line	store	Containers
`last`	Show recent login sessions	bundled	System
`link`	Create a hard link to a file	bundled	Coreutils
`ln`	Create hard or symbolic links	bundled	Coreutils
`logname`	Print the current login name	bundled	Administration
`ls`	List directory contents	bundled	Coreutils
`lsmod`	List loaded Linux kernel modules	bundled	Inspection
`lsns`	List Linux namespaces and their member processes	store	Containers
`lsof`	List open files and their owning processes	bundled	Inspection
`lspci`	List PCI devices	bundled	Inspection
`lsscsi`	List SCSI devices	bundled	Inspection
`lsusb`	List USB devices	bundled	Inspection
`ltrace`	Trace Linux library calls	store	Debugging
`masscan`	Scan large networks for open ports at high speed	store	Network
`md5sum`	Compute and verify MD5 checksums	bundled	Coreutils
`mkdir`	Create directories	bundled	Coreutils
`mkfifo`	Create named pipes	bundled	Administration
`mknod`	Create block, character, or FIFO special files	bundled	Administration
`mktemp`	Create temporary files or directories	bundled	Coreutils
`modinfo`	Display Linux kernel module information	bundled	Inspection
`more`	Page through text one screen at a time	bundled	Coreutils
`mount`	Inspect mounts or mount filesystems read-only	bundled	Storage
`mountpoint`	Check whether a path is a mount point	bundled	System
`mv`	Move or rename files and directories	bundled	Coreutils
`naabu`	Scan hosts for open ports	store	Network
`ncat`	Connect, listen, redirect, and proxy network traffic	store	Network
`nice`	Run a command with adjusted scheduling priority	bundled	Administration
`nl`	Number lines from input files	bundled	Coreutils
`nmap`	Discover hosts and audit network services with NSE scripting	store	Network
`nohup`	Run a command immune to hangups	bundled	Administration
`nproc`	Print the number of available processing units	bundled	Coreutils
`nsenter`	Run a program in another process's Linux namespaces	store	Containers
`nslookup`	Query DNS name servers	bundled	Network
`nuclei`	Scan targets for known vulnerabilities using bundled templates	store	Security
`numfmt`	Convert numbers to and from human-readable units	bundled	Coreutils
`od`	Dump file contents in octal and other formats	bundled	Coreutils
`openssl`	Inspect certificates and perform cryptographic operations	store	Security
`paste`	Merge corresponding lines from files	bundled	Coreutils
`pathchk`	Check pathnames for portability and validity	bundled	Administration
`pgrep`	Find process IDs by name and attributes	bundled	Process
`pidof`	Find process IDs by executable name	bundled	Process
`pidwait`	Wait for selected processes to exit	bundled	Process
`ping`	Test network reachability with ICMP echo requests	bundled	Network
`ping6`	Test network reachability with ICMP echo requests	bundled	Network
`pinky`	Print concise user login information	bundled	Administration
`pkill`	Send signals to processes selected by name	bundled	Process
`pmap`	Report process memory maps	bundled	Process
`podman`	Manage Podman through its remote service	store	Containers
`pr`	Paginate or columnate files for printing	bundled	Coreutils
`printenv`	Print environment variables	bundled	Coreutils
`printf`	Format and write data	bundled	Coreutils
`ps`	Report process status	bundled	Process
`pspy`	Monitor Linux processes without root permissions	store	Debugging
`ptx`	Produce a permuted index of file contents	bundled	Coreutils
`pwd`	Print the current working directory	bundled	Coreutils
`pwdx`	Report process working directories	bundled	Process
`python`	Static Python with HTTP, WebSocket, and HTML libraries	store	Runtime
`readlink`	Print resolved symbolic link targets	bundled	Coreutils
`realpath`	Resolve paths to canonical absolute form	bundled	Coreutils
`refresh-tools`	Refresh and verify AXE Store metadata	bundled	Control
`rg`	Search file contents with regular expressions	store	Search
`rm`	Remove files and directories	bundled	Coreutils
`rmdir`	Remove empty directories	bundled	Coreutils
`rsync`	Synchronize files efficiently between local and remote paths	store	Network
`scp`	Copy files securely between hosts with OpenSSH	store	Network
`sed`	Transform text streams with editing expressions	bundled	Text
`seq`	Print numeric sequences	bundled	Coreutils
`setcap`	Set Linux file capabilities	store	Security
`sftp`	Transfer files through OpenSSH SFTP	store	Network
`sha1sum`	Compute and verify SHA-1 checksums	bundled	Coreutils
`sha224sum`	Compute and verify SHA-224 checksums	bundled	Coreutils
`sha256sum`	Compute and verify SHA-256 checksums	bundled	Coreutils
`sha384sum`	Compute and verify SHA-384 checksums	bundled	Coreutils
`sha512sum`	Compute and verify SHA-512 checksums	bundled	Coreutils
`shred`	Overwrite files to obscure their contents	bundled	Coreutils
`shuf`	Randomly permute input lines	bundled	Coreutils
`skill`	Send signals to processes selected interactively	bundled	Process
`slabtop`	Display Linux kernel slab cache usage	bundled	Process
`sleep`	Delay execution for a duration	bundled	Coreutils
`snice`	Adjust scheduling priority for selected processes	bundled	Process
`socat`	Relay bidirectional data between sockets and streams	store	Network
`sort`	Sort lines of text	bundled	Coreutils
`split`	Split files into pieces	bundled	Coreutils
`sqlite3`	Query and modify SQLite databases	store	Data
`ss`	Inspect sockets and network connections	store	Network
`ssh`	Connect securely to remote hosts with OpenSSH	store	Network
`ssh-add`	Add OpenSSH private keys to an authentication agent	store	Network
`ssh-agent`	Hold OpenSSH private keys for authenticated sessions	store	Network
`ssh-keygen`	Generate and manage OpenSSH authentication keys	store	Network
`ssh-keyscan`	Collect OpenSSH host public keys	store	Network
`sshd`	Serve certificate-authenticated SSH and SFTP sessions	bundled	Service
`stat`	Display file or filesystem status	bundled	Administration
`strace`	Trace Linux system calls and signals	store	Debugging
`strings`	Extract printable strings from files	bundled	Binary
`stty`	Inspect and change terminal settings	bundled	Administration
`subfinder`	Enumerate subdomains from passive and active sources	store	Network
`sum`	Compute file checksums and block counts	bundled	Coreutils
`sync`	Flush buffered filesystem data	bundled	Coreutils
`sysctl`	Inspect and modify kernel parameters	bundled	Process
`tac`	Concatenate files in reverse line order	bundled	Coreutils
`tail`	Print the end of files	bundled	Coreutils
`tar`	Create, inspect, and extract tar archives	bundled	Archive
`tcpdump`	Capture and inspect network packets	store	Network
`tee`	Copy standard input to files and standard output	bundled	Coreutils
`test`	Evaluate expressions and file predicates	bundled	Coreutils
`timeout`	Run a command with a time limit	bundled	Administration
`tload`	Display a terminal graph of system load	bundled	Process
`top`	Display live process and system statistics	bundled	Process
`touch`	Update timestamps or create empty files	bundled	Coreutils
`tr`	Translate or delete characters	bundled	Coreutils
`traceroute`	Trace the network path to a host	bundled	Network
`traceroute6`	Trace the network path to a host	bundled	Network
`tree`	Display directory trees	bundled	Filesystem
`true`	Return a successful exit status	bundled	Coreutils
`truncate`	Shrink or extend files to a specified size	bundled	Coreutils
`tshark`	Analyze network captures from the command line	store	Network
`tsort`	Topologically sort dependency pairs	bundled	Coreutils
`tty`	Print the terminal connected to standard input	bundled	Administration
`uname`	Print system information	bundled	Coreutils
`unexpand`	Convert spaces to tabs	bundled	Coreutils
`uniq`	Report or remove adjacent duplicate lines	bundled	Coreutils
`unlink`	Remove one filesystem name	bundled	Coreutils
`unshare`	Run a program in new Linux namespaces	store	Containers
`unxz`	Compress or decompress xz data	bundled	Compression
`uptime`	Report system uptime and load averages	bundled	Administration
`users`	Print logged-in user names	bundled	Administration
`vdir`	List directory contents	bundled	Coreutils
`vmstat`	Report virtual memory statistics	bundled	Process
`vzik`	Collect bounded host and container evidence as JSONL	bundled	Host inspection
`w`	Show logged-in users and their processes	bundled	Process
`watch`	Run a command repeatedly and display its output	bundled	Process
`wc`	Count lines, words, and bytes	bundled	Coreutils
`which`	Locate executables resolved through PATH	bundled	Environment
`who`	Show logged-in users	bundled	Administration
`whoami`	Print the effective user name	bundled	Coreutils
`xargs`	Build and run commands from standard input	bundled	Process
`xh`	Fancy HTTP client	store	Network
`xz`	Compress or decompress xz data	bundled	Compression
`xzcat`	Compress or decompress xz data	bundled	Compression
`yes`	Repeat a string until interrupted	bundled	Coreutils
`yq`	Process and transform YAML, JSON, and XML data	store	Data

/ focus search · esc clear

06 sshd + relay

SSH access through an outbound connection

Run the certificate-only SSH/SFTP server on the target. A standalone relay makes it reachable over an outbound TCP+yamux or QUIC connection.

>_ Operator OpenSSH client

SSH

⇄ axe-relay standalone service · TCP+yamux · QUIC+mTLS

outbound control

AX AXE sshd isolated target

Certificate identity

OpenSSH user certificates authorize logins. The certificate principal matches the login and its configured allowlist.

Separate QUIC identities

sshd pins the relay certificate and presents its own embedded client identity.

Outbound registration

sshd keeps one control connection with bounded reconnect backoff; relay assigns its public TCP port.

Owned lifecycle

Listeners bind before readiness. Connection tasks are bounded, supervised and shut down explicitly.

07 Lookup order

Command lookup order

Aliases, functions, builtins and bundled applets take precedence. AXE Store integrity failures stop execution rather than falling through to a PATH binary.

01alias / function
02shell builtin
03bundled applet
04AXE Store
05PATHtransient failure only

signature · digest · schema · TLS failure

STOP / 126

AXE_STORE_MODE auto cache + network · cache-only verified cache · off PATH only. Auto backs off transient network failures for 30 seconds; SSH sessions inherit the effective restriction.

08 Downloads and builds

Get AXE before you need it.

Download an OSS binary for your target from GitHub Releases. You can also build from source.

Latest release → Binaries and SHA-256 → Source and build instructions → Build your own edition →

build.sh

nix develop .#default
just build-linux-amd64
./dist/axe-x86_64-unknown-linux-musl --version

edition: oss verify the downloaded binary against SHA256SUMS before installing