Offline by default
An ordinary check never reaches an intelligence API. The answer is reproducible because the evidence is already local.
Local intelligence / zero lookups
Don't query a blacklist.
Observe the evidence.
KiloCheck compiles current threat observations into an auditable local snapshot, then checks IPs without asking the network for permission.
- Network calls / check
- 0
- Verdict engine
- Deterministic
- Output contract
- Stable JSON
The local circuit
Evidence goes in.
Proof comes out.
The network is used to acquire hashed, versioned data releases—not to judge a target. Every ordinary check runs against the same immutable local facts.
One command. No theater.
Ask locally.
Get evidence.
Missing, unknown, stale, incomplete, and unsafe are different states. KiloCheck refuses to flatten them into a vibes-based reputation score.
tty://kilocheck
offline
$ kilo check 162.243.103.246 --json
{
"schema": "kilo.command.v1",
"ok": true,
"snapshot_id": "0f3fff…a781c2",
"data": [{
"target": { "type": "ip", "value": "162.243.103.246" },
"verdict": {
"disposition": "critical",
"recommended_action": "block"
},
"observations": [{ "source_id": "feodo-c2" }]
}]
}Observed from the v0.2.0 engine against the published Kilo Data release. Ordinary checks issue zero network syscalls.
The hard contract
Trust is a build artifact.
Evidence, not scores
Verdicts derive from typed observations and independent source groups—not one mutable number with an unknown half-life.
Failure stays legible
Unknown is not safe. Missing is not clean. Stale and incomplete keep their own exit codes and machine-readable diagnostics.
Transmission ready
KiloCheck v0.2.0
Signed provenance. Neighboring SHA-256 checksums. Linux, macOS, and Windows.