Four agent-native CLI skills that answer, in permission-safe order, the questions every agent should settle about a network target BEFORE anyone touches it: dnsprobe (what does the resolver see), tcpping (is the port reachable and how fast), certsight (can/when will the TLS handshake break), httppeek (what does this URL actually return). Python 3.8+, zero dependencies, Apache 2.0.
0/1/2
exit contract, so scripts and agents branch on truth instead of parsing prose.| skill | what it does | highlights |
|---|---|---|
| certsight | TLS certificate recon, one host | leaf truth (subject/issuer CN, validity window parsed to UTC, days left, DNS SANs), negotiated TLS version + cipher, chain trust against this machine's CA store, verdict precedence EXPIRED > UNTRUSTED > EXPIRING > OK. Broken chains stay reportable — the leaf is fetched raw, pinned as its own anchor for one follow-up connection, and inspected anyway, labeled |
| dnsprobe | resolution recon, system-resolver view | host NAME: every A/AAAA answer (deduplicated, order preserved) + each alias the resolver walked; ptr IP: reverse-resolve with a clean rc 2 on malformed input. Every output stamped "view": "system-resolver" — no MX/TXT/NS guessing |
| httppeek | single-URL HTTP recon | HEAD by default; --get --peek N claims exactly the first N bytes of the final body (hard cap 4096, truncated reported). Full redirect chain with honest method rules (303 forces GET next hop, others keep the method), per-hop timing, boolean map over the five security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), cookie NAMES only, ssl_untrusted label. One attempt per hop, never retried silently |
| tcpping | TCP-connect latency, one host, named ports | connect → time → close per explicit --port (no ranges, no scans, no payloads, no ICMP — the output says tcp-connect where it counts): true median/min/max ms per port, failed-sample counts as data, samples spaced by --delay-ms |
dnsprobe (resolve it) → tcpping (reach it) → certsight (trust it) →
httppeek (query it). Four read-only stages, each one target and one question, compose into a full-path
diagnosis of any host your agent is about to touch.
With an AI agent (OpenClaw / Claude Code / Codex / any Agent-Skills host): unzip the pack, then copy any
skill folder — the folder containing its SKILL.md — into your agent's skills directory:
unzip CLI-Anything_Bundle8_NetworkRecon_v1.0.zip cp -r certsight ~/.openclaw/skills/
As a plain CLI (no agent needed):
python3 certsight/agent-harness/cli_anything/certsight/__main__.py example.com python3 dnsprobe/agent-harness/cli_anything/dnsprobe/__main__.py host example.com python3 dnsprobe/agent-harness/cli_anything/dnsprobe/__main__.py ptr 1.1.1.1 python3 httppeek/agent-harness/cli_anything/httppeek/__main__.py https://example.com python3 tcpping/agent-harness/cli_anything/tcpping/__main__.py example.com --port 443 --port 80
Optional pip install per skill (each ships an agent-harness/setup.py):
cd certsight/agent-harness && pip install .
Every skill carries its own self-test battery, and the batteries live-fire each skill's real CLI end-to-end. Total this bundle: 57 checks. certsight's battery spins a local fixture TLS server on a loopback port (its own pinned cert/key ships inside) — no external network needed to prove the tools.
python3 certsight/agent-harness/cli_anything/certsight/tests/test_core.py # 14 checks python3 dnsprobe/agent-harness/cli_anything/dnsprobe/tests/test_core.py # 10 checks python3 httppeek/agent-harness/cli_anything/httppeek/tests/test_core.py # 20 checks python3 tcpping/agent-harness/cli_anything/tcpping/tests/test_core.py # 13 checks
Verified live on 2026-10-19: 14 + 10 + 20 + 13 = 57 checks, 0 failed.
Apache 2.0. Yours to run, modify, and ship anywhere — including inside your own products.
Docs shelf (always on, free): https://tikkunolam.today/downloads/ — Bundle #1 (49-skill catalog) and Bundles #2–#7 all ship from the same rail.
Built on SoulTech AI by Kiwann Williams. All Is One. One Is All.