LANCET NanoA local classifier that flags risky Bash commands before an agent or a person runs them.

# 1. verify the download, then the bundle
certutil -hashfile lancet-v0.3.0-nano-cpu-int8.zip SHA256
python verify_bundle.py --strict

# 2. install three pinned CPU dependencies
python -m venv .venv
.\.venv\Scripts\python.exe -m pip install -r requirements.txt

# 3. classify (JSON lines in, JSON lines out)
$env:OPENBLAS_NUM_THREADS = '1'
'{"command": "terraform destroy -auto-approve", "shell": "bash"}' |
  .\.venv\Scripts\python.exe classify.py --model model

{"score": 0.997, "classification": "risky", "reason": null,
 "experimental": true, "executionAuthorized": false, ...}

• Python 3.12 with NumPy, tokenizers and ONNX Runtime CPU. No PyTorch, no GPU, no API key.
• Keep one process running and stream commands to it; the model loads once.
• Commands are read as text and never executed.
• On macOS or Linux, use .venv/bin/python. Those platforms were not benchmarked.
• If you clone instead of downloading the ZIP: install Git LFS, run git lfs pull, and use bundle/.

v0.3.0 fine-tunes the Salesforce CodeT5-base encoder from its pinned upstream weights, with no earlier LANCET checkpoint, using class-balanced sampling. Its labels come from project authoring and documentation, not from another model's opinions:

• tldr-pages: each example's one-line description sets the label. "Delete a specific pod" is risky; "List all volumes" is benign.
• AWS botocore: the operation verb, plus AWS's own sensitive markings on returned fields, so commands that print credentials are risky.
• Azure CLI, GitHub CLI, kubectl, Docker CLI reference examples, labelled by verb and description, including documented secret reveals such as keys list and --with-decryption.
• LANCET's project-authored risky/safe pairs, a secrets family, earlier agent-authored evaluation suites (retired into training, original labels), and developer commands from SWE-smith, Terminal-Bench and NL2Bash.

No language model, hosted API or human labeler produced any training label.
Development and calibration used tools and families held out from training.
The label rules are heuristic and were not human-adjudicated.