Kali GPT without refusals: shell-gpt on Obscurify.ai

“Kali GPT” usually means wiring an LLM into your Kali Linux terminal. shell-gpt (sgpt) is the common way: it turns a prompt into a shell command or an answer, right in the terminal. Point it at Obscurify.ai and a cybersecurity-tuned model, and it won’t refuse authorized security work. The account is a 16-digit number, not an email.

Authorized work only. For pentests you have permission for, CTFs, and your own systems. Obscurify.ai’s terms prohibit breaking into systems you are not authorized to access, or writing or spreading malware.

Tested on 2026-11-08 with shell-gpt against the live API, generating shell commands and answering security questions with heabsy/cyberheabsy.

Before you start

  • shell-gpt: uv tool install shell-gpt (or pipx install shell-gpt). On Kali it’s pipx install shell-gpt.
  • An Obscurify.ai API key. Create an account — a random 16-digit number, no email. Add credit on the account page, then click Show API Key. The key starts with sk-obs1_ and can be fetched again from your account number.

Point sgpt at Obscurify.ai

shell-gpt reads ~/.config/shell_gpt/.sgptrc. Set the base URL, your key and a cybersecurity model:

OPENAI_API_KEY=sk-obs1_...
API_BASE_URL=https://obscurify.ai/v1
DEFAULT_MODEL=heabsy/cyberheabsy
OPENAI_USE_FUNCTIONS=false
USE_LITELLM=false

Pick a cybersecurity model

Decensored, cybersecurity-tuned models that work on any funded account (no Pro plan needed). From /v1/models:

  • heabsy/cyberheabsy (used in the test)
  • orca/orcacyber-minimax-m3.1-flash (8 of 8 in our security test)

Try it

Ask for a command (sgpt proposes it and asks before running):

sgpt --shell "list listening TCP ports on this machine"
# -> ss -tlnp   [E]xecute, [M]odify, [D]escribe, [A]bort

Or ask a security question:

sgpt "Explain how to check a web app for SQL injection on a target I'm authorized to test"

The KaliGPT-style CLIs (for example SudoHopeX/KaliGPT) take the same OpenAI base URL and key, so this config works there too.

What it costs

Billed from your balance at each model’s price. Short prompts are cheap. Paid models have no monthly token limit. See pricing.

If something fails

  • 402: no balance — add credit on the account page.
  • 404 model_not_found: check the id against /v1/models and keep its prefix.
  • It asks for a key on startup: the .sgptrc isn’t being read; set OPENAI_API_KEY, API_BASE_URL and DEFAULT_MODEL in the environment instead.

What stays private

Prompts and responses aren’t stored on Obscurify.ai’s servers; models with the ZDR tag run only on zero-data-retention routes. Providers see the prompt text but not who sent it. See the privacy policy.

More: Obscurify.ai for agents.