Capabilities

Capabilities bundle a system prompt, tool access, and skills into a single server-managed package. They define the default behaviors and tooling available to agents.

Built-in capabilities include:

• dreadairt — AI red teaming workflows
• dreadweb — web application pentesting workflows

Inspect capabilities in the TUI

$ dreadnode
dreadnode> /agents
Available agents: dreadairt, dreadweb
dreadnode> /agent dreadairt
Agent details displayed

Capability manager

Capabilities are managed from the active runtime, but the manager behaves differently for local and sandbox hosts.

Open the manager from inside the TUI:

/capabilities

Runtime-aware behavior

The capability manager reflects the runtime host you are using:

• Local runtime: machine-scoped. Installed manages what is present under ~/.dreadnode/capabilities/. Available browses org inventory and public capabilities you can install locally.
• Sandbox runtime: project-scoped. Installed manages project-installed capabilities. Available browses org inventory and public capabilities you can install to the active project.

Browsing a capability does not activate it. For local runtimes, a capability becomes usable only after it is installed into ~/.dreadnode/capabilities/ and the runtime reloads.

Tabs

The manager has two primary tabs:

• Installed: capabilities currently visible to the active runtime
• Available: capabilities you can install onto the active runtime

Available is a unified list. It combines org inventory and public catalog results and shows the source on each row.

Already-installed capabilities are hidden from Available.

Installed states

Installed entries use a small runtime-focused state model:

• enabled
• disabled

For local installs, detail view also shows provenance:

• local (authored)
• org
• public

Typical flow

/capabilities

Then:

1. use Installed to inspect or toggle what the runtime already has
2. switch to Available to install something new
3. press Enter for details
4. use Space to toggle actionable installed entries

After a local install, the manager keeps you on the detail view, installs into ~/.dreadnode/capabilities/, and reloads the runtime automatically.

Local development

To populate workspace capability inventory for local Studio and local-runtime TUI flows:

just dev
just sync-capabilities

This local bootstrap is explicit and idempotent. It packages the repo’s example capabilities as OCI artifacts, pushes them into the local server, prefers explicit auth env vars when set, and otherwise falls back to the local dev bootstrap user.

For remote sync, use the environment-specific commands and variables:

just sync-capabilities-dev
just sync-capabilities-staging
just sync-capabilities-prod

Each remote command expects its matching DREADNODE_<ENV>_API_URL, DREADNODE_<ENV>_API_KEY, and DREADNODE_<ENV>_ORG environment variables.

For local-only capability authoring, create a capability directory under:

~/.dreadnode/capabilities/

The local runtime will discover it automatically. Local enable/disable state persists across local runtime restarts.