Every tool the book actually runs, in one place. If a chapter puts a command in your hands, this is where you find it again - the real invocation, not a description of one. Where a tool has no meaningful CLI, the invocation column says so rather than dressing a product name up as a command.
A command is the shortest form that actually does the job - placeholders in <angle brackets>. A - means the tool has no meaningful command line (it is a library, a model, a hosted service, or a web application); the “What it does” column tells you how the book uses it, and the owning chapter shows it in context.
Offense - attacking the model
Tool What it does Invocation Chapter IBM ART Craft adversarial-ML evasion (PGD / FGSM) against a model you own from art.attacks.evasion import ProjectedGradientDescentI.4
Eval and red-team
Tool What it does Invocation Chapter garak Broad LLM vulnerability scanner - sweep injection / jailbreak / leak probe families python -m garak --target_type openai --target_name <model> --probes promptinject,dan,encoding,latentinjection,leakreplayII.2 PyRIT Microsoft multi-turn adaptive red-team (Crescendo / TAP) for depth from pyrit.executor.attack import CrescendoAttackVI.4 promptfoo Red-team config to a per-plugin attack-success-rate report you diff across model versions promptfoo redteam run --target <endpoint>VI.3 Project Moonshot AI Verify run layer - connectors plus cookbooks / recipes and red-teaming moonshot run cookbook "singapore-safety-cookbook" -e <target> -n 1 -r 5VI.5 Inspect UK AISI eval harness - the standard runner for public capability benchmarks inspect eval inspect_evals/wmdp_bio --model <provider>/<model> --limit 100VI.6
Supply chain - proving the artifact
Tool What it does Invocation Chapter modelscan Flags unsafe pickle / H5 / SavedModel deserialization before load modelscan -p ./<model-dir>I.5 fickling Trail of Bits - decompile a pickle, inspect opcodes, detect code payloads fickling --check-safety ./<model>.pklI.5 picklescan Denylist pickle scanner - a secondary gate only, it has known bypasses picklescan --path ./<model>.pklI.4 safetensors Code-free tensor format - the safe alternative to pickle weights python -c "from safetensors.torch import load_file; load_file('model.safetensors')"I.5 cosign / Sigstore Sign, verify and attest the artifact; keyless, transparency-logged cosign sign-blob --key <cosign.key> ./models/<model> > model.sigI.5 model_signing (OMS) OpenSSF Model Signing - verify weights against a signer identity model_signing verify sigstore --signature <model.sig> --identity <builder@org.example>I.5 slsa-verifier Verify tamper-resistant build provenance (in-toto / SLSA attestation) slsa-verifier verify-artifact <artifact> --provenance-path <att.jsonl> --source-uri github.com/<org>/<repo>I.5 DVC Content-addressed dataset versioning - hash-pin and diff each external set dvc add data/raw && dvc pushVII.1
Cloud and infrastructure
Tool What it does Invocation Chapter Prowler Multi-cloud CIS-aligned posture scan prowler aws --profile <assessment-profile> --output-formats html,json-ocsfV.1 CloudFox Enumerate exploitable attack paths a compliance scanner will not surface (AWS / Azure / GCP) cloudfox aws --profile <assessment-profile> all-checksV.1 pmapper Graph IAM and compute privilege-escalation paths automatically pmapper query 'preset privesc *'V.2 Pacu AWS exploitation framework - enumerate permissions, test privesc pacu then run iam__privesc_scanV.2 nuclei Sweep the estate for exposed MLOps, vector and MCP services nuclei -tags mlflow,ray,kubeflow -u https://<target-host>I.5
Defense - build and run
Tool What it does Invocation Chapter pytm Threat-model-as-code - regenerates the data-flow diagram and findings on every design change python tm.py --dfd | dot -Tpng -o dfd.pngVI.3 Presidio Microsoft PII detection and redaction, on ingest and on live responses and logs from presidio_analyzer import AnalyzerEngineVII.1 Amazon Macie Managed PII discovery across S3 before data reaches a training or RAG pipeline aws macie2 create-classification-job --job-type ONE_TIME --s3-job-definition <file://job.json>VII.1 Evidently Data and prediction drift baselining (PSI / KL) with alert thresholds from evidently.metric_preset import DataDriftPresetVII.1 NannyML Post-deploy performance estimation without fresh labels import nannyml as nmlVII.1 Llama Guard / Prompt Guard Meta’s input / output safety and injection classifiers, run as an inline guardrail - (models, served behind your own inference endpoint)II.5 DefectDojo Track AI vulnerabilities on the same board as application vulnerabilities (CVSS + EPSS) - (web application, deployed and driven through its UI / API)VII.1
Identity and policy
Tool What it does Invocation Chapter OPA Policy-as-code - enforce audience, scope and delegation at the resource, not in the prompt opa eval -d policy.rego -i input.json 'data.authz.allow'IV.6 Cedar AWS policy language for the same job, where the platform speaks Cedar - (policy language, evaluated by the host authorization engine)IV.6
ScoutSuite appears in a lot of cloud-audit guidance, but this book prefers Prowler and CloudFox - see V.1 · Where AI runs for the reasoning. If you inherit a ScoutSuite report, read it, but do not build a new engagement on it.
This roster is the index, not the manual. Each command’s full context - the surrounding flags, the caveats, and the authorized-target discipline - lives in its owning chapter. Copy-paste-able engagement artifacts live in templates .