# TOOLS.md - Model & Tool Reference

## Model Stratejisi: Ollama → OpenRouter → Gemini

### Ollama via Olla LB (PRIMARY — hepsi FREE)
- **Olla LB:** `http://127.0.0.1:40114` (~615 endpoint, 264 tool-capable)
- **DB:** `/home/ali0606/ollama.db` (3810 IP, tam DB)
- **Sync:** `/home/ali0606/olla-db-sync.sh` (cron her 6 saat)
- **40+ model tanımlı** — tam liste: `/home/ali0606/notes/openclaw-setup/MODEL-GUIDE.md`

### Telegram Model Komutları

```
# === REASONING (derin düşünme, mantık, analiz) ===
/model ollama-r1-70b  → DeepSeek R1 70B     FREE (en iyi reasoning)
/model ollama-qwq     → QwQ 32B             FREE (güçlü reasoning)
/model ollama-r1-32b  → DeepSeek R1 32B     FREE (iyi reasoning)
/model ollama-r1-14b  → DeepSeek R1 14B     FREE (orta reasoning)
/model ollama-r1      → DeepSeek R1 default FREE (hızlı reasoning)
/model r1             → DeepSeek R1 cloud   FREE (OpenRouter)
/model qwen           → Qwen3 235B Thinking FREE (OpenRouter reasoning)

# === CODING (kod yazma, debug, review) ===
/model ollama-qwen-coder → Qwen3 Coder 30B  FREE (en iyi coding)
/model ollama-coder14b   → Qwen2.5 Coder 14B FREE (güçlü coding)
/model ollama-deepcoder  → DeepCoder 14B     FREE (alternatif)
/model ollama-coder7b    → Qwen2.5 Coder 7B  FREE (hızlı coding)
/model coder             → Qwen3 Coder 480B  FREE (OpenRouter)

# === GÜÇLÜ GENEL (karmaşık görevler, analiz) ===
/model ollama-qwen235b   → Qwen3 235B        FREE (dev model)
/model ollama-qwen-next  → Qwen3 Next 80B    FREE (yeni nesil)
/model ollama-llama33    → Llama3.3 70B       FREE (güçlü genel)
/model ollama-qwen32b    → Qwen3 32B         FREE (cron modeli)
/model ollama-gemma27b   → Gemma3 27B        FREE (güçlü + yaygın)
/model ollama-qwen14b    → Qwen3 14B         FREE (iyi denge)
/model ollama-phi4       → Phi4 14B          FREE (Microsoft)

# === CHAT (günlük kullanım — varsayılan) ===
/model ollama-qwen    → Qwen3 8B            FREE (PRIMARY, varsayılan)
/model ollama-llama   → Llama3.1 8B         FREE (en yaygın)
/model ollama-gemma   → Gemma3 12B          FREE (iyi genel)
/model ollama-hermes  → Hermes3 8B          FREE (tool calling iyi)
/model ollama-mistral → Mistral 7B          FREE (hızlı)
/model ollama-mistral-sm → Mistral Small 24B FREE (tool calling)
/model ollama-llama32 → Llama3.2 3B         FREE (ultra hızlı)

# === VISION (görsel analiz) ===
/model ollama-qwen-vl → Qwen3 VL 8B         FREE (resim + metin)
/model ollama-llama-vl→ Llama3.2 Vision 11B  FREE (resim + metin)
/model vision         → Nemotron Vision      FREE (OpenRouter)

# === CLOUD — OpenRouter (Ollama yoksa fallback) ===
/model qwen           → Qwen3 235B Thinking FREE (reasoning)
/model llama          → Llama 3.3 70B       FREE (tools)
/model gpt            → GPT-OSS 120B        FREE (tools)
/model step           → Step 3.5 Flash      FREE (256K context)
/model trinity        → Trinity Large        FREE (reasoning)
/model mistral        → Mistral Small 3.1   FREE (vision+tools)

# === CLOUD — Gemini (SON ÇARE) ===
/model gemini         → Gemini 2.5 Flash    FREE (son çare)
/model lite-$0.10     → Flash Lite          $0.10/M
/model pro-$1.25      → Gemini 2.5 Pro      $1.25/M (EN PAHALI)
```

### Tool Calling Uyarısı
- **YAPAR:** llama3.1+, qwen3, qwen2.5, mistral, hermes3, gemma3, phi4, command-r
- **YAPAMAZ:** deepseek-r1, qwq (tool çağrısı kabul eder ama sonuç UYDURUR!)
- Cron job'larda tool-capable model şart (şu an: qwen3:32b)

## Skills Inventory (33/77 ready — updated 2026-03-12)

### Intelligence & Analysis
- **seithar-intel** — Threat intelligence + cognitive security (MITRE ATT&CK, DISARM, SCT taxonomy, 23 RSS feeds)
- **freshrss** — RSS feed management (Fever + Google Reader API)
- **freshrss-reader** — RSS feed reading & analysis (geopolitical + CTI categories)
- **war-intel-monitor** — Real-time conflict zone monitoring + emergency alerts
- **osint-investigator** — Deep OSINT (person, domain, IP, org, username, phone, email)
- **gov-cybersecurity** — CVE lookup via NIST NVD, CISA KEV, EPSS scores, MITRE ATT&CK (7 MCP tools)
- **news-crawler** — RSS news feeds by topic (cyber, defense, tech, geopolitics)

### Security & Pentesting
- **pentest** — Penetration testing, SAST, secret scanning, infrastructure security
- **pwnclaw-security-scan** — AI agent security testing (112 attacks)
- **security-scanner** — Vulnerability scanning (nmap, nuclei, nikto)
- **security-skill-scanner** — Skill SKILL.md security audit
- **security-audit-toolkit** — Code/infra audit, OWASP top 10, SSL/TLS, file permissions
- **senior-secops** — Full SecOps toolkit (vuln mgmt, compliance, hardening)
- **nmap-recon** — Structured nmap reconnaissance workflows
- **network-scanner** — Network device discovery (ARP/nmap, RFC 1918 safe)
- **sql-injection-testing** — SQLi detection + exploitation (authorized)
- **pcap-analyzer** — PCAP/PCAPNG network forensics (tshark: DNS, TLS, HTTP, anomalies)
- **sys-guard-linux-remediator** — Linux incident response & forensics
- **clawsec** — ClawSec Monitor MITM proxy, AI agent traffic inspection
- **ctf-writeup-generator** — Professional CTF writeup generation
- **stealth-browser** — Anti-detection web automation (CF bypass, CAPTCHA)
- **dns-networking** — DNS debugging, port testing, cert troubleshooting

### Web Scraping
- **deep-scraper** — Containerized deep scraping (Docker+Crawlee, YouTube, X)
- **crawl-for-ai** — Crawl4AI with JS rendering for complex pages

### Infrastructure & DevOps
- **docker-essentials** — Container management, image ops, debugging
- **session-logs** — Search/analyze OpenClaw session logs with jq
- **healthcheck** — Host security audit + OpenClaw cron checks
- **tmux** — Interactive CLI sessions
- **coding-agent** — Background coding agents
- **skill-creator** — Create/package new skills

### Document Processing
- **image-ocr** — Image text extraction (Tesseract)
- **mistral-ocr** — Mistral-powered OCR (PDF/image to markdown)
- **pdf-text-extractor** — PDF text extraction + batch processing
- **youtube-transcript** — YouTube video transcript fetch + analysis

### Other
- **weather-checker** — Weather info
- **productivity-helper** — Task management

## Infrastructure

### Server
- OS: Kali GNU/Linux Rolling 2026.1
- Host: kali (Agent 2 — debian-1 hala primary)
- IP: 45.155.127.94 (public), 100.84.44.120 (Tailscale)
- CPU: 4x Intel Xeon E5-2650 v2 @ 2.60GHz
- RAM: 8GB
- Disk: 111GB (84GB free)
- Gateway: localhost:18789, Tailscale: https://kali.tail6344dd.ts.net

### Installed System Tools
- `ripgrep` (rg) — fast file search
- `tmux` — terminal multiplexer
- `tesseract` — OCR engine
- `ffmpeg` — video/audio processing
- `jq` — JSON processor
- `sqlite3` — SQLite CLI
- **Kali Security Tools (full suite):**
  - `nmap`, `masscan` — network scanning
  - `sqlmap` — SQL injection
  - `msfconsole` (Metasploit) — exploitation framework
  - `john`, `hashcat` — password cracking
  - `hydra` — brute force
  - `nikto` — web server scanner
  - `gobuster` — directory/DNS brute force
  - `burpsuite` — web app testing
  - `aircrack-ng` — WiFi security

### Telegram Bot
- Active: @KaliAgentClawBot
- DM Policy: allowlist (user 1120204135)

## Data Locations

### Geopolitics
- Main: `/home/ali0606/notes/geopolitics/`
- Subdirectories: Iran, Russia, China, Iraq, Lebanon, Egypt, NATO, Turkey

### Cybersecurity
- Main: `/home/ali0606/notes/cybersec/`

### Persona
- 6 personas: `~/.openclaw/workspace/personas/` (neo, frodo, oracle, ghost, architect, scholar)
- Frodo/Dave protocol: `/home/ali0606/persona/dave.md`
