Oniomarchy: Beautiful, opinionated Linux for cybersecurity, built on Omarchy
The hacker's omakase: every tool hand-picked, signed, and waiting in the menu you already use.A workstation you live in, not a live CD you throw away.
About Oniomarchy
An installable overlay on top of a stock Omarchy install — nothing Omarchy owns is touched, and its updates ride along intact.
"Oni" (鬼, Japanese for demon/ogre) + "Omarchy". Recon, research, reverse, report — every stage of an engagement, dropped straight into the desktop you already use every day.
Every tool is chosen on purpose — the one worth reaching for in each category — merged into the same menu, themed the same way, updated the same way as the rest of the system.
What you get
One tool per job
One hand-picked tool for each stage, from recon to reporting, all in the Security menu you already use. Nothing is here because a distro upstream happened to ship it.
Usage first, then the prompt
Launch a command-line tool and its help appears first, with your machine’s IP already filled in. You never start from a blank prompt.
Engagement setup in one keystroke
A reverse-shell listener, an HTTP file server, trusting your proxy’s CA. The things you do at the start of every job, each a single keystroke.
Services only when you ask
SSH, a database, two web servers, BeEF. All off by default, and each one asks before it opens a port.
Still Omarchy underneath
One script over a stock Omarchy install. Nothing Omarchy owns is touched, and its updates keep flowing.
Signed packages, not random build scripts
Every tool comes from Oniomarchy’s own repository: built once, tested on Omarchy, signed, and served fast. Nothing installs unless its signature checks out, so you never compile an unvetted AUR script.
Tool categories
Grouped the way you actually work, from recon through reporting — 82 tools across 15 categories, plus 18 webapp shortcuts.
Privacy & OPSEC, built in
Not one blunt “anonymous mode”, but independent layers you stack to fit the job. Tor, your MAC address and going dark are a click away on the bar.
Tor, your way
Route the whole machine through Tor, or just the browser, isolated at the kernel level. A kill switch, bridges, a leak check and a panic command, all from the bar.
A new MAC on demand
Randomize, restore, or set a specific hardware address on each interface, straight from the bar, so you’re not trackable from one network to the next.
Off the grid in one click
Cut every radio and network link at once — Wi-Fi, Bluetooth, mobile, ethernet — and bring back exactly what was on before. Dark even survives a reboot.
A browser that forgets
A hardened Firefox beside your normal one: always private, cookies and site data cleared on exit, no saved passwords, Global Privacy Control on.
Secrets locked at rest
KeePassXC for credentials, VeraCrypt for encrypted volumes. A lost or seized laptop doesn’t hand over the engagement.
Agentic pentesting, built in
Point an AI agent at a real offensive toolkit — hexstrike-ai and Metasploit's own MCP server, both wired straight into the Security menu you already use.
150 tools, one conversation
hexstrike-ai gives your AI assistant a huge slice of the toolkit — recon, web testing, exploitation. Describe what you want, and it runs the real tool, reads the output, and decides what to try next.
Metasploit, in plain English
Metasploit ships its own MCP server. Find a module, set the options, launch the exploit — the same engine behind msfconsole, now driven by a conversation instead of a keyboard.
One agent, the whole kill chain
hexstrike-ai covers recon and web testing; msfmcpd takes over for exploitation and post-exploitation. The same agent, the same conversation, from first scan to shell.
Install Oniomarchy
Two ways to run it — one ready today, one on the way.
On top of Omarchy
available nowOne script over an existing, stock Omarchy install. Nothing Omarchy owns is touched, and its updates ride along intact.
git clone https://github.com/SalimRK/oniomarchy.git
cd oniomarchy
./install.shFull-disk install
coming soonA bootable ISO that hands back a finished, fully-armed desktop straight from a blank disk — no existing Omarchy install required.