
# An interactive catalog: Parrot Arsenal Explorer

Until recently, anyone trying to explore the full range of tools available on ParrotOS had to rely almost entirely on the traditional command-line search. There was no centralized place to browse, compare, and inspect packages at a glance. For a distribution that maintains hundreds of curated cybersecurity tools, this was a significant gap.

To bridge it, we introduced [**Parrot Arsenal Explorer**](https://tools.parrotsec.org): a project that pairs a lightweight data extraction engine with a modern web interface. Two parts working in tandem to transform raw repository data into something anyone can navigate from a browser.

In this article, we'll walk through how each piece works and why the architecture behind them matters.

## Night Watch

Before any data can be presented to the user, it first needs to be collected and cleaned. The metadata for Parrot packages – versions, descriptions, dependencies, upstream links – lives scattered across compressed index files within the Debian and Parrot repositories, distributed across multiple suites and components.

We opted for a solution that operates as a standalone Python script, entirely free of external dependencies. We called it [**Night Watch**](https://gitlab.com/parrotsec/infra/night-watch-json). The idea is straightforward: build something so minimal that it can run anywhere Python is installed, with zero setup – no virtual environments, no package managers, no build tools. Just the standard library.

The script connects to the official Parrot mirrors, simulating the standard APT client to ensure access. From there, it downloads and decompresses dozens of index files directly in memory (`Sources.gz` and `Packages.gz`), cycling through every combination of suite and component. That alone amounts to roughly forty HTTP requests per run. Each downloaded index is then parsed using a custom-built parser tailored for the standard Debian stanza format (a text-based structure similar to old email headers), where each package is a block of key-value fields separated by blank lines.

![Blog picture](/assets/blog/parrot-arsenal-explorer/parrot-displaymanager.png)

During this process, the script handles a subtle but interesting problem: the name of a package on GitLab doesn't always match its name in the Debian ecosystem. What GitLab calls `jsql-injection`, for instance, Debian knows simply as `jsql`. A dedicated mapping file resolves these discrepancies, ensuring every package is correctly linked to its source code. The script also filters the results against a curated list of tools officially maintained by the Parrot team so that the final output only includes what actually matters.

The result is a clean, structured JSON file printed to standard output. No database, no persistent state, no running server. The script executes, produces the data, and exits. This makes it a perfect fit for periodic CI/CD jobs: the pipeline runs Night Watch on a schedule, generates the updated JSON, and publishes it as a static asset on GitLab Pages. From that point on, the frontend simply fetches it.

## The Frontend

If Night Watch serves as the engine that aggregates and cleans the data, [**Parrot Arsenal Explorer**](https://gitlab.com/parrotsec/web/parrot-arsenal-explorer-web) is the interface that brings it to life. Built as a modern single-page application with React and Vite, it transforms that single JSON file into a visually rich and interactive catalog.

The architecture is deliberately straightforward. When the application loads, it fetches the JSON from GitLab Pages and stores it in memory. From that moment on, there are no further server calls. Every interaction – searching, scrolling, opening details – happens entirely within the browser. There's no database to manage or authentication layer to worry about.

When more information is needed, clicking on any card opens a detailed modal window. It displays the package version, supported architecture, download and installed size, individual dependency packages, and direct links to both the GitLab source repository and the original upstream project.

The visual identity ties everything together. The design draws directly from Parrot OS branding style, all managed via TailwindCSS.

## Conclusion

The resulting application, [tools.parrotsec.org](https://tools.parrotsec.org), loads almost instantly, incurs no backend hosting costs since the JSON is served as a simple static file, and works reliably even in constrained environments.

For those who use and contribute to ParrotOS, this could be an everyday reference tool. For those studying cybersecurity, it's an interactive map of the available toolkit.

Both projects are open source and available on [GitLab](https://gitlab.com/parrotsec).


Explore the full range of tools available on ParrotOS.