The harness
- Durable memory and task state
- Specialized tools exposed through MCP
- Observation, decision and execution loops
- Authentication and sessions for permitted targets
- Completion criteria and blocker handling
← All projects
Cybersecurity · AI agents · Proprietary application
Agentic auto-pentest
A complete harness that coordinates authorized security tasks, preserves evidence and produces findings ready for human review.
scope → rules + allowed targets
planner → tasks + criteria
tools → MCP + controlled execution
memory → state + observations
evidence → proof + report
TypeProprietary application
ModelsLocal LLM or API
ControlScope + rules of engagement
OutputEvidence and reports
Problem
Automate continuity, not authority.
A useful security agent must decide what to do next without losing context while remaining strictly limited to the authorized mandate.
Guardrails
- Scope and rules of engagement checked before action
- Controlled exploitation, never assumed
- Command and observation traceability
- Evidence attached to each finding
- Human validation of risks and remediation
Engagement loop
01Scope
Targets, permissions and criteria.
02Enumerate
Observe and structure the surface.
03Validate
Test in a controlled way.
04Prove
Connect risk, evidence and fix.
Design
Built for real engagements.
The goal is to reduce context loss and repetitive work, not replace the tester's judgement.
Orchestration
The model interprets observations and selects the next step. Deterministic code protects scope, state, validation and execution.
Deliverables
Preserved observations feed reproducible evidence, normalized findings and remediation recommendations reviewed by a human.
Code, targets and exploitation details remain private. This page only describes the architecture and control principles.
Next project