— Deployment Models
The same Hounds, three front doors — a spectrum of autonomy. Self-host the open-source repo (data stays local, near-zero tokens), open the in-Cowork artifact (zero setup, Claude drives), or go fully prompt-driven with navi-mcp + the Hounds harness (one prompt runs the pack). Same grounded, gated guarantees across all three.
Self-Hosted
open-source · you run it · reads your local navi.db
A small Python app you launch with one command. Deterministic agents do the work over a local navi.db; the LLM is an optional, scoped convenience.
Benefits
Trade-offs
In Cowork
zero setup · Claude drives · navi + Tenable MCP
A single self-contained page that runs inside Claude Cowork. Claude works agentically through the navi and Tenable MCPs — conversational and always current.
Benefits
Trade-offs
Prompt-Driven
full autonomy · you prompt · the Hounds skill grounds it
Connect Claude to the navi MCP and install the Hounds harness — a skill that teaches Claude each hound's detection logic and tag scheme. Then just prompt an outcome; one prompt runs the whole pack.
Benefits
Trade-offs
The harness is the key. Raw navi tools let Claude query and tag; the Hounds skill is what turns that into the disciplined pack — each hound's selectors, tag schemes, ephemeral rules, and "grounded, gated, only-Garmr-removes" doctrine. Without it you get generic navi use; with it, you get the Hounds.
— Side by Side
| The Repo | The Artifact | navi-mcp + Harness | |
|---|---|---|---|
| Model | Your Anthropic key (opt-in, NL only) — or none | Claude in Cowork (Anthropic-hosted) | Any MCP-compatible model — Claude, GPT-4o, Gemini, local |
| Where it runs | Your machine / server | Inside Claude Cowork | Any navi-mcp host (Cowork / Desktop / Code) |
| Setup | python3 run.py · Python 3.10+ | Open the artifact — nothing to install | navi-mcp + navi skills + Hounds harness |
| Who does the work | Deterministic Python agents | Claude, in a structured console | Claude, prompt-driven & open-ended |
| What grounds it | The agent code | The agent code + MCPs | The Hounds skill (harness) + navi skills |
| How you drive it | Click a hound / arm the contract | Buttons + chat | One prompt ("Release the Hounds") |
| Autonomy | Governed (deterministic) | Assisted (guided) | Autonomous (agent directs itself) |
| LLM token cost | Near zero (opt-in NL only) | Higher — reads tool output | Highest — model drives everything |
| Live Tenable One counts | Via navi's API passthrough (roadmap) | Yes — Tenable MCP, real time | Yes — via navi's API access |
| Writes (tags / ACR) | navi CLI · NAVI_ALLOW_WRITES env flag | navi MCP · server flag + per-call confirm | navi MCP · server flag + per-call confirm; mail & remote-exec add a second env gate |
| Offline / air-gapped | Yes (core) | No | No |
| Best for | Production, privacy, cost control | Demos, exploration, triage | Power users, ad-hoc + full-send runs |
— Follow the Data
The core difference in one picture: the repo keeps the data with you and only sends a scoped prompt when you ask; the artifact and the prompt-driven harness let Claude read results as it reasons — more capable, more data through the model.
Deterministic agents; the model is optional and scoped.
Vuln rows & outputs never leave. SQL runs locally; results render in your browser, not sent back to the model.
Agentic — the model chains tools and reads their output.
Flexible and conversational — but query results and rows pass through the model's context, so more data and more tokens are involved.
Fully agentic — the model plans and acts, grounded by the skill.
Most autonomous and composable — and the most data + tokens through the model. Best as a trusted-operator mode with the gate deliberately opened.
The privacy line, stated plainly: in the repo, your vulnerability data stays on your machine — only your question and the database schema (plus, for a few opt-in features, a small derived slice like cert names or CVE IDs) is ever sent to Claude, and never the query results. Set no API key and nothing leaves at all.
— Bring Your Own Model
The navi-mcp + Harness path works with any model that supports MCP tool use — Claude, GPT-4o, Gemini, or a local model running on your own hardware. The Hounds harness is a skill file, not a Claude-specific artifact; any capable model can load it and follow the playbooks. The grounded, gated doctrine travels with the harness, not with the model.
Reference implementation. Best tool-use reliability and the model the harness was written and tested against. Recommended for production.
Solid MCP tool-use support. Works well for the prompt-driven path; some harness prompts may need minor tuning for OpenAI's tool-call format.
Any model with MCP tool-use support works. Keeps all data and inference on your hardware — maximum privacy, zero external API cost. Capability varies by model size.
The gate travels with the harness, not the model. Regardless of which model you use, writes are double-gated — the server flag must be armed and every write call needs per-call confirmation. Mail and remote-exec add a second environment gate on top. Swapping the model does not weaken the doctrine.
— Which Should I Use?
Not either/or — it's a dial. Demo with the artifact, run the repo in production, and reach for the prompt-driven harness when you want the pack on autopilot. Same navi, same gated writes, same grounded doctrine across all three.
— Open Source
The whole pack is open source. Self-host the repo, or open the artifact in Cowork — your call.