THE PLATFORM
41 agents across five tiers — plus a five-strong Search Pack. One contract. Your data stays local.
Agent Architecture
The Hounds are organized into five tiers — Signal Producers that detect and tag, Correlators that reason across signals, Orchestration & Delivery that governs the loop and closes it, Remediation & Tracking that follows fixes to closure, and Audit & Oversight that inspects the programme itself. Every agent reads from navi.db. Every write is double-gated: server flag plus per-call confirmation. Nothing is committed until a human says yes.
ANUBIS
ACR Calibration
Calibrates Asset Criticality Ratings using business context, connectivity, and threat exposure — the shared currency every other agent reasons from.
FENRIR
Attack Path Analysis
Chains exploitability, identity, and reachability into exploitable attack paths. Thinks like an adversary so your team doesn't have to.
SPHINX
Unknown-Unknowns Dashboard
Aggregates cross-agent signals to surface coverage gaps, ownerless assets, and anomalies no individual agent would catch alone.
ATLAS
Exposure Routes
Maps the network routes and choke points exposures travel — where to stand to block the most paths at once.
ARGOS
Asset Deep-Dive
Give it one asset — it returns the complete picture: risk band, every tag traced to the hound that raised it, top CVEs, software, and certificate status.
DAEDALUS
Dashboard Builder
Assembles audience-aware exposure views from navi.db — practitioners get finding-level drill-down, executives get risk posture without the noise.
SIRIUS
Agent Group Tagging
Aligns Nessus Agent groups with the pack's tag scheme so scan coverage and asset organisation stay in sync.
COVENANT
AI Contract — runs the gated tag/ACR plan on a schedule
GABRIEL
Reports — owner-routed remediation, KEV fire-alarms, and run summaries, double-gated
ALERT RAVEN
Alerting — watches navi.db between runs; fires a gated digest the moment a condition trips
GARMR
Tag Removal — retires stale and superseded tags so the pack's labels stay trustworthy, every removal gated and logged
AMAROK
Remediation Tracking
Follows every approved fix from proposal to verified closure — SLA tracking, stall detection, and confirmation that the patch actually landed in navi.db.
HERMES
Remediation Routing
Reads owner tags and asset group data from navi.db to route approved findings to the correct owner — no finding left unowned.
CASSANDRA
Remediation Velocity Tracking
Calculates your actual fix rate from navi.db timestamps — how fast findings are closing, where the backlog is growing, and whether current velocity will clear the queue before SLA deadlines.
HEPHAESTUS
Compliance Mapping
Maps every finding in navi.db to the compliance controls it violates — CIS, NIST, PCI-DSS, SOC 2, ISO 27001 — producing audit-ready evidence from data you already have.
NEMESIS
Suppression & Exception Audit
Audits every suppression and accepted-risk record in navi.db — surfacing stale justifications, expired waivers, and exceptions that have outlived their rationale.
HECATE
Tag Integrity Audit
Audits the tag estate for contradictions, stale rule-applied values, and categories with low coverage — so every downstream filter and report reflects reality.
PROTEUS
Asset Classification Audit
Finds assets with missing, inconsistent, or contradictory type tags, OS lineage, and criticality scores — the classification gaps that skew every downstream priority calculation.
MORPHEUS
Software Risk Leaderboard
Ranks every software package by asset spread, critical finding count, and KEV presence — answering which package, if patched today, closes the most risk.
AEGIS
Scan Coverage Audit
Finds assets with stale last-seen dates, subnets with no scan history, and agent-managed hosts that haven't checked in — the blind spots before an adversary finds them.
Evidence-first detection. Agents detect by content, not memorized lists. Every finding ships with a "why?" inspector — trace the exact evidence that triggered each tag or ACR change.
Human in the Loop
Every tag and ACR write is double-gated: the server flag must be armed (NAVI_MCP_ALLOW_WRITES=1) and every individual write call needs per-call confirmation — two keys, two locks. Email and remote-exec each add a second environment gate on top of that. Nothing runs autonomously until a policy is explicitly armed. Every change is logged and auditable. Agents state what they can't see — blind hosts, stale data — instead of pretending omniscience.
Double-gated writes
Two keys, two locks: the server flag (NAVI_MCP_ALLOW_WRITES=1) must be armed, and every individual write call needs per-call confirmation narrated to you first. Email and remote-exec each add a second environment gate on top.
Explicit arming
Autonomous operation requires a policy to be deliberately armed. Default state is always human-gated — the write gate is off until you set the environment variable.
Full audit trail
Every agent action, proposal, and approval is logged with timestamp, evidence, and operator identity.
Honest blind spots
Agents declare what they cannot see — stale scan data, blind hosts, missing credentials — rather than filling gaps with guesses.
The AI Contract
Enable agents, set a schedule, arm the Contract: it runs the gated tag/ACR plan on a loop with durable run history, a what-changed diff each cycle, and a scheduled morning digest. Autonomy with a safety switch.
When a cycle completes, Gabriel can email the run summary and each owner's slice of the work — previewed first, double-gated always.
Durable run history
Every cycle is recorded — what ran, what changed, what was skipped and why.
What-changed diff
Each cycle produces a precise diff: new tags, updated ACRs, removed findings, and the evidence behind each.
Morning digest
Scheduled summary of overnight agent activity delivered before your team starts the day.
Safety switch
Autonomy can be paused at any time. The Contract returns to human-gated mode instantly.
Built on navi
The pack runs local-first on navi, the open Tenable VM / Tenable One CLI. navi syncs your Tenable data into a local navi.db; the navi-mcp server exposes it to the agents, with the Tenable MCP as a live secondary source.
Data flow
17 Skills
Domain expertise packaged as skills — the knowledge layer the Hounds run on. A router plus 15 domain skills covering every navi domain, including the double-gated mail and remote-execution harnesses, the compliance mapping skill, the remediation tracking skill, and The Hounds playbook.