Prompt Pack

Run the whole pack
by prompt.

Connect the navi MCP, then just ask. One master prompt runs the entire pack autonomously; or grab a single hound's prompt for targeted work. Same grounded, gated outcomes as the app — driven by Claude.

Full send · one prompt, whole estate À la carte · one hound at a time writes need NAVI_MCP_ALLOW_WRITES=1

Full Autonomy

🐕 Release the Hounds — one prompt

The whole pack in a single pass. The MODE switch sets the autonomy: PLAN previews and stops; ARMED applies it and reports. Run PLAN first; switch to ARMED once you trust it.

Tip: if your navi-mcp exposes the navi_workflow prompt, invoke it first — it loads the navi router skill so Claude knows the full tool surface before it starts.

Release the Houndsautonomous · MODE: PLAN → ARMED

You are running "The Hounds" fully autonomously over the navi MCP against my Tenable data
(navi.db + the Tenable API via navi). I authorize writes for this run; NAVI_MCP_ALLOW_WRITES
is enabled on the server.

MODE: PLAN        # PLAN = discover + show the full plan, write NOTHING.
                  # ARMED = apply the plan live (confirm=True), then report.

Run the ENTIRE pack in one pass, without stopping to ask me between hounds. For each hound:
discover with real navi queries, prefer navi built-in selectors, skip anything that matches
0 assets, and if one step errors, log it and keep going (never abort the run).

Tagging hounds (use ephemeral remove=True for the health/state ones, marked *):
  1. CISA KEV*        assets with a CISA-KNOWN-EXPLOITED xref   -> "CISA KEV : Vulnerable"  (--xrefs)
  2. Certificates*    certs expired or expiring within 12 months -> "Cert failure : <Mon-dd-yyyy>"
  3. Scan health*     credential failures (plugin 104410)       -> "Scan Health : Cred Failure"
  4. Agent groups     each Tenable agent group                  -> "Agent Group : <name>"  (--group)
  5. EOL / unsupported unsupported-product plugins (name match) -> "Lifecycle : <product> EOL"
  6. AI inventory     AI plugin family + software/cpes          -> "AI : Present" (+ per-role)
  7. IoT              confidence-scored device detection        -> "IoT : <device class>"
  8. Post-Quantum     quantum-vulnerable certs + PQ plugins     -> "Post-Quantum : Cipher Analysis"
  9. MITRE ATT&CK     CVE->technique (cached mapping, CVE-based) -> "Mitre : <technique>"
 10. Software         version sprawl / EOL / crown jewels       -> "Software : <product>" (notable only)
 11. Ownership        map exposure routes/paths to owners       -> "Owner : <group/user>" (persistent)
 12. Custom Apps      routes + filesystem paths -> app names   -> "Custom App : <name>"  (Cavall)
 13. Dark Assets*     hosts in asset data but absent from scans -> "Coverage : Dark Asset"  (Nyx)
 14. Network Exposure deprecated protocols + unexpected ports   -> "Network : <protocol> Exposed"  (Triton)

ACR (Anubis): set Asset Criticality by business tier per this policy —
  <<< replace with your policy, or use defaults: production = 9, staging = 6, dev/test = 3;
      anything carrying a crown-jewel or CISA KEV tag: +1 >>>

Guardrails that always apply, even in ARMED:
  - GROUNDED: only real navi results. Never invent counts, assets, or findings.
  - NO DESTRUCTION: do not delete tags or assets. (Tag removal is a separate, explicit request.)
  - HONEST COVERAGE: call out blind/uncredentialed hosts and stale navi.db; offer a navi update.

When finished, VERIFY the applied tags against `navi explore info tags` and give me ONE report:
  - per hound: candidates found, tags applied, landed vs still-pending, and any errors;
  - the ACR changes made;
  - the top 5 pressing exposures I should look at first;
  - a note that tags can take ~30 min to fully propagate in Tenable.

Begin now in the MODE set above.

To go fully hands-off: change MODE: PLAN to MODE: ARMED — one prompt, whole estate, report at the end. The guardrails stay on even when armed.

À la carte

Operating Rules — paste once first

Prepend this once, then drop in any single-hound prompt below it.

Operating Rules

You are running "The Hounds" over the navi MCP against my Tenable data (navi.db + the Tenable
API via navi). Follow these rules for everything in this chat:

1. GROUNDED: answer only from real navi queries/tools. If you can't get it from navi, say so —
   never guess counts or findings.
2. PROPOSE, THEN CONFIRM: for any tag or ACR write, first show me exactly what you'll do (the
   navi command, the category:value, and how many assets match). Do NOT write until I reply
   "confirm". Writes also require NAVI_MCP_ALLOW_WRITES=1 on the server.
3. PREFER BUILT-IN SELECTORS: use navi's --plugin/--output, --cve, --cpe, --xrefs, --group,
   --name before a raw --query.
4. EPHEMERAL HEALTH TAGS: for health/state tags (cred failures, KEV, expiring certs) use
   remove=True so the tag reflects current reality on each run.
5. HONEST COVERAGE: call out blind/uncredentialed hosts and stale navi.db.
6. VERIFY: after a write, note it can take ~30 min to propagate, and offer to confirm it landed
   with `navi explore info tags`.

Per-Hound Prompts

One prompt per hound

Grounded in each agent's real navi mechanics. Copy any one under the Operating Rules.

Run the whole packby prompt.

🐕 Release the Hounds — one prompt

Operating Rules — paste once first

One prompt per hound

Run the whole pack
by prompt.