agent red

how it works

One model attacks. Others keep it honest.

The model running an operation is good at finding a way in — and bad at being its own referee. So it never is. A fast judge model and a set of hard rules sit between it and anything that matters.

Start freeSee the guided plan

the path of one action

Every move runs a gauntlet.

From the moment an operator decides to try something to the moment a finding reaches you, it passes through checks that are either plain code or a second, cheaper model — never the attacking model marking its own homework.

  1. 1

    operator proposes an action

    working model

    the model driving the operation decides what to try next

  2. 2

    scope gate

    decision model / gateway

    local calls pass; clear cases decided in code; anything ambiguous goes to a fast judge model — off-scope is refused

  3. 3

    approval gate

    deterministic

    read-only inside the workspace runs unattended; anything that writes or reaches further stops for you

  4. 4

    it runs

    working model

    the tool executes; the operator reads the result and keeps going

  5. 5

    finding filed as proposed

    working model

    with reproduction, evidence and a CVSS vector it proposes — not a severity it asserts

  6. 6

    severity re-scored

    decision model / gateway

    the gateway scores the vector with go-cvss, so the model can't inflate its own finding

  7. 7

    you confirm

    you

    deduped against prior intel; a human promotes it before it reaches a report

why it's trustworthy

the model that attacks never grades its own work.

The attacking model proposes whether a call is in scope; a fast decision model rules on the ambiguous ones and refuses anything it can't vouch for. It also checks every call for data exfiltration, so nothing leaves your environment that shouldn't. Findings land as proposals a human promotes. A compromised or over-eager operator can't wander off-target or walk your data out the door.

where everything runs

Your box. A private tailnet. The gateway.

Operators work on a machine you own and dial out to a tailnet only your org can see. Model and tool traffic goes through the gateway, which holds the keys, meters usage and re-scores findings. No AI key ever lands on your box, and nothing can dial in.


 ╔══ your environment ═══════════════╗
 ║  agent red application            ║░
 ║ ┏━━━━━━━┓   ┏━━━━━━━┓   ┏━━━━━━━┓ ║░
 ║ ┃ op 1  ┃   ┃ op 2  ┃   ┃ op 3  ┃ ║░
 ║ ┗━━━━━━━┛   ┗━━━━━━━┛   ┗━━━━━━━┛ ║░
 ║     ▼           ▼           ▼     ║░
 ║ ┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ║░
 ║ ┃       offensive toolkit       ┃ ║░
 ║ ┃   recon · exploit · report    ┃ ║░
 ║ ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛ ║░
 ║                                   ║░
 ║  no AI key ever lands here        ║░
 ╚═══════════════════════════════════╝░
  ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
                   │  dials out
                   ▼
 ╔══ private tailnet ════════════════╗
 ║ ┌─ ai handler ──────────────────┐ ║░
 ║ │                               │ ║░
 ║ │  ┏━━━━━━━━━━━━━━━━━━━━━━━━━┓  │ ║░
 ║ │  ┃     attacking model     ┃  │ ║░
 ║ │  ┃ does the offensive work ┃  │ ║░
 ║ │  ┗━━━━━━━━━━━━━━━━━━━━━━━━━┛  │ ║░
 ║ │         │           ▲         │ ║░
 ║ │         │ proposes  │ verdict │ ║░
 ║ │         ▼           │         │ ║░
 ║ │  ┏━━━━━━━━━━━━━━━━━━━━━━━━━┓  │ ║░
 ║ │  ┃     decision model      ┃  │ ║░
 ║ │  ┃     keeps it honest     ┃  │ ║░
 ║ │  ┗━━━━━━━━━━━━━━━━━━━━━━━━━┛  │ ║░
 ║ └───────────────────────────────┘ ║░
 ╚═══════════════════════════════════╝░
fig. 1 — operators work in your environment; one model attacks, another keeps it honest

the guided plan

You're not staring at a blank page.

Start at surface monitoring — one click, no prerequisites, results the same day. Every operation you run opens up the next, so the map below is also your roadmap. Hover any discipline to see the short chain that leads to it. The AI lane in blue runs alongside the classic one.

start here

then

then

then

then

Nineteen disciplines, but you never have to plan all nineteen. Run one, read the intel, and the next is unlocked when you want it.

it doesn't lose its place

Reboot the box. The operation resumes.

An operation is a durable workflow, not a script tied to a live connection. Close your laptop, lose the network, restart the host — when it comes back, operators pick up from the last thing they did, with their memory, their transcripts and the shared board intact. It resumes; it doesn't start over.

only test what you own

Start at surface monitoring. See results today.

One click, no setup to plan. The map shows you where to go next.

Start freeQuickstart & self-host