Built for FIND EVIL! 2026, the SANS Institute hackathon for autonomous incident response.
What works today
- Every tool is read-only and typed.
- Every claim is checked against a hash-chained audit log. A finding without a valid artifact reference is rejected by the interface, not by a prompt.
- The whole investigation runs on one laptop with a local model.
Why it is in the lab
It is a small, public demonstration of the evidence-and-authority research: fabrication is refused by structure.