live
Autonomous Security Agent
A transparent SOC investigation agent with a visible ReAct loop over read-only tools — log patterns, threat intel, geolocation, and WHOIS.
- Cybersecurity
- Agents
- SOC
- LLM
Overview
Simple Autonomous Security Agent runs a visible ReAct investigation loop over four read-only tools and produces structured risk reports with JSON/TXT export. Safety-first architecture includes input/tool guardrails, private-IP blocking, per-session rate limits, and a deterministic risk floor so the LLM cannot under-rate high-confidence tool evidence. Hybrid cloud/local LLM profiles (Groq/Ollama) with GitHub Actions CI and 64 offline tests.
Highlights
- Visible ReAct loop over four read-only investigation tools
- Safety guardrails, private-IP blocking, and session rate limits
- Deterministic risk floor against under-rated high-confidence evidence
- Structured risk reports with JSON/TXT export