Built in the open.

Hosts a Next.js operator dashboard and FastAPI aggregation API. Manages the ClownPeanuts and PingTing repository checkouts via parallel bootstrap/update scripts and surfaces the status of both runtimes. Cross-repo CI with smoke harness. Security controls include directory validation against allowed base roots, Git remote verification against config manifest, ephemeral credential helpers (never embedded in URLs), and hard timeouts on Git operations. Config driven by projects.yaml as single source of truth.

Nine emulator modules ship: seven production protocol emulators (SSH, HTTP Admin, Redis, MySQL, PostgreSQL, MongoDB, Memcached), an OpenAI-compatible fake-LLM endpoint, and a dummy emulator for testing. The Rabbit Hole Engine maintains per-session world models with an eight-level credential cascade graph, phantom lateral movement with fake network interfaces, and "oops" artifacts (leaked bash history, debug endpoints, hardcoded passwords). Tarpit primitives include adaptive throttle, slow-drip downloads, infinite exfiltration streams, and query tarpits. Intelligence pipeline: MITRE ATT&CK mapping, attacker classification by skill level, tool fingerprinting, behavioral biometrics, credential reuse detection, STIX 2.1/TAXII 2 export. Advanced features: Adversary Narrative Engine (cross-protocol coherence), Adaptive Lure Bandit (Thompson sampling/UCB), Adversary Theater (live session replay with kill-chain visualization), and counterfactual simulation for policy testing.

Device discovery via ARP and nmap with fingerprinting and drift detection. Optional LLM device classification against whatever OpenAI-compatible endpoint you configure, so point it at a model on your own hardware to keep fingerprints local. Breach exposure monitoring via HIBP. Log file anomaly detection with baseline learning. Multi-channel alerting (log, webhook, Slack, SMTP) with delivery tracking and exponential backoff retry. Operational reporting with dead-letter queue and replay tooling. Plugin system with SHA256 pinning, namespace constraints, and filesystem root enforcement. macOS launchd service support. Full SQLite storage and no vendor telemetry. The only unprompted outbound call is a one-time IEEE OUI database download for MAC vendor lookup; every other external call is one you configure. Security: parameterized SQL, defusedxml, no shell=True, SSRF protections, DNS pinning, webhook HMAC signing.

A SwiftUI control plane paired with a Python sensor that does the monitoring and deception: auto-deployed decoy services, credential canaries, device fingerprinting, Squirrel Scouts service reconnaissance, and behavioral baselines learned over 48 hours. App and sensor talk over mutual TLS with certificates exchanged during on-device pairing. Inventory, alerts, and configuration stay in local SQLite; optional AI classification and Apple Push Notification alerts are explicit opt-ins. Signed installer with published SHA-256 and a checksummed release verification artifact.