SecOpsAI

Purpose

Two questions decide the security posture of most organizations: what is on the network, and what is in the software. SecOpsAI answers both, on your own hardware.

SecOpsAI Edge discovers every device on your network and flags risky changes. SecOpsAI Research watches eight package registries for typosquats and suspicious releases. The platform correlates this telemetry into findings with evidence, severity, and a next action.

All analysis runs on your hardware. Telemetry stays in a local store. Cloud reports contain minimized findings only.

Architecture

SecOpsAI is one platform with four components. Each component has one clear responsibility.

The OpenClaw integration provides approval-gated automation tools. The Hermes Agent integration provides read-only access to normalized findings, asset context, sessions, and service health while a separate local monitor collects Hermes telemetry. Neither integration exposes raw credentials or bypasses operator approval boundaries.

Enterprise security operations

SecOpsAI keeps the local-first workflow while adding a guarded enterprise foundation for normalized cloud and Kubernetes events, vulnerability prioritization, authorized DAST, GRC evidence, customer questionnaires, threat models, and penetration-test coordination.

Local SQLite mode remains available. Hosted deployments can use the optional PostgreSQL enterprise data plane. See the enterprise architecture guide.

Source-First Artifact Research gives every supported ecosystem one safe workflow: metadata and provenance, quarantined artifact collection, deterministic static/YARA analysis, minimized model review, analyst escalation, evidence matrices, and review-only research drafts. It covers crates.io, npm, PyPI, Packagist, Go, Maven, NuGet, RubyGems, Open VSX, GitHub sources, Hugging Face metadata, containers, and approved archives. Nothing is installed or executed, and publication always remains human-approved. The execution-grounded reliability workspace adds competing hypotheses, versioned plans, claim-level verification, blinded review, originality and visual QA, and auditable resource accounting before a report can advance.

Every result is signal-calibrated: structured manifests and language-aware call sites are separated from documentation noise, repeated observations are deduplicated, source links are kept distinct from attacker IOC candidates, and the decision card shows priority, confidence, impact, local exposure, evidence quality, and next action separately. Publication-sensitive cases can continue through the execution-grounded reliability workflow with claim-level evidence, blinded review, and visual QA.

Installation

Select your platform. Run the command. The install takes less than five minutes.

Capabilities

Deployment models

Data and AI boundaries

SecOpsAI uses AI where it helps: summaries, explanations, and report text. The platform never lets AI decide what is true.

Operation

SecOpsAI is terminal-native. The example shows a standard operator session.

$ secopsai refresh --platform macos,openclaw,hermes
[OK] Collected host and agent telemetry. Findings persisted to the local store.

$ secopsai research worker run --once
[OK] 8 collectors due · 6 registries current · 2 coverage gaps queued for replay

$ secopsai research score run
[OK] 1,204 events scored · 1 candidate above threshold

$ secopsai list --severity high
HIGH Possible typosquat package observed on nuget feed
CAN-… | reference: braintree | status: new | review required

Safety boundaries

SecOpsAI collects and analyzes. It takes no offensive action. These rules apply everywhere in the platform.

References