v0.1.0 · single signed binary · Free up to 10 endpoints
Sovereign agentic AI SOC.
Your SOC. Your AI. Your audit chain.
Built by Chris. Ten years federal cyber, including Secret Service electronic crimes. Ten years running BladeOne's SOC. The audit chain comes from someone who has had to defend chain-of-custody.
Single-binary, on-prem agentic security operations. 25 open-source connectors including Wazuh. Local AI by default. Hash-linked audit chain. Your data never leaves the box, and it keeps watching when the internet is down. No CyberCLI cloud, no telemetry, no compromise.
Cosign-signed releases on /downloads. Verify the signature before you install. Every release ships SHA-256 + Ed25519 signature artifacts you can replay offline.
curl -sSfL https://cybercli.com/install.sh | bash Non-negotiable
Rules of engagement.
What makes it different
Four pillars no cloud SOC can offer.
CYCON
Live postureOne always-on security condition for your environment — it elevates and de-escalates as the engine reasons over real signals.
Learn more →Connectors
BreadthSpeak to the tools and partners you already run — Wazuh to Microsoft 365 — each normalized into one signal stream.
Learn more →The Guild
Agent workforceA roster of specialized AI roles — triage, detection, response, voice — running on local models you own.
Learn more →Trust
The leashAn 8-level Trust Ladder caps what the AI may do per action class, and every decision is hash-chained and replayable.
Learn more →The roster
25 open-source connectors. 4 proprietary on Pro.
We don't replace your tools — we orchestrate them. Free tier covers the full open-source roster. Pro adds the cloud-identity + EDR substrate that the major vendors gate behind enterprise pricing.
- Wazuh
- auditd
- osquery
- Falco
- ClamAV
- Suricata
- Zeek
- CrowdSec
- pfSense
- OPNsense
- AdGuard Home
- Pi-hole
- nginx
- Apache
- Caddy
- Traefik
- HAProxy
- Coraza WAF
- WireGuard
- OpenVPN
- OpenCanary
- Cowrie
- Trivy
- Proxmox VE
- Keycloak
- UniFi
- Microsoft 365
- Avanan
- SentinelOne
Cyber posture as a first-class signal
CYCON. Like DEFCON, for your network.
A 5-tier posture indicator the whole org reads at a glance. Operators see it in the dashboard chrome; executives see it on the status page. Engine-derived from live events — never set from a toolbar.
The only winning move is to see the whole board.
Regulator-ready decision log · chain of custody for AI actions
Prove every AI action. Locally. Forever.
Every gate decision lands as a signed row on a SHA-256 hash-chain. The chain lives in your SQLite (not our cloud) and is locally re-derivable forever. When an auditor, a board member, or an incident reviewer asks why the AI took an action eighteen months from now, you can replay the row, verify the signature, and answer the question without us.
Chain lives on your engine box, never leaves. No vendor-cloud retention, no per-seat audit-storage charge, no third-party subpoena risk.
Flip one byte on disk and the next cybercli audit verify catches it. Useful for SOC 2 CC7, NIST AU-3 / AU-9, and any "show me why the AI did that" review.
cybercli audit tail --format json hands counsel or a regulator the bytes they can verify against your engine's public key, no engine access required.
{
"seq": 295,
"timestamp": "2026-06-07T16:14:13Z",
"initiator": { "type": "ai", "model_route": "local" },
"action": {
"type": "notify_only",
"action_template_id": "notify_only.v1"
},
"trust_level_applied": 7,
"effective_level": 4,
"outcome": "approved_autonomous",
"prev_hash": "d5961d84a2c01fd2…",
"entry_hash": "2c1a4d32c7aeb57e…"
}$ cybercli audit verify
✓ 297 entries verified · chain intact · no tamper- → Replay any decision. seq, initiator, model_route, trust level, outcome — all in the row. Two years later, you can still answer "why."
- → Tamper-evident at the byte. Each entry hashes the previous; flip a bit and the chain breaks.
cybercli audit verifycatches it. - → Sovereign by default. The chain lives in your SQLite, not our cloud. We never see the entries. We couldn't if we wanted to.