PROJECT

iStrix

Defensive security scanning — unprivileged probes, on-site CVE brain, air-gapped by design. Proprietary.

pip install -e ".[all]"Copy

iStrix pairs a single controller with a director and a fan-out of lightweight remote probes, so you can scan networks the controller cannot reach directly. Probes dial home over a rendezvous tunnel, keeping inbound ports closed on the target side. Probes are unprivileged — no root, no kernel drivers, no nmap — and they never attribute: the controller holds the brain, the scoring and the authority.

Controller + director + probes

One iStrix controller directs a director and multiple remote lightweight probes across Linux, Windows and ARM Linux — a fan-out topology built for scanning networks the controller cannot reach directly. Control runs over stdio+TCP with HMAC task tokens, drafted as the ISCP RFC series. Probes gather evidence; they never attribute.

Rendezvous reverse tunnels

Director-ordered dial-home: probes establish an outbound tunnel and the controller pushes tasks back through it. No inbound ports on the probe side.

Unprivileged probes

Probes need nothing but the target network — Python stdlib plus a zero-dependency Rust build, no root, no kernel drivers and no nmap. Contract boxes adopt via single-use burned claims and work only inside licensed IP blocks.

Wire-speed rate caps

Enforced probe-side: mbps, mpps, pps or percentage ceilings, plus adaptive probe scaling and a --speed contract (eco / normal / fast / max).

Appliance ready

Ships as the M8S (Amlogic S905X) running Armbian from eMMC — systemd probe, read-only /boot, atomic state writes, survey-grade WiFi scan/audit/sniffer, and static probe builds for Win10 22H2.

On-site CVE brain, fail-closed

Local-first attribution through a positronic brain with a version gate and veto: exact-ID, then version veto, then lexical/embedding agreement, then abstain. Scores precision 1.00 and coverage 0.90 across 117 golden queries — an abstain handed to an analyst beats a confident wrong CVE. Off-site AI providers are rejected at call time and NVD stays offline by default, so no target, packet or scan result leaves the site.

Four report levels, OS-aware fixes

Brief, detail, threat and remediation — each in HTML, PDF and Markdown with an auto-generated index. Remediation is sorted by priority and written per OS family (Debian/Ubuntu, RHEL/Oracle/Rocky/Alma, Windows, Cisco, printer vendors, embedded/IoT) with version-specific commands you can paste straight into a terminal.

Active Directory forest discovery

One entry CIDR is enough: DNS SRV and PTR lookups enumerate every subnet in the forest, so a single scan reaches domain controllers the scope would otherwise miss. Windows detection uses LDAP RootDSE and IIS rather than guessing at SMB banners.

Proprietary — © 2026 Shing Wong, all rights reserved. Licensed for defensive/reactive security use under a commercial agreement. Versions distributed under Apache-2.0 remain under those terms for their recipients; this and future versions are closed-source. Custom builds and licensing: info@positronic-ai.us.

Part of the ecosystem

Built alongside

Positronic is a small set of pieces that fit together — an engine, a seam, plugins and a network layer. Here is what sits around this project, and where each piece lives.