Counterfactual Exposure Planner
Compares several remediation futures against a sealed exposure graph before anything touches production.
- Status
- Submitted, awaiting review
- Licence
- MIT · zero runtime dependencies
- Evidence
- 25 tests · 120,000 invariant checks
The problem
Patch it or isolate it — which future is actually safer?
Patch-or-isolate is argued from intuition, and the planning exercise itself risks corrupting the state of record.
What it does
It clones a sealed exposure graph, applies bounded interventions — patch a finding, isolate an asset, reduce exposure probability, vary criticality as a stated assumption — recomputes weighted risk, reachable attack surface, critical reachable findings and intervention cost, then ranks the resulting futures and marks the Pareto-efficient ones.
How it works
Caller input is never mutated: every scenario runs on a clone, and both baseline and scenario are sealed with SHA-256 canonical digests. Ranking uses deterministic utility with stable tie-breaks, so the same data ranks the same way in tomorrow's review, and Pareto marking stops a dominated option being presented as reasonable. Unknown targets and out-of-range values fail closed.
Tool surface
MCP over stdio. Compatible with Claude Code, Claude Desktop and Cursor, or usable directly as a TypeScript library. No API key, account or Tenable product is required.
exposure_baseline
Validate and seal the baseline exposure graph.
exposure_simulate
Apply bounded interventions to a clone and recompute risk and reachability.
exposure_rank
Rank scenarios by deterministic utility and mark the Pareto-efficient ones.
What it deliberately does not do
- An analysis and decision surface, not an actuator: no network client, no file writes, no process spawning, no environment reads.
- Criticality changes are recorded as stated assumptions, not facts.
- It ranks futures; it does not apply them.
Provenance
Where this came from
SHPBL discovered and composed this product from capability intent across its library and CMPSBL, a sister project by the same developer. It was composed from packetchaos/navi and the SHPBL library — new software neither had before, with zero lines of upstream implementation copied. The implementation cleared an exact-file review of its release surface and received its own MIT grant over that reviewed file set. The MIT grant covers only the named files in that one repository; it does not relicense SHPBL, CMPSBL, private harvest machinery, harvested bodies or provenance maps.
SHA-256 · 517417c9d9cc771a0eb566511e7fef233d45c16b564fedbbc63b60e4075074cc
Submission does not imply review, approval, certification or endorsement by Tenable. No Exchange listing exists until a maintainer merges it.