Counterfactual Exposure Planner
Compares several remediation futures against a sealed exposure graph before anything touches production.
- Status
- Under author review before resubmission
- Licence
- MIT · zero runtime dependencies
- Evidence
- 25 tests · 120,000 invariant checks
The problem
Patch it or isolate it — which future is actually safer?
Patch-or-isolate is argued from intuition, and the planning exercise itself risks corrupting the state of record.
What it does
It clones a sealed exposure graph, applies bounded interventions — patch a finding, isolate an asset, reduce exposure probability, vary criticality as a stated assumption — recomputes weighted risk, reachable attack surface, critical reachable findings and intervention cost, then ranks the resulting futures and marks the Pareto-efficient ones.
How it works
Caller input is never mutated: every scenario runs on a clone, and both baseline and scenario are sealed with SHA-256 canonical digests. Ranking uses deterministic utility with stable tie-breaks, so the same data ranks the same way in tomorrow's review, and Pareto marking stops a dominated option being presented as reasonable. Unknown targets and out-of-range values fail closed.
Tool surface
MCP over stdio. Compatible with Claude Code, Claude Desktop and Cursor, or usable directly as a TypeScript library. No API key, account or Tenable product is required.
exposure_baseline
Validate and seal the baseline exposure graph.
exposure_simulate
Apply bounded interventions to a clone and recompute risk and reachability.
exposure_rank
Rank scenarios by deterministic utility and mark the Pareto-efficient ones.
What it deliberately does not do
- An analysis and decision surface, not an actuator: no network client, no file writes, no process spawning, no environment reads.
- Criticality changes are recorded as stated assumptions, not facts.
- It ranks futures; it does not apply them.
Provenance
Where this came from
SHPBL discovered and composed this product from capability intent across its library and CMPSBL, a sister project by the same developer. It was composed from packetchaos/navi and the SHPBL library — new software neither had before, with zero lines of upstream implementation copied. The implementation cleared an exact-file review of its release surface and received its own MIT grant over that reviewed file set. The MIT grant covers only the named files in that one repository; it does not relicense SHPBL, CMPSBL, private harvest machinery, harvested bodies or provenance maps.
SHA-256 · 517417c9d9cc771a0eb566511e7fef233d45c16b564fedbbc63b60e4075074cc
This tool is not currently submitted to the Exchange. It is held for the author's own review before any resubmission, and nothing here implies Tenable review, approval, certification or endorsement.