Fleet Immune System

The problem

Which findings are one condition, and which neighbours will show it next?

Findings arrive as a flat list, so related exposure is triaged one row at a time and the same analysis restarts on the second occurrence.

What it does

It discovers co-occurring fleet threat patterns above an explicit minimum support, synthesizes non-executing defensive recipes from a pattern and its signals, retains successful outcomes as recallable memory, and names adjacent cohorts in the supplied topology likely to carry the same variant.

How it works

Unsupported coincidence is not a pattern — support is explicit. A synthesized antibody is a described, reviewable response plan, and the server has no actuator to run it. Crystallized outcomes are recalled by pattern similarity above a threshold, and breeding two recipes is deterministic and may not introduce destructive action absent from both parents.

Tool surface

MCP over stdio. Compatible with Claude Code, Claude Desktop and Cursor, or usable directly as a TypeScript library. No API key, account or Tenable product is required.

• immune_discover

  Return co-occurring patterns meeting an explicit minimum support.

• immune_synthesize

  Produce a non-executing antibody recipe from a pattern and its signals.

• immune_cycle

  Plan one cycle: patterns, variants, memory recall and adjacent-cohort targets.

• immune_crystallize

  Retain a pattern, antibody and outcome above a confidence floor.

• immune_recall

  Return the closest retained crystal, or nothing below the similarity threshold.

• immune_breed

  Deterministically combine two recipes without escalating destructive action.

What it deliberately does not do

• ·An analysis and decision surface, not an actuator: no network client, no file writes, no process spawning, no environment reads.
• ·Immune memory is session-local.
• ·Unknown fields, malformed signals and out-of-range thresholds fail closed.