Skip to content

SHPBL agent evidence series

Nightmare Probe Engine

Turns worst-case fleet hypotheses into the smallest bounded scan that could falsify them.

Status
Submitted, awaiting review
Licence
MIT · zero runtime dependencies
Evidence
29 tests · 210,000 invariant checks

The problem

What is the smallest scan that could disprove our worst theory about the fleet?

Worst-case theories about a fleet get argued rather than tested, and the usual answer to a hunch is another fleet-wide sweep nobody can afford.

What it does

It generates falsifiable worst-case hypotheses from supplied assets and observations, compiles each into the smallest bounded probe with a control cohort and an explicit budget, and returns a SUPPORTED, REFUTED or INCONCLUSIVE verdict with its reasoning.

How it works

No observation, no hypothesis: every hypothesis carries the evidence that suggested it. A SUPPORTED verdict requires both target support and discrimination from the tested controls, so target agreement alone cannot confirm a theory. Every run is a pure function of its inputs, and malformed or out-of-range input fails closed rather than guessing.

Tool surface

MCP over stdio. Compatible with Claude Code, Claude Desktop and Cursor, or usable directly as a TypeScript library. No API key, account or Tenable product is required.

  • nightmare_generate

    Derive deterministic, evidence-seeking hypotheses from supplied assets and observations.

  • nightmare_compile_probe

    Compile one hypothesis into exact targets, an optional control cohort and a budget.

  • nightmare_evaluate_probe

    Judge target versus control observations and return the verdict with reasoning.

What it deliberately does not do

  • It plans and judges; the operator's own scanner executes and hands back observations.
  • No network client, no file writes, no process spawning, no environment reads.
  • Falsification is a first-class result — a refuted hypothesis is recorded, not hidden.

Provenance

Where this came from

SHPBL discovered and composed this product from capability intent across its library and CMPSBL, a sister project by the same developer. It was composed from conard0-git/targeted-nessus-scan and the SHPBL library — new software neither had before, with zero lines of upstream implementation copied. The implementation cleared an exact-file review of its release surface and received its own MIT grant over that reviewed file set. The MIT grant covers only the named files in that one repository; it does not relicense SHPBL, CMPSBL, private harvest machinery, harvested bodies or provenance maps.

SHA-256 · 229d4a98c2c7de04e890484b926efd6240c31e20010deb7d9ad4ae5e3b8def8c

Submission does not imply review, approval, certification or endorsement by Tenable. No Exchange listing exists until a maintainer merges it.