Nightmare Probe Engine
Turns worst-case fleet hypotheses into the smallest bounded scan that could falsify them.
- Status
- Under author review before resubmission
- Licence
- MIT · zero runtime dependencies
- Evidence
- 29 tests · 210,000 invariant checks
The problem
What is the smallest scan that could disprove our worst theory about the fleet?
Worst-case theories about a fleet get argued rather than tested, and the usual answer to a hunch is another fleet-wide sweep nobody can afford.
What it does
It generates falsifiable worst-case hypotheses from supplied assets and observations, compiles each into the smallest bounded probe with a control cohort and an explicit budget, and returns a SUPPORTED, REFUTED or INCONCLUSIVE verdict with its reasoning.
How it works
No observation, no hypothesis: every hypothesis carries the evidence that suggested it. A SUPPORTED verdict requires both target support and discrimination from the tested controls, so target agreement alone cannot confirm a theory. Every run is a pure function of its inputs, and malformed or out-of-range input fails closed rather than guessing.
Tool surface
MCP over stdio. Compatible with Claude Code, Claude Desktop and Cursor, or usable directly as a TypeScript library. No API key, account or Tenable product is required.
nightmare_generate
Derive deterministic, evidence-seeking hypotheses from supplied assets and observations.
nightmare_compile_probe
Compile one hypothesis into exact targets, an optional control cohort and a budget.
nightmare_evaluate_probe
Judge target versus control observations and return the verdict with reasoning.
What it deliberately does not do
- It plans and judges; the operator's own scanner executes and hands back observations.
- No network client, no file writes, no process spawning, no environment reads.
- Falsification is a first-class result — a refuted hypothesis is recorded, not hidden.
Provenance
Where this came from
SHPBL discovered and composed this product from capability intent across its library and CMPSBL, a sister project by the same developer. It was composed from conard0-git/targeted-nessus-scan and the SHPBL library — new software neither had before, with zero lines of upstream implementation copied. The implementation cleared an exact-file review of its release surface and received its own MIT grant over that reviewed file set. The MIT grant covers only the named files in that one repository; it does not relicense SHPBL, CMPSBL, private harvest machinery, harvested bodies or provenance maps.
SHA-256 · 229d4a98c2c7de04e890484b926efd6240c31e20010deb7d9ad4ae5e3b8def8c
This tool is not currently submitted to the Exchange. It is held for the author's own review before any resubmission, and nothing here implies Tenable review, approval, certification or endorsement.