Scan Coverage Autopilot
A capacity-safe next scan schedule that names what it could not fit, and why.
- Status
- Submitted, awaiting review
- Licence
- MIT · zero runtime dependencies
- Evidence
- 25 tests · 120,000 invariant checks
The problem
What is overdue, what fits in the window, and what did we fail to schedule?
Coverage gets reported as an average, overdue targets quietly fall off the plan, and the work that did not fit is never named.
What it does
It finds stale and never-scanned coverage against risk-tier maximum ages, predicts each target's duration from real scan history, and emits a capacity-bounded, risk-weighted next schedule that explicitly reports every overdue target it could not fit and the reason.
How it works
The current time must be supplied explicitly; wall-clock time is never silently inferred. Duration prediction uses the median of the exact scanner/target history first, then target-wide history, then an explicit estimate. Assignments respect scanner capability, scanner capacity and the planning horizon, each target is scheduled at most once, and every plan is sealed with SHA-256 so two plans can be diffed for coverage and load deltas.
Tool surface
MCP over stdio. Compatible with Claude Code, Claude Desktop and Cursor, or usable directly as a TypeScript library. No API key, account or Tenable product is required.
scan_analyze_coverage
Identify stale targets against risk-tier maximum ages and never-scanned targets.
scan_plan
Emit a capacity-bounded, risk-weighted schedule plus every unscheduled target and its reason.
scan_compare
Diff two sealed plans for coverage and load deltas.
What it deliberately does not do
- An analysis and decision surface, not an actuator — it launches no scans.
- Unschedulable overdue work is reported, never hidden.
- Prediction depends on the history the operator supplies.
Provenance
Where this came from
SHPBL discovered and composed this product from capability intent across its library and CMPSBL, a sister project by the same developer. It was composed from packetchaos/navi and the SHPBL library — new software neither had before, with zero lines of upstream implementation copied. The implementation cleared an exact-file review of its release surface and received its own MIT grant over that reviewed file set. The MIT grant covers only the named files in that one repository; it does not relicense SHPBL, CMPSBL, private harvest machinery, harvested bodies or provenance maps.
SHA-256 · 7b8e60d07eb56252257eda1e4c27cee5e621a14c6118d81b37ef3e1f5665b5f3
Submission does not imply review, approval, certification or endorsement by Tenable. No Exchange listing exists until a maintainer merges it.