Security Genome Reactor
Evolves scan and policy configurations against the fleet's measured phenotype instead of its labels.
- Status
- Submitted, awaiting review
- Licence
- MIT · zero runtime dependencies
- Evidence
- 39 tests · 420,000 invariant checks
The problem
Is this scan policy the best one, or just the one we inherited?
Scan and policy profiles are inherited from asset labels nobody re-checks, so a mislabelled group keeps driving the wrong configuration and no one dares change it.
What it does
It infers latent security phenotypes from observed findings rather than operator labels, seeds competing candidate genomes per phenotype, evolves them under measured fitness, and keeps an explicit parent-before-child ancestry graph for every configuration in production.
How it works
Phenotypes come from observed findings and compliance behaviour, with cloud labels explicitly refused as ground truth. Callers may supply real measured fitness per genome; rehearsal is the fallback and is never presented as measurement. A genome becomes a bounded target/policy/profile trial plan rather than a mutation applied anywhere.
Tool surface
MCP over stdio. Compatible with Claude Code, Claude Desktop and Cursor, or usable directly as a TypeScript library. No API key, account or Tenable product is required.
genome_infer_phenotypes
Infer phenotypes from records above an explicit threshold.
genome_seed
Seed several competing genomes for one phenotype.
genome_evolve
Run one deterministic generation using supplied measured fitness, or rehearsal.
genome_trial_plan
Translate one genome into a bounded target, policy and profile trial plan.
genome_lineage
Return ancestry in parent-before-child order and reject cycles.
What it deliberately does not do
- An analysis and decision surface, not an actuator — it mutates no live configuration.
- Populations below two genomes, unknown ids and invalid thresholds fail closed.
- Rehearsal fitness is labelled as rehearsal, never as measurement.
Provenance
Where this came from
SHPBL discovered and composed this product from capability intent across its library and CMPSBL, a sister project by the same developer. It was composed from conard0-git/targeted-nessus-scan and the SHPBL library — new software neither had before, with zero lines of upstream implementation copied. The implementation cleared an exact-file review of its release surface and received its own MIT grant over that reviewed file set. The MIT grant covers only the named files in that one repository; it does not relicense SHPBL, CMPSBL, private harvest machinery, harvested bodies or provenance maps.
SHA-256 · 6cfa01dce08999e22e83eb4e1f6f5ee652d91e8073f11aa54414e601a69499da
Submission does not imply review, approval, certification or endorsement by Tenable. No Exchange listing exists until a maintainer merges it.