Policy & Hardening

 ██████╗ ██╗██████╗ ███████╗ ██████╗ ███╗   ██╗
██╔════╝ ██║██╔══██╗██╔════╝██╔═══██╗████╗  ██║
██║  ███╗██║██║  ██║█████╗  ██║   ██║██╔██╗ ██║
██║   ██║██║██║  ██║██╔══╝  ██║   ██║██║╚██╗██║
╚██████╔╝██║██████╔╝███████╗╚██████╔╝██║ ╚████║
 ╚═════╝ ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═╝  ╚═══╝

What is Gideon?

Gideon is not a script. It is not a scanner. It is an autonomous security operations agent that thinks, plans, and acts — transforming complex threat intelligence questions into step-by-step research missions, executing them against live data sources, checking its own reasoning, and delivering confident, evidence-backed answers.

Where traditional security tools require expert configuration and manual correlation, Gideon operates with goal-directed autonomy: break down the problem, retrieve the data, validate the results, and synthesize a clear picture of the threat landscape.

Built for dual-mode operations — functioning as a defensive analyst by default (detection, mitigation, and protection) but capable of transitioning into a fully autonomous Red Team Mode for authorized offensive security engagements. Every response is grounded in real data, every action is auditable, and every output is actionable.

> gideon cve CVE-2024-21887

🔍 Researching CVE-2024-21887...
📡 Querying NVD API...
📋 Cross-referencing CISA KEV catalog...
🧠 Analyzing exploit chain and affected systems...
🛡️ Generating mitigation strategy...

✅ CVE-2024-21887 | Ivanti Connect Secure | CVSS 9.1 (Critical)
   Command injection in web components — exploited in the wild.
   CISA KEV: Yes | Patch Available: Yes
   Recommended: Immediate patching + IoC sweep on outbound traffic.

Core Capabilities

NVIDIA AI Stack Integration

Gideon is purpose-built to leverage NVIDIA’s enterprise AI infrastructure — recognized at NVIDIA GTC 2026 as a leading implementation of the NVIDIA AI stack for security operations.

┌─────────────────────────────────────────────────────────┐
│                   NVIDIA AI STACK                        │
├──────────────┬──────────────┬──────────────┬────────────┤
│     NIM      │   Morpheus   │ PersonaPlex  │    NeMo    │
│  GPU-accel   │   Threat     │  Voice AI    │ Guardrails │
│  local LLMs  │  Detection   │  Ops Mode    │  & Safety  │
└──────────────┴──────────────┴──────────────┴────────────┘
                       │
               ┌───────▼───────┐
               │    RAPIDS     │
               │  Accelerated  │
               │  IOC Analysis │
               └───────────────┘

Advanced Skills System

Gideon’s modular Skills architecture extends core capabilities with specialized intelligence modules. Each skill operates as an autonomous sub-agent with its own toolset, state machine, and command vocabulary.

🔴 Security Research

Advanced-mode bug bounty hunting, penetration testing assistance, and CTF operations.

> skills security start bounty         # Launch bug bounty research mode
> skills security scope [program]      # Define the target scope
> skills security recon [target]       # Begin passive reconnaissance
> skills security hunt [vuln-class]    # Focus hunt on vulnerability class

Modes: bounty · pentest · research · ctf

☠️ Post-Exploitation [RED TEAM MODE]

Autonomous post-exploitation operations for authorized engagements: AD mapping, lateral movement, and privilege escalation.

> skills postex-help                   # Show command help
> skills post-exploitation lateral [IP]# Plan intelligent lateral movement
> skills post-exploitation sitrep      # Display C2 sessions and mapped hosts
> skills post-exploitation harvest     # Create credential harvesting playbooks

🗡️ Weaponization [RED TEAM MODE]

Payload generation, obfuscation, and EDR evasion library.

> skills weaponization payload generate reverse_shell windows 10.10.14.1
> skills weaponization payload evade   # Recommend EDR bypass techniques
> skills weaponization payload encode [file] x86/shikata_ga_nai

🎙️ Voice AI (NVIDIA PersonaPlex)

Hands-free security operations — narrate queries, receive spoken threat briefings.

> skills voice speak [text]            # Text-to-speech output
> skills voice voice-set [voice-id]    # Select voice profile
> skills voice voice-list              # List available voices
> skills voice voice-enable            # Activate voice mode globally

🔍 Threat Detection (NVIDIA Morpheus)

Real-time behavioral analysis and threat classification using Morpheus AI pipelines.

• DFP (Digital Fingerprinting): Detects anomalous user and entity behavior
• DGA Detection: Identifies domain generation algorithm traffic
• Anti-Phishing: URL and content analysis for phishing indicators
• Ransomware Patterns: Early-stage ransomware behavioral signatures

🛡️ Governance & Safety (NVIDIA NeMo Guardrails)

Enterprise-grade AI safety layer — topic steering, self-correction, and full audit trails.

• Jailbreak Detection: Intercepts adversarial prompt injection attempts on Gideon itself
• Topic Steering: Keeps operations within defined defensive scope
• Self-Correction: Detects and corrects off-target reasoning before output
• Audit Logging: Cryptographically referenced log of every agent action

🔐 OpenClaw Sentinel

Comprehensive security sidecar for OpenClaw AI agent deployments.

> skills sentinel openclaw-init                      # Initialize sentinel monitoring
> skills sentinel openclaw-status                    # Runtime security status
> skills sentinel openclaw-audit                     # Full deployment audit
> skills sentinel openclaw-scan-skill [name]         # Scan skill for vulnerabilities
> skills sentinel openclaw-scan-injection [content]  # Prompt injection analysis
> skills sentinel openclaw-report                    # Generate security report

CVE Coverage: CVE-2026-25253 · CVE-2026-24763 · CVE-2026-25157 · CVE-2026-22708 · ClawHavoc campaign

Architecture

Gideon implements a ReAct (Reasoning + Acting) agent loop — plan, act, observe, reflect, repeat — with a modular tool layer and safety guardrails at every transition.

flowchart TD
    CLI["🖥️ Gideon CLI\nInteractive Shell"] --> Core["⚙️ Agent Core\nReAct Loop"]

    Core --> Plan["🧠 Task Planning\n& Decomposition"]
    Core --> Reflect["🔄 Self-Reflection\n& Validation"]
    Core --> Tools["🔧 Tools & Skills Layer"]

    subgraph INTEL["📡 Threat Intelligence"]
        NVD["NVD + CISA KEV\nCVE Research"]
        VT["VirusTotal + AbuseIPDB\nIOC Reputation"]
        EXA["Exa AI\nNeural Search"]
        TAVILY["Tavily\nWeb Search"]
    end

    subgraph NVIDIA["🟢 NVIDIA AI Stack"]
        NIM["NIM\nLocal LLM Inference"]
        MORPHEUS["Morpheus\nThreat Pipelines"]
        PLEX["PersonaPlex\nVoice AI"]
        NEMO["NeMo Guardrails\nSafety Layer"]
        RAPIDS["RAPIDS\nData Analytics"]
    end

    subgraph MODELS["🤖 LLM Providers"]
        OR["OpenRouter\n400+ Models"]
        OAI["OpenAI"]
        ANT["Anthropic"]
        GGL["Google Gemini"]
        OLL["Ollama\nLocal"]
    end

    subgraph MCP["🔌 MCP Servers"]
        MCPS["Custom Tool Servers\nExtensible Protocol"]
    end

    Tools --> INTEL
    Tools --> NVIDIA
    Tools --> MODELS
    Tools --> MCP
    Reflect --> Core

Installation

Prerequisites

Install Bun

macOS / Linux

curl -fsSL https://bun.com/install | bash

Windows

powershell -c "irm bun.sh/install.ps1|iex"

Quick Start

# 1. Clone
git clone https://github.com/Cogensec/Gideon.git
cd Gideon

# 2. Install dependencies
bun install

# 3. Configure environment
cp env.example .env
# → Edit .env with your API keys

# 4. Launch
bun start

That’s it. No Docker. No Python environment. No security tools on your host. Just Bun.

Configuration

All configuration lives in .env and gideon.config.yaml.

LLM & Model Providers

Threat Intelligence & Search

NVIDIA AI Stack (Optional — Advanced)

Usage

Interactive Shell

bun start

Launches the Gideon interactive shell. Type natural language security questions or use command shortcuts.

Command Reference

# Intelligence Operations
gideon brief                          # Generate daily threat intelligence briefing
gideon cve CVE-2024-21887             # Deep CVE analysis with CVSS + KEV status
gideon ioc 185.220.101.47             # IP reputation check
gideon ioc domain malicious.xyz       # Domain reputation check
gideon ioc hash <sha256>              # File hash reputation check
gideon search "Ivanti zero day 2024"  # Neural semantic search

# Policy & Hardening
gideon policy aws                     # AWS hardening checklist
gideon policy azure                   # Azure hardening checklist
gideon policy gcp                     # GCP hardening checklist
gideon policy k8s                     # Kubernetes hardening checklist
gideon policy okta                    # Okta hardening checklist

# Skills & System
skills                                # Show all enabled skills + commands
skills security start [mode]          # Launch security research skill
skills voice voice-enable             # Enable voice AI mode
skills sentinel openclaw-init         # Initialize OpenClaw Sentinel

Example Sessions

Threat Research

> What are the latest Ivanti vulnerabilities being exploited in the wild?

🔍 Planning research...
  ├── Query NVD for Ivanti CVEs (last 90 days)
  ├── Cross-reference CISA KEV catalog
  ├── Neural search for exploit write-ups and PoC reports
  └── Synthesize threat actor TTPs

[Results: 4 critical CVEs, 2 in CISA KEV, active exploitation by UNC5337...]

IOC Sweep

> Analyze this C2 IP: 45.142.212.100

🌐 Checking VirusTotal reputation...
🚨 Checking AbuseIPDB history...
📡 Passive DNS resolution...
🔗 Threat actor attribution...

[Result: Known Cobalt Strike C2 — associated with ALPHV ransomware cluster]

Project Structure

Gideon/
├── src/
│   ├── agent/          # Core ReAct agent loop + task planner
│   ├── tools/          # CVE, IOC, search, policy tool implementations
│   ├── skills/         # Modular skills system
│   │   ├── security/   # Security research skill
│   │   ├── voice/      # NVIDIA PersonaPlex voice AI
│   │   ├── detection/  # NVIDIA Morpheus threat detection
│   │   ├── governance/ # NeMo guardrails + audit
│   │   └── sentinel/   # OpenClaw Sentinel security sidecar
│   ├── providers/      # LLM provider adapters (OpenAI, Anthropic, OpenRouter...)
│   ├── mcp/            # MCP server integrations
│   └── config/         # Configuration loader + validator
├── mcp-servers/        # Custom MCP server implementations
├── docs/               # Extended documentation
├── gideon.config.yaml  # Main configuration
├── env.example         # Environment template
└── package.json

Roadmap

Safety & Ethics

Gideon is designed with a strict Dual-Mode Security Architecture. By default, it operates in Defensive Mode — focusing on detection, mitigation, analysis, and protection.

When explicitly authorized, operators can unlock Red Team Mode for active engagements. The following safety mechanisms govern both modes:

1. Scope Enforcement — In Red Team Mode, every offensive action (Nmap, Metasploit, SQLMap) is validated against an explicit EngagementScope. Out-of-scope executions are hard-blocked.
2. Sandboxed Execution — All offensive tools run within an isolated, resource-constrained Docker sandbox (gideon-toolbox).
3. Defensive Prompting — In Defensive Mode, agent reasoning is anchored strictly to mitigation, patching, and protection outcomes.
4. Data Redaction — Sensitive values (keys, credentials, PII) are automatically scrubbed from logs and outputs.
5. NeMo Guardrails — Enterprise-grade topic control, self-correction, and jailbreak interception remain active across both modes to prevent adversarial manipulation of the agent itself.
6. Audit Trail — Every agent action, exploitation attempt, and tool invocation is logged with a traceable, reviewable record in the engagement audit file.

⚠️ Legal Notice: Gideon's Red Team Mode is intended for explicitly authorized security research, comprehensive penetration testing, and educational use only. Always ensure you have legal authorization before analyzing or exploiting any system, IP, or domain. Users are solely responsible for compliance with applicable laws.

Contributing

Contributions are welcome. See <CONTRIBUTING.md> for guidelines.

• Security Vulnerabilities: Do not open public issues. Contact security@cogensec.com directly.
• Feature Requests: Open a Discussion
• Bug Reports: Open an Issue with reproduction steps and environment details

# Development setup
git clone https://github.com/Cogensec/Gideon.git
cd Gideon
bun install
bun run dev          # Hot-reload development mode
bun run test         # Run test suite
bun run lint         # TypeScript + ESLint checks