How sup3rus3r/secunet works
SecuNet is an autonomous purple-team operations platform: an engineer uses the tactical dashboard to oversee a Commander-coordinated fleet that discovers assets, tests vulnerabilities, evaluates detections, proposes fixes, and monitors posture. The README documents Commander as the sole router and the Command Center as the scoped execution gateway. The graph preserves those documented capabilities; internal storage and context links are grounded in sampled source, while unsampled agent internals are represented at their enclosing source paths.
Main entry points: agent_gateway.py Agent gateway · execution.py Scoped execution · write_pipeline.py Event write pipeline · context_engine.py Context engine
Components 26
Tactical dashboard
- Operations dashboard
dashboard/app/home/page.tsx - Live panels
dashboard/components/toc - WebSocket client
dashboard/lib/ws-client.ts
Command Center
- Commander
command-center/commander/agent.py - Agent gateway
command-center/api/agent_gateway.py - Scoped execution
command-center/api/execution.py - Scope enforcement
command-center/api/scope_enforcer.py - HITL approvals
command-center/api/hitl.py - WebSocket service
command-center/api/websocket.py - Report builder
command-center/commander/report_builder.py - LLM client
command-center/llm_client.py
Agent fleet
- Recon agent
agents/recon/agent.py - Exploit agent
agents/exploit/agent.py - Detect agent
agents/detect/agent.py - Fix Advisor
agents/remediate/agent.py - Monitor agent
agents/monitor/agent.py
Commander memory
- Context engine
command-center/commander/context_engine.py - Event write pipeline
command-center/commander/write_pipeline.py - Rolling window
command-center/commander/rolling_window.py - Vector store
command-center/commander/vector_store.py - Summary cache
command-center/commander/summary_cache.py - Cold storage
command-center/commander/cold_storage.py
External systems
- Authorized targets
- SIEM platforms
- LLM provider
Other components
- Engineer
Connections 37
- Engineer → Operations dashboard: operates
- Operations dashboard → Live panels: displays
- WebSocket client → WebSocket service: connects
- WebSocket service → Live panels: streams updates
- Commander → Agent gateway: routes work
- Agent gateway → Recon agent: dispatches
- Agent gateway → Exploit agent: dispatches
- Agent gateway → Detect agent: dispatches
- Agent gateway → Fix Advisor: dispatches
- Agent gateway → Monitor agent: dispatches
- Recon agent → Agent gateway: sends results
- Exploit agent → Agent gateway: sends results
- Detect agent → Agent gateway: sends results
- Fix Advisor → Agent gateway: sends results
- Monitor agent → Agent gateway: sends results
- Recon agent → Scoped execution: requests tools
- Exploit agent → Scoped execution: requests tools
- Detect agent → Scoped execution: requests tools
- Fix Advisor → Scoped execution: requests tools
- Monitor agent → Scoped execution: requests tools
- Scoped execution → Scope enforcement: checks scope
- Scoped execution → HITL approvals: requests approval
- Scoped execution → Authorized targets: runs scoped commands
- Detect agent → SIEM platforms: integrates
- Commander → Context engine: queries context
- Context engine → Rolling window: reads events
- Context engine → Vector store: retrieves context
- Context engine → Summary cache: retrieves summaries
- Context engine → LLM client: synthesizes with
- LLM client → LLM provider: requests completion
- Agent gateway → Event write pipeline: records events
- Scoped execution → Event write pipeline: records commands
- Event write pipeline → Rolling window: writes events
- Event write pipeline → Vector store: stores embeddings
- Event write pipeline → Cold storage: appends audit log
- Event write pipeline → WebSocket service: broadcasts events
- Report builder → Cold storage: queries events