# sup3rus3r/secunet architecture

> Architecture diagram of the GitHub repository sup3rus3r/secunet, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sup3rus3r/secunet
- Repository: https://github.com/sup3rus3r/secunet

## Overview

SecuNet is an autonomous purple-team operations platform: an engineer uses the tactical dashboard to oversee a Commander-coordinated fleet that discovers assets, tests vulnerabilities, evaluates detections, proposes fixes, and monitors posture. The README documents Commander as the sole router and the Command Center as the scoped execution gateway. The graph preserves those documented capabilities; internal storage and context links are grounded in sampled source, while unsampled agent internals are represented at their enclosing source paths.

Main entry points: [`command-center/api/agent_gateway.py`](https://github.com/sup3rus3r/secunet/blob/main/command-center/api/agent_gateway.py) (Agent gateway), [`command-center/api/execution.py`](https://github.com/sup3rus3r/secunet/blob/main/command-center/api/execution.py) (Scoped execution), [`command-center/commander/write_pipeline.py`](https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/write_pipeline.py) (Event write pipeline), [`command-center/commander/context_engine.py`](https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/context_engine.py) (Context engine)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_dashboard["Tactical dashboard"]
  node_dashboard_app["Operations dashboard<br/>[page.tsx]"]
  node_dashboard_panels["Live panels"]
  node_dashboard_ws["WebSocket client<br/>[ws-client.ts]"]
end

subgraph group_orchestration["Command Center"]
  node_commander["Commander<br/>[agent.py]"]
  node_gateway["Agent gateway<br/>[agent_gateway.py]"]
  node_execution["Scoped execution<br/>[execution.py]"]
  node_scope["Scope enforcement<br/>[scope_enforcer.py]"]
  node_hitl["HITL approvals<br/>[hitl.py]"]
  node_websocket["WebSocket service<br/>[websocket.py]"]
  node_reports["Report builder<br/>[report_builder.py]"]
  node_llm_client["LLM client<br/>[llm_client.py]"]
end

subgraph group_agents["Agent fleet"]
  node_recon["Recon agent<br/>[agent.py]"]
  node_exploit["Exploit agent<br/>[agent.py]"]
  node_detect["Detect agent<br/>[agent.py]"]
  node_remediate["Fix Advisor<br/>[agent.py]"]
  node_monitor["Monitor agent<br/>[agent.py]"]
end

subgraph group_memory["Commander memory"]
  node_context["Context engine<br/>[context_engine.py]"]
  node_write_pipeline["Event write pipeline<br/>[write_pipeline.py]"]
  node_rolling[("Rolling window<br/>[rolling_window.py]")]
  node_vector[("Vector store<br/>[vector_store.py]")]
  node_summary_cache[("Summary cache<br/>[summary_cache.py]")]
  node_cold_storage[("Cold storage<br/>[cold_storage.py]")]
end

subgraph group_integrations["External systems"]
  node_target_systems["Authorized targets"]
  node_siem["SIEM platforms"]
  node_llm_provider["LLM provider"]
end

node_engineer(("Engineer"))

node_engineer -->|"operates"| node_dashboard_app
node_dashboard_app -->|"displays"| node_dashboard_panels
node_dashboard_ws -->|"connects"| node_websocket
node_websocket -->|"streams updates"| node_dashboard_panels
node_commander -->|"routes work"| node_gateway
node_gateway -->|"dispatches"| node_recon
node_gateway -->|"dispatches"| node_exploit
node_gateway -->|"dispatches"| node_detect
node_gateway -->|"dispatches"| node_remediate
node_gateway -->|"dispatches"| node_monitor
node_recon -->|"sends results"| node_gateway
node_exploit -->|"sends results"| node_gateway
node_detect -->|"sends results"| node_gateway
node_remediate -->|"sends results"| node_gateway
node_monitor -->|"sends results"| node_gateway
node_recon -->|"requests tools"| node_execution
node_exploit -->|"requests tools"| node_execution
node_detect -->|"requests tools"| node_execution
node_remediate -->|"requests tools"| node_execution
node_monitor -->|"requests tools"| node_execution
node_execution -->|"checks scope"| node_scope
node_execution -->|"requests approval"| node_hitl
node_execution -->|"runs scoped commands"| node_target_systems
node_detect -.->|"integrates"| node_siem
node_commander -->|"queries context"| node_context
node_context -->|"reads events"| node_rolling
node_context -->|"retrieves context"| node_vector
node_context -->|"retrieves summaries"| node_summary_cache
node_context -->|"synthesizes with"| node_llm_client
node_llm_client -->|"requests completion"| node_llm_provider
node_gateway -->|"records events"| node_write_pipeline
node_execution -->|"records commands"| node_write_pipeline
node_write_pipeline -->|"writes events"| node_rolling
node_write_pipeline -->|"stores embeddings"| node_vector
node_write_pipeline -->|"appends audit log"| node_cold_storage
node_write_pipeline -->|"broadcasts events"| node_websocket
node_reports -->|"queries events"| node_cold_storage

click node_dashboard_app "https://github.com/sup3rus3r/secunet/blob/main/dashboard/app/home/page.tsx"
click node_dashboard_panels "https://github.com/sup3rus3r/secunet/tree/main/dashboard/components/toc"
click node_dashboard_ws "https://github.com/sup3rus3r/secunet/blob/main/dashboard/lib/ws-client.ts"
click node_commander "https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/agent.py"
click node_gateway "https://github.com/sup3rus3r/secunet/blob/main/command-center/api/agent_gateway.py"
click node_execution "https://github.com/sup3rus3r/secunet/blob/main/command-center/api/execution.py"
click node_scope "https://github.com/sup3rus3r/secunet/blob/main/command-center/api/scope_enforcer.py"
click node_hitl "https://github.com/sup3rus3r/secunet/blob/main/command-center/api/hitl.py"
click node_websocket "https://github.com/sup3rus3r/secunet/blob/main/command-center/api/websocket.py"
click node_reports "https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/report_builder.py"
click node_recon "https://github.com/sup3rus3r/secunet/blob/main/agents/recon/agent.py"
click node_exploit "https://github.com/sup3rus3r/secunet/blob/main/agents/exploit/agent.py"
click node_detect "https://github.com/sup3rus3r/secunet/blob/main/agents/detect/agent.py"
click node_remediate "https://github.com/sup3rus3r/secunet/blob/main/agents/remediate/agent.py"
click node_monitor "https://github.com/sup3rus3r/secunet/blob/main/agents/monitor/agent.py"
click node_context "https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/context_engine.py"
click node_write_pipeline "https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/write_pipeline.py"
click node_rolling "https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/rolling_window.py"
click node_vector "https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/vector_store.py"
click node_summary_cache "https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/summary_cache.py"
click node_cold_storage "https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/cold_storage.py"
click node_llm_client "https://github.com/sup3rus3r/secunet/blob/main/command-center/llm_client.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_dashboard_app,node_dashboard_panels,node_dashboard_ws toneBlue
class node_commander,node_gateway,node_execution,node_scope,node_hitl,node_websocket,node_reports,node_llm_client toneAmber
class node_recon,node_exploit,node_detect,node_remediate,node_monitor toneMint
class node_context,node_write_pipeline,node_rolling,node_vector,node_summary_cache,node_cold_storage toneRose
class node_target_systems,node_siem,node_llm_provider,node_engineer toneIndigo
```

## Components

### Tactical dashboard

- [Operations dashboard](https://github.com/sup3rus3r/secunet/blob/main/dashboard/app/home/page.tsx): `dashboard/app/home/page.tsx`
- [Live panels](https://github.com/sup3rus3r/secunet/tree/main/dashboard/components/toc): `dashboard/components/toc`
- [WebSocket client](https://github.com/sup3rus3r/secunet/blob/main/dashboard/lib/ws-client.ts): `dashboard/lib/ws-client.ts`

### Command Center

- [Commander](https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/agent.py): `command-center/commander/agent.py`
- [Agent gateway](https://github.com/sup3rus3r/secunet/blob/main/command-center/api/agent_gateway.py): `command-center/api/agent_gateway.py`
- [Scoped execution](https://github.com/sup3rus3r/secunet/blob/main/command-center/api/execution.py): `command-center/api/execution.py`
- [Scope enforcement](https://github.com/sup3rus3r/secunet/blob/main/command-center/api/scope_enforcer.py): `command-center/api/scope_enforcer.py`
- [HITL approvals](https://github.com/sup3rus3r/secunet/blob/main/command-center/api/hitl.py): `command-center/api/hitl.py`
- [WebSocket service](https://github.com/sup3rus3r/secunet/blob/main/command-center/api/websocket.py): `command-center/api/websocket.py`
- [Report builder](https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/report_builder.py): `command-center/commander/report_builder.py`
- [LLM client](https://github.com/sup3rus3r/secunet/blob/main/command-center/llm_client.py): `command-center/llm_client.py`

### Agent fleet

- [Recon agent](https://github.com/sup3rus3r/secunet/blob/main/agents/recon/agent.py): `agents/recon/agent.py`
- [Exploit agent](https://github.com/sup3rus3r/secunet/blob/main/agents/exploit/agent.py): `agents/exploit/agent.py`
- [Detect agent](https://github.com/sup3rus3r/secunet/blob/main/agents/detect/agent.py): `agents/detect/agent.py`
- [Fix Advisor](https://github.com/sup3rus3r/secunet/blob/main/agents/remediate/agent.py): `agents/remediate/agent.py`
- [Monitor agent](https://github.com/sup3rus3r/secunet/blob/main/agents/monitor/agent.py): `agents/monitor/agent.py`

### Commander memory

- [Context engine](https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/context_engine.py): `command-center/commander/context_engine.py`
- [Event write pipeline](https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/write_pipeline.py): `command-center/commander/write_pipeline.py`
- [Rolling window](https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/rolling_window.py): `command-center/commander/rolling_window.py`
- [Vector store](https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/vector_store.py): `command-center/commander/vector_store.py`
- [Summary cache](https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/summary_cache.py): `command-center/commander/summary_cache.py`
- [Cold storage](https://github.com/sup3rus3r/secunet/blob/main/command-center/commander/cold_storage.py): `command-center/commander/cold_storage.py`

### External systems

- **Authorized targets**
- **SIEM platforms**
- **LLM provider**

### Other components

- **Engineer**

## Connections

- Engineer → Operations dashboard: operates
- Operations dashboard → Live panels: displays
- WebSocket client → WebSocket service: connects
- WebSocket service → Live panels: streams updates
- Commander → Agent gateway: routes work
- Agent gateway → Recon agent: dispatches
- Agent gateway → Exploit agent: dispatches
- Agent gateway → Detect agent: dispatches
- Agent gateway → Fix Advisor: dispatches
- Agent gateway → Monitor agent: dispatches
- Recon agent → Agent gateway: sends results
- Exploit agent → Agent gateway: sends results
- Detect agent → Agent gateway: sends results
- Fix Advisor → Agent gateway: sends results
- Monitor agent → Agent gateway: sends results
- Recon agent → Scoped execution: requests tools
- Exploit agent → Scoped execution: requests tools
- Detect agent → Scoped execution: requests tools
- Fix Advisor → Scoped execution: requests tools
- Monitor agent → Scoped execution: requests tools
- Scoped execution → Scope enforcement: checks scope
- Scoped execution → HITL approvals: requests approval
- Scoped execution → Authorized targets: runs scoped commands
- Detect agent → SIEM platforms: integrates
- Commander → Context engine: queries context
- Context engine → Rolling window: reads events
- Context engine → Vector store: retrieves context
- Context engine → Summary cache: retrieves summaries
- Context engine → LLM client: synthesizes with
- LLM client → LLM provider: requests completion
- Agent gateway → Event write pipeline: records events
- Scoped execution → Event write pipeline: records commands
- Event write pipeline → Rolling window: writes events
- Event write pipeline → Vector store: stores embeddings
- Event write pipeline → Cold storage: appends audit log
- Event write pipeline → WebSocket service: broadcasts events
- Report builder → Cold storage: queries events