Security visibility for your network and your software supply chain. Local-first by design.
Two questions decide the security posture of most organizations: what is on the network, and what is in the software. SecOpsAI answers both, on your own hardware.
SecOpsAI Edge discovers every device on your network and flags risky changes. SecOpsAI Research watches eight package registries for typosquats and suspicious releases. The platform correlates this telemetry into findings with evidence, severity, and a next action.
All analysis runs on your hardware. Telemetry stays in a local store. Cloud reports contain minimized findings only.
SecOpsAI is one platform with four components. Each component has one clear responsibility.
| COMPONENT | RESPONSIBILITY | RUNS ON |
|---|---|---|
| edge-sensor | Collects network telemetry: asset discovery, service exposure, Wi-Fi observation, scan jobs, sensor heartbeat. | MacBook, Linux host, or Raspberry Pi on the customer LAN |
| core | Owns the canonical store: findings, asset graph, triage, research cases, correlation, and reports. | Local workstation or hosted API |
| research-engine | Monitors package registries, scores events against watchlists, and manages disclosure and publication workflows. | Local worker or hosted collector service |
| console | Operator dashboard for findings, assets, research, schedules, and reports. | Browser, served statically |
The OpenClaw plugin connects the platform to local automation runtimes. It can start scans, read findings, and prepare actions. Approval-gated actions always need an operator.
Select your platform. Run the command. The install takes less than five minutes.
curl -fsSL https://secopsai.dev/install.sh | bash
Requires macOS 12 or later. Edge discovery requires Nmap. The installer checks for it.
curl -fsSL https://secopsai.dev/install.sh | bash
Requires Python 3.10 or later. A systemd service keeps the Edge worker running.
wsl --install -d Ubuntu
SecOpsAI runs in WSL2 on Windows. After WSL is ready, use the Linux procedure.
openclaw plugins install secopsai
The OpenClaw plugin connects SecOpsAI to your local automation runtime.
| MODULE | FUNCTION | STATUS |
|---|---|---|
| secopsai-edge | Discovers network assets, open services, and Wi-Fi networks. Flags new devices, missing devices, and risky changes. Builds the asset inventory automatically. | Live LIVE |
| secopsai-research | Monitors eight package registries for typosquats and suspicious releases. Scores every event against your watchlists. Feeds research cases, disclosure, and published advisories. | Live LIVE |
| supply-chain-scanner | Scans project dependencies for known vulnerabilities, malicious packages, and policy violations across supported ecosystems. | Live LIVE |
| triage-engine | Correlates findings across hosts and platforms. Tracks status, disposition, notes, and evidence. Prevents duplicate work. | Live LIVE |
| asset-graph | Links sites, sensors, assets, services, and Wi-Fi networks into one queryable graph. Answers what changed, when, and where. | Live LIVE |
| adaptive-response | Evaluates response posture from signal memory. Recommends containment actions. An operator approves every action. | Live LIVE |
| ai-dependency-guard | Checks AI-suggested packages for hallucinated names and lookalike (slopsquatting) risk before installation. | Live LIVE |
| reports | Generates executive and technical reports from findings and graph context. Exports printable, client-ready documents. | Live LIVE |
| splunk-hec | Exports normalized findings and report summaries to Splunk HEC. Raw telemetry never leaves the local store. | Live LIVE |
| secopsai-cloud | Hosted dashboard, scheduled scans, and multi-site workflows for teams and service providers. | Pilot PILOT |
| MODEL | DESCRIPTION | BEST FOR |
|---|---|---|
| local-cli | Run SecOpsAI as a terminal tool. Local store, local analysis, no external services required. | Individual operators and evaluation |
| macbook-sensor | A MacBook acts as the Edge sensor. Nmap discovery, Wi-Fi observation, scheduled scans. | First pilot and proof of value |
| appliance | A Raspberry Pi or mini PC runs as a permanent Edge sensor with a background service. | Offices and customer sites |
| hosted-pilot | Hosted API and dashboard with local sensors. Central findings, reports, and schedules. | Teams and managed service providers |
SecOpsAI uses AI where it helps: summaries, explanations, and report text. The platform never lets AI decide what is true.
| DATA TYPE | LOCATION | LEAVES YOUR SYSTEM? |
|---|---|---|
| raw-scans | Local store only | Never |
| package-artifacts | Local quarantine | Never executed; sandbox upload needs approval |
| findings | Local store; minimized copy for reports | Only as minimized findings |
| ai-inputs | Normalized finding fields only | Identifiers are redacted or hashed first |
SecOpsAI is terminal-native. The example shows a standard operator session.
$ secopsai refresh --platform macos,openclaw,hermes [OK] Collected host and agent telemetry. Findings persisted to the local store. $ secopsai research worker run --once [OK] 8 collectors due · 6 registries current · 2 coverage gaps queued for replay $ secopsai research score run [OK] 1,204 events scored · 1 candidate above threshold $ secopsai list --severity high HIGH Possible typosquat package observed on nuget feed CAN-… | reference: braintree | status: new | review required
SecOpsAI collects and analyzes. It takes no offensive action. These rules apply everywhere in the platform.
| REF | DOCUMENT | LOCATION |
|---|---|---|
| [R1] | Operator documentation and runbooks | docs.secopsai.dev |
| [R2] | Security research and advisories | blog.secopsai.dev |
| [R3] | Source code and issue tracker | github.com/Techris93/secopsai |
| [R4] | SecOpsAI Edge deployment guide | docs.secopsai.dev/edge-integration |
| [R5] | Research discovery and surveillance operations | docs.secopsai.dev/research-discovery |
| [R6] | Research cases and disclosure workflow | docs.secopsai.dev/research-cases |