Capability catalog
Everything ROOTVIEL evaluates
17 agentic families and 4 overlays. The whole catalog is shown on purpose — a signal of robustness — and each entry publishes its real technical state and its declared limits. What is not fully available always carries a non-empty limitation; what cannot be proven is marked UNKNOWN, never “safe”.
status is code maturity; availability is whether it is offerable, kept orthogonal. ingest is how a target enters (pull, upload, live, host, observed, overlay). RoE marks families that act on live targets and require signed Rules of Engagement. See how the catalog works and the signed order protocol.
| Family / overlay | Maturity | Availability | Ingest |
|---|---|---|---|
| Autonomous offensive — live targets | |||
| RAVEN — Verified pentestRoEFAM-PENTEST-WEB | ready | available | live |
| Autonomous Attack SwarmRoEFAM-SWARM | ready | available | live |
| NEMESIS — Autonomous frontier red-teamRoEFAM-NEMESIS | experimental | lab-only | none |
| Code & applications | |||
| Source codeFAM-CODE-SRC | ready | available | pull |
| Design / vibe codingFAM-CODE-DESIGN | beta | partial | pull |
| Binary / artifactFAM-BINARY | ready | available | upload |
| Generative AI | |||
| GenAI (static)FAM-GENAI-STATIC | ready | available | pull |
| GenAI (live red-team)RoEFAM-GENAI-LIVE | ready | available | live |
| MCP / agent toolsFAM-GENAI-MCP | ready | available | pull |
| MCP (live red-team)RoEFAM-GENAI-MCP-LIVE | experimental | experimental | live |
| Agent-swarm collusionFAM-GENAI-SWARM | experimental | experimental | pull |
| Infrastructure & systems | |||
| Container / infra / cloudFAM-INFRA | ready | available | pull |
| Server / hostFAM-HOST | ready | available | host |
| NetworkRoEFAM-NETWORK | beta | partial | upload, live |
| Runtime behaviourFAM-RUNTIME | beta | partial | observed |
| Forensic postmortem (DFIR)FAM-FORENSIC | beta | partial | upload |
| Assurance & compliance overlays | |||
| Assurance / containmentFAM-ASSURANCE | ready | available | pull |
| Cryptographic sealoverlayOVL-CRYPTO-SEAL | ready | available | overlay |
| GDPR / EU AI ActoverlayOVL-GDPR | ready | available | overlay |
| LGPD (Latam)overlayOVL-LGPD | partial | partial | overlay |
| Attack chains & adversarial validationoverlayOVL-ATTACK-CHAIN | partial | partial | overlay |
maturity is code readiness; availability is whether it is offerable, kept orthogonal; ingest is how a target enters; RoE marks families that act on live targets. The full description and declared limits for each row are in its catalog fiche below — this matrix is generated from the same source, so it can never drift from it.
Autonomous offensive — live targets
Operate against running systems, so they are gated by signed Rules of Engagement.
RAVEN — Verified pentest
Against a live endpoint: discovers the web / network / TLS surface and detects a broad range of classes — and, distinctively, re-derives and verifies each finding from the recorded exchange before reporting it.
Missions are web-audit / tls-audit / exploit-check (verify-over-tool + membrane). Frontier reasoning and the agentic offense loop do not run against real external targets — that is lab-only (see NEMESIS). “Zero false positives” is a design property (no proof ⇒ no finding), not a measured rate; GraphQL/SOAP/WebSocket adapters prove only a subset today.
Autonomous Attack Swarm
A coordinated offensive swarm: N specialized agents attack N live targets in parallel, collaborate by capability, and prove with an observed postcondition.
Runs coordinated RAVEN agents over live targets, verified end-to-end, in a single process; multi-target fan-out from a single order needs multi-input ingest wiring. Diverse per-agent priors are not wired yet — today it splits territory by target, not by hypothesis.
NEMESIS — Autonomous frontier red-team
An autonomous offensive agent that reasons with a frontier model and chains the attack A→B→C by itself, inside an authorized cyber-range.
Lab-only by design: it runs in a cyber-range against ground truth, never against a real external target, and it is not an offerable scan. The genuinely offensive walk against real services is deliberately held back and is never run against production systems.
Code & applications
Source code
Vulnerabilities in the code: injection, taint / dataflow, secrets, cryptography and TLS, and supply chain.
Native taint with provenance is strongest for Python and the common injection classes; it is single-pass and straight-line (interprocedural, alias and branch precision are future work). Other languages are presence-based rather than full taint.
Design / vibe coding
Insecure-design defects demonstrable from the structure (OWASP A04): privilege concentration, trust-boundary violations, fail-open gates, model output reaching a privileged sink, security-by-convention.
Python-only, derived from the graph; the cross-file trust-flow class stays structural and is not promoted. Only high-severity structural classes are surfaced.
Binary / artifact
Hardening of a shipped artifact (NX / PIE / RELRO / stack canary), dangerous imports and embedded secrets.
Severity is advisory; packing detection is architecturally out of scope today; no external held-out validation.
Generative AI
GenAI (static)
The LLM / RAG / agent surface in a repository, without running it: excessive agency, identity, and prompt-injection surface in the code.
The architecture graph covers Python plus a first-pass JS/TS front end; other languages degenerate to a single node. The deeper agentic/RAG classes (taint-to-tool, unscoped retrieval, unbounded loops) are not yet end-to-end verified.
GenAI (live red-team)
Tests the running model or app: jailbreak, prompt-injection and prompt-leak, adapting the probes to what the system responds.
Requires a live target and signed Rules of Engagement. Live-model defense evaluation is probabilistic by nature; results are not promoted as deterministic findings and no success-rate numbers are published.
MCP / agent tools
The Model Context Protocol surface: tool poisoning, rug-pull / schema drift, and abuse of topology or trust boundaries.
Covers the static MCP surface and an enumerated server; live-server red-teaming is a separate experimental family. Decoding of nested/poisoned content is bounded.
MCP (live red-team)
Attacks a live MCP server: enumerates its tools and maps description-poisoning, schema-drift and rug-pull to the MCP invariants, promoted by the membrane.
Experimental and not runnable from the platform: reachable only directly, and not yet wired into the platform’s run flow.
Agent-swarm collusion
Does the aggregate capability of a swarm cross a boundary that no single agent crosses alone? Capability composition over shared channels.
Built and validated on its own corpus but not integrated — no mission declares its frontier and no bridge turns a verified collusion into a reported finding. It is declared experimental so the platform never renders a “run” button.
Infrastructure & systems
Container / infra / cloud
Hardening of Dockerfile / compose / nginx and Terraform infrastructure-as-code (misconfiguration, privileges, exposure, IAM escalation).
Infrastructure-as-code supported today = Terraform HCL2. CloudFormation and Azure ARM are built and validated but not yet integrated; .tf.json is recognized but not parsed.
Server / host
Permissions, SUID/SGID, exposed services and secrets on the host — read-only, with host access authorized by the operator.
Read-only, operator-authorized (the caller provides the backend and credential); Linux only; benchmarked on captured host state.
Network
Observed network posture: active service mapping, active TLS, and passive analysis of a capture.
Active discovery requires explicit opt-in and is limited to a curated set; the port inventory is a note, never a finding; passive analysis is limited to cleartext traffic and active TLS is refused by default. Requires external binaries on the worker.
Runtime behaviour
What an observed run cost (amplification vs budget) and how far a corruption propagated, derived from that run’s sensor telemetry.
A single telemetry format is wired; other formats and a live privileged sensor are out of scope — the sensor reads an alert stream that no ingest mode produces today.
Forensic postmortem (DFIR)
Reconstructs an incident (kill-chain, timeline, root-cause) and correlates runtime→code over an uploaded forensic bundle.
Two log sources today (web access + auth/PAM); broad ingest (syslog, cloud, memory) is pending; no memory forensics or lateral-movement.
Assurance & compliance overlays
Assurance / containment
Which security claims hold — with proof — and whether a control actually cuts the attack path.
Assurance only asserts about claims a verifier actually checked; the absence of a check is not evidence of safety.
Cryptographic seal
A tamper-evident attestation (custody + hash-chain) over the assessment evidence.
How it worksGDPR / EU AI Act
Maps findings to GDPR and EU AI Act articles and shows which evidence touches each requirement.
How it worksLGPD (Latam)
A technical mapping of evidence to LGPD (Brazil) articles, with technical grading — never an assertion of COMPLIANT.
Requires legal review by a qualified Brazilian reviewer: the article set and each mapping stay in legal-review until signed.
Attack chains & adversarial validation
Joins findings from different families into exploitable chains and walks the ones it can prove against an authorized isolated replica.
The full cross-family join is not integrated; any measured validation rate describes the machine on its own corpus, not a promise about any real target.