An investigation agent that connects security events to evidence-backed reports.
Implemented a bounded LLM tool loop behind a TypeScript API, with shared contracts and validated evidence provenance. The current web interface is a scaffold; investigations run through the API against a synthetic event fixture.
Engineering notes
- Three read-only investigation tools
- Per-investigation evidence validation
- Explicit model and tool-call budgets