System Architecture

Back to Monitor

Security Monitor

How the Platform Works

A deep dive into the 100% private, local-first security pipeline — 50+ CIS Benchmark controls, zero cloud storage, local AI via Ollama, and CVE matching via OSV.dev.

System Architecture

Security Tools Hardener — Cloud Security Pipeline

Agent (.sh/.bat/.ps1)
API Routes
Browser
Supabase
IndexedDB Cache
AI / PhishGuard
Validate / Remediate
CVE / OSV
USER & AGENT SCRIPTSNEXT.JS API ROUTES (VERCEL · STATELESS)STORAGE, AI & EXTERNAL SERVICES🖥️Dashboard Browsersession_id · IndexedDB · UI⚙️Mac / Linux / Windowscurl | python3 · .bat · .ps1 · 50+ CIS🛡️PhishGuard ExtensionGmail · OAuth · BEC · Claude AI📥/agent/uploadPOST · agent submits findings🔍/scan/stream (SSE)POST · re-analyze · checklist✅/validate + /remediatePOST · run-check · apply-fix🔬/cve/checkPOST · OSV.dev · batch packages🗄️Supabasemachines · scans · findings persist💾Browser IndexedDBlocal findings cache · browserDb🤖AI EngineClaude (Anthropic) · Ollama (optional)🌐OSV.dev APIfree · no key · Homebrew/Debian/npm

Data Flow — Step by Step

1
Dashboard→/agent/downloadBrowser copies curl command with session_id — user runs it in Terminal / CMD
2
curl … | python3→Python / PS agent50+ CIS checks run locally — macOS, Linux & Windows (.bat + .ps1) supported
3
Python / PS agent→/agent/uploadAgent POSTs findings JSON to server with session_id + agent_mode=cis-deterministic
4
/agent/upload→Supabase + IndexedDBFindings persisted to Supabase; view_url #data= fragment ingested into IndexedDB
5
Re-Analyze button→/scan/stream (SSE)Fresh CIS pass + AI multi-pass enrichment, streams back findings + checklist
6
/scan/stream→Hardening ChecklistAll 50+ CIS checks returned with pass/fail/manual_review for every control
7
AI Engine→Claude (Anthropic)Claude API (server-side) for deep analysis — local Ollama optional in dev
8
Run Check button→/validateRead-only shell command run on machine — real output shown inline in UI
9
Apply Fix button→/remediateAI-generated fix command executed on machine with dry-run safety gate
10
CVE Scan button→/cve/check → OSV.devInstalled packages batch-checked against OSV.dev vulnerability database
11
PhishGuard→/phishguard-scanGmail auto-scanned; OAuth consent + BEC signals analyzed server-side via Claude

API Routes Reference

GET

/api/monitor/agent/download

Returns Python agent script (macOS / Linux) or .bat / .ps1 (Windows) with session_id baked in

POST

/api/monitor/agent/upload

Receives CIS findings from agent (agent_mode=cis-deterministic), persists to Supabase, returns view_url

GET

/api/monitor/agent/pending

Browser polls this to retrieve latest scan payload for the current session_id (Supabase relay)

POST

/api/monitor/agent/collect

Collects raw snapshot data from agent — pre-processes before CIS analysis

POST

/api/monitor/scan/stream

SSE — re-runs 50+ CIS rules + AI multi-pass via Claude, streams findings + hardening checklist

POST

/api/monitor/validate

Runs read-only verification command on machine — whitelisted safe commands only

POST

/api/monitor/remediate

Executes AI-generated fix command with dry-run mode and rollback command recorded

POST

/api/monitor/cve/check

Batch CVE lookup via OSV.dev for installed packages (Homebrew / Debian / npm)

POST

/api/phishguard-scan

PhishGuard email scanner — checks links, OAuth scopes, BEC signals via Claude (server-side)

POST

/api/monitor/chat

AI security assistant (Claude) — answers questions about the machine's security posture

GET

/api/monitor/settings

Loads / saves persisted scanner settings (AI preferences, thresholds, notifications)

📋

50+ CIS Benchmark Controls

Every control shown with pass/fail/manual_review — macOS, Linux & Windows supported

✅

Real Verification

Run Check executes actual shell commands and shows real output inline

🤖

Claude AI Engine

Claude (Anthropic) powers deep analysis, remediation, and PhishGuard email scanning

🛡️

CVE matching via OSV.dev

Free, no API key, Homebrew + Debian + npm package support

Tech Stack

Next.js 15TypeScriptTailwind CSS 4Framer MotionSupabaseClaude (Anthropic)Ollama (optional)CIS Benchmarks L1/L2SOC 2 TSCNIST SP 800-53OSV.dev CVE DatabaseRechartsIndexedDBJSZipPDF (window.print)

Data Sovereignty

Sensitive system data is stored only in Supabase (your own project) and browser IndexedDB. The agent script runs locally — findings are POSTed directly to your session. Nothing is processed by third-party cloud services.

Local AI Intelligence

Ollama runs entirely on your machine. The /api/ai/proxy route forwards requests to localhost:11434, so AI enrichment, remediation scripts, and chat all happen without a single byte of config leaving your network.

CVE Matching

macOS: outdated Homebrew packages detected via the formulae.brew.sh API — shows installed vs. latest version. Linux: packages batch-checked against OSV.dev (Debian ecosystem) for real CVE IDs and CVSS scores. No API key required for either.

PhishGuard

Phishing Detection Pipeline

Multi-layer email analysis — client-side heuristics, DNS-over-HTTPS SPF/DMARC validation, RDAP domain age, AI deep-analysis (BYOK), and screenshot vision scanning — all without storing your email content.

Browser / Client
PhishGuard API
AI Analysis (BYOK)
DNS / RDAP
Supabase
Risk Score

Analysis Pipeline — Step by Step

1
Email input→Paste or Gmail OAuthUser pastes raw email source or connects Gmail — content stays client-side
2
cyber-sense-rules→Client heuristics50+ pattern rules check subject, headers, URLs, spoofing signals — runs in browser
3
Extracted domains→/phishguard-scanDomains, links, and sender extracted — SPF/DMARC checked via Cloudflare DoH (1.1.1.1)
4
/phishguard-enrich→RDAP (rdap.org)Domain registration age checked — newly registered domains (<30d) are strong phish signal
5
SPF / DMARC→DNS TXT recordsSPF alignment (pass/softfail/none) + DMARC policy (reject/quarantine/missing) via DoH
6
AI deep analysis→/phishguard-analyzeBYOK proxy — Anthropic Claude or OpenAI GPT — key passed per-request, never stored
7
Screenshot vision→/phishguard-visionOptional: screenshot uploaded to AI vision model to detect spoofed login pages
8
Risk engine→Weighted score 0-100Heuristics + DNS + RDAP age + AI verdict weighted → final phishing risk score + badge
9
Result persist→SupabaseScan result saved (score, indicators, verdict) — no raw email body stored server-side
10
Export / Report→/phishguard-reportFull analysis exported as PDF — indicator breakdown, AI explanation, header dump

PhishGuard API Routes

POST

/api/phishguard-scan

SPF/DMARC lookup via Cloudflare DoH, domain extraction, saves scan result to Supabase

POST

/api/phishguard-enrich

RDAP domain age check via rdap.org — flags newly registered domains (free, no key)

POST

/api/phishguard-analyze

BYOK AI proxy — routes to Anthropic or OpenAI with user-provided key, key never stored

POST

/api/phishguard-vision

Screenshot analysis via AI vision model — detects spoofed login pages and brand impersonation

GET

/api/phishguard-report

Retrieves saved scan result for report rendering and PDF export

POST

/api/phishguard-generate-report

Generates full structured report with indicator breakdown and AI explanation

🔑

BYOK — No Key Stored

Your Anthropic/OpenAI key is passed per-request over HTTPS and used immediately — never persisted

🌐

DNS-over-HTTPS

SPF & DMARC checked via Cloudflare 1.1.1.1 DoH — no plaintext DNS leakage

📅

RDAP Domain Age

Newly registered domains (<30 days) flagged as high-risk using free rdap.org API

🔒

No Email Body Stored

Raw email content is never sent to the server — analysis runs client-side or via proxied AI key