Stigmergy
Autonomous DFIR at machine speed. Math decides, a signed ledger records, and the LLM only explains — so a hallucination can never cause a wrong decision or forge an evidence trail.
The agent can't hallucinate its way into a wrong decision
Connecting an LLM to 200 forensic tools makes it fast — and makes it hallucinate. Stigmergy fixes that architecturally, not with prompts. Three planes, one rule: the model is never in the decision path.
Hot path — deterministic
Sensors deposit Dempster–Shafer evidence on a pheromone field. Belief / Plausibility / conflict_K decide observe · mitigate · conflict · escalate. No LLM. p50 0.567ms.
Forensic ledger — provable
Every decision: UUIDv7 + BLAKE3 hash chain + Ed25519 signature, Merkle-batched to Sigstore Rekor. One command re-verifies the whole chain.
Reasoning plane — off the hot path
Fractal pivot agents and a prosecutor/defense/judge narrator explain findings after the ledger entry exists. Citations are validated; output is schema-constrained.
Architectural guardrails, not prompt guardrails
The difference the brief asks for. If every prompt-based control failed at once, Stigmergy would still emit a correct, signed, tamper-evident decision.
◆ Architectural — cannot be prompted away
- ✓Typed MCP tools only — no execute_shell_cmd exists
- ✓Reference-resolved exhibit IDs, not free-form paths
- ✓LLM excluded from the decision path entirely
- ✓outlines/xgrammar FSM-constrained JSON output
- ✓BLAKE3 + Ed25519 ledger; tampering breaks verify
- ✓Fabricated citations rejected before the ledger
○ Prompt-based — defense in depth only
- •Narrator role instructions (prosecutor/defense/judge)
- •Zheng-2023 position-swap to reduce ordering bias
- •System-prompt scope limits for pivot agents
These improve explanation quality. They are not relied on for evidence integrity.
Replay: the real ROCBA run
Real indicators carved from the official SANS Find Evil! memory image, driven through the live pipeline into the signed ledger. Scrub the timeline; the amber marker is the self-correction — a Yager conflict the system refused to auto-mitigate.
Download & run it yourself
Stigmergy runs entirely on your machine — your telemetry, models, and signed ledger never leave it. One prerequisite: Docker.
Get Stigmergy running in ~10 minutes
The launcher checks Docker, fetches the repo, starts the full stack, and opens the dashboard. Works on Windows, macOS, and Linux.
curl -fsSL https://raw.githubusercontent.com/Shaugato/find-evil/main/installer/install.sh | bash