EXTENSIONS

Reports whether a machine, container or image is vulnerable to

Finds and mitigates hosts exposed to Tailworm, the security assessment of

Finds and patches PHP installs exposed to the critical PHP remote code

Finds and fixes Brotli decoders exposed to **CVE-2026-111497**

Finds and fixes Linux, macOS and Windows hosts and Linux containers that

Observes APT package inventory and pending upgrades on Debian/apt-based Linux, with security-update classification, versioned delta reporting, debsecan CVE cross-checking, and a safety-gated install/remove for verified security updates. Verified on Raspberry Pi 5 / Debian 13 trixie, arm64.

Datadog Security Signals — signal search, triage, and archiving

Cloudflare Rulesets — WAF custom rules, transform rules, managed rulesets

Datadog Security Rules — detection rule CRUD and management

Datadog Security Suppressions — suppression rule management

Read-only observability model for GuardDuty findings. Query and inspect

Query and manage AWS Security Hub findings from a delegated administrator

Cross-account IAM observation model for role, user, and policy inventory.

Query Discourse forums via the public REST API. List categories, browse

Head-hunt exposure and indicators of compromise for the PHP2Shell remote code

HashiCorp Vault secrets management via REST API (KV v1 and v2). Emits OpenTelemetry spans for get, put, and list, with one child span per request in the recursive list walk, so vault reads are visible in traces including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and KV version only — never secret values, tokens, or error messages.

macOS Keychain vault using the security CLI. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and keychain service only — never secret values, argv, or error messages.

Snyk SBOM — software bill of materials testing and analysis

Snyk Issues — vulnerability issues across projects and groups

Snyk Cloud — cloud environments, scans, and resource posture management

Snyk Projects — project listing, attributes, relationships, and target management

Snyk Container Images — container image scanning and vulnerability data

Agile threat modeling as an agent-guided concept model.

Snyk Policies — security policy management and rule configuration