The on-prem cybersecurity AI agent that operates your infrastructure
The QROS AI Harness (qros-cli) is a self-hosted cybersecurity AI agent that runs on your own network: it launches licensed TLS, CVE and CIS/STIG/PCI scanners, executes Ansible hardening and firewall/IDS/SOC playbooks, follows a red-and-blue-team pentest methodology, and renders HTML→PDF audit reports — all through an MCP tool interface, with a hardware-bound license and offline store-and-forward sync to qros.dev. On-prem first; no production change without explicit operator authorization.
.-- :==-. .-=-. . .==. :== . .= = . .= .=------- = . *@%%%%%%%@@ :@@%%%%%%@@- *@%%%%%%%@@- *@%%%%%%%%. .= -- -: = . %+ .@= :@: @@ @+ %* .@* .= =: =: = . %+ .@= *@@@@@@@@%. @+ %* .#######%@ =. -- --. :- . %* .%*-@= :@: .%%. @+ %* :@: :- .....:=. .. . +*******@= :*. :** +********- *********: :- :-. . -: .-- . --. -=: .:: QROS v0.1.0 · cybersecurity AI agent — “Paco” 🛡 blue team licensed for host01 · Ed25519 license valid · queue: 0 pending > Audit host01 for CIS, check only ● classifying target … private (RFC1918) ● qros_heartbeat … license valid ● qros_run_playbook audit/debian12-cis_l2_complete --target host01 ✓ 124 controls checked · 6 fail · 2 warn · 0 err ● queue result; qros_sync → qros.dev (store-and-forward) ● qros_scan_result scan_id=0192… → report.html
A self-hosted AI harness, not a cloud chatbot
The QROS AI Harness is a packaged agent runtime (qros-cli) that turns a language model into a senior cybersecurity and DevOps operator working inside your perimeter. The agent — “Paco” — reasons about scope and authorization, classifies targets client-side, runs real licensed scanners and Ansible roles against your fleet, and ships only public-target results to qros.dev for server-side enrichment. Private stays on-prem. The model never sees keys it should not see, and nothing touches production without explicit operator authorization.
Nine tools that turn a model into a security operator
The harness exposes a fixed Model Context Protocol (MCP) tool surface — qros-agent. The agent can only do what these tools allow, so its capabilities are bounded and auditable. Availability is whatever the system lists under ## Tooling; the guide below describes correct usage.
qros scan
Run a licensed native scanner (tls / cve / audit) against a host. Optional --ship sends immediately; otherwise queue locally.
qros recon
Run a licensed recon tool (9 binaries — see below) and return its JSON. Passive analysis by default; vuln-scan is active and authorized-only.
qros run playbook
Download + signature-verify an Ansible playbook and run it locally against the target. Check (*_complete) by default; repair (*_repair) with authorization.
qros playbooks
List the auditable and deployable playbook catalogue (CIS/STIG/PCI, firewall/IDS/SOC) before choosing a slug.
qros scan result
Pull the enriched result of a scan already sent to qros.dev, by scan_id — CVEs, scores, structured findings.
qros formats
List the raw scan formats the server parses (testssl-json, nmap-xml-json, qros-audit-cis) before shipping a payload.
qros sync
Store-and-forward: push the queued scans to qros.dev and renew the hardware-bound license.
qros heartbeat
License + status heartbeat: verify the agent and its license are alive before running a job.
qros enrich cve
Enrich CVE data (CVSS, CWE, references) from the NVD-backed enrichment service.
Download the MCP bundle · 13 binaries, ~16–20 MB, no runtime
The qros-mcp bundle — the qros-agent + 13 native binaries (3 scanners + 9 recon tools) + installer + config. Everything to expose the nine tools above to any MCP client (Claude Desktop, …) without the full AI Harness. No Node, no Ollama, no Ansible.
Env: QROS_AGENT_API_KEY, QROS_API_BASE_URL, QROS_AGENT_ID, QROS_AGENT_ORG, QROS_SCANNER_BIN_DIR. A missing binary or invalid license fails with exit 126 — the agent reports it and stops, it never fabricates output.
Nine licensed recon tools behind one MCP call
The qros_recon tool dispatches to nine specialized, hardware-licensed recon binaries — each with its own subcommands. The agent selects the tool and forwards its arguments verbatim; a missing binary or invalid license fails with exit 126 and the agent stops, it never fabricates output. All but vuln-scan are passive (they read what a target publishes); vuln-scan sends payloads and runs only against authorized targets.
auth-audit
Passive JWT / cookie / OAuth analysis; offline HMAC-SHA256/384/512 wordlist brute-force; OAuth grant-flow tracing.
api-recon
Headless-Chromium CDP network harvest; link + JS-endpoint mining; source-map disclosure; OpenAPI/Swagger detection.
header-audit
Passive HTTP security-header grading: CORS, CSP, security headers and cookie attributes.
content-audit
Content exposure: sensitive paths, secret mining, directory fuzzing and backup-file discovery.
dns-audit
DNS security: subdomain takeover, deep DNS, virtual-host discovery and DNS rebinding.
api-prober
API-protocol probing: GraphQL audit, gRPC recon and HTTP/2 protocol checks.
cloud-audit
Cloud and SSRF exposure: metadata-endpoint SSRF (optional callback) and S3/GCS/Azure bucket exposure checks.
tls-audit
Deep TLS and certificates: SSL Labs-style handshake grade, crt.sh CT history and TLS-fronting (SNI vs SAN).
vuln-scan active
Active web-vuln detection — sends payloads against authorized targets only: SQLi, reflected XSS (4 contexts), open redirect, IDOR and 20 built-in nuclei templates.
Three licensed binary scanners, not toy scripts
The harness ships three licensed native scanners the agent launches on demand. If a binary is missing or there is no valid license, it fails with exit 126 — the agent reports it and stops, it does not improvise results.
qros-tls-scanner
TLS/SSL posture: probes TLS 1.0/1.1, cipher suites, certificate chain and known vulns. Output testssl-json via qros_scan tls.
qros-cve-scanner
Concurrent TCP + banner enumeration with NVD CVE attribution by version. Output nmap-xml-json via qros_scan cve.
qros-audit-scanner
File-based CIS/STIG/PCI compliance checks. Output qros-audit-cis via qros_scan audit.
Audits and deploys via Ansible, with check vs repair modes
The agent runs signed Ansible playbooks locally against your targets — the server never touches the host. Two modes everywhere: *_complete = audit (check, no changes) and *_repair = audit + apply fixes. By default the agent proposes *_complete; it only escalates to *_repair with explicit authorization.
Audit & hardening playbooks
- CIS / STIG / PCI per OS (Ubuntu, Debian, RHEL, Windows via WinRM), one playbook per benchmark.
- Real galaxy roles (ansible-lockdown) + OpenSCAP, with section selection via
--tags. - Two slugs per playbook:
audit/<os>-<bench>_complete(check) and_repair(apply).
Firewall / IDS / SOC deploys
- IPS / WAF (HAProxy), IDS (Suricata + Snort) and SOC monitoring (OpenSearch + Grafana).
- Generic roles with placeholder vars:
deploy/firewall-*, check + repair modes. - No prod secrets shipped: roles are decoupled from any production firewall config.
Check mode *_complete
Audit only, zero writes. The default for every playbook: read the posture, score it, and leave the host exactly as it was.
the defaultRepair mode *_repair
Audit plus apply the fixes. The agent only escalates here with explicit operator authorization — never on its own.
authorization requiredAn enrichment API built for on-prem agents
The harness talks to qros.dev through a dedicated Agent API (/api/agent/*), separate from the SaaS user API. The agent authenticates with an Agent API Key (qag_…, Bearer), pinned to an Ed25519-signed hardware-bound license, with scoped capabilities and idempotent ingest via client_request_id (UUIDv7).
Scopes
Target privacy
- The server does no DNS; the agent resolves and classifies client-side.
- Private targets stay on the agent; public targets also feed the Explore index.
Red team and blue team with wisdom, not a checklist bot
The agent carries a pentest methodology built from real audit practice: web-application, generic-services and binary-exploitation checklists, each gated by scope and authorization. Before any offensive work it declares scope, authorization, goal and type; without written operator authorization for a target, it stops.
Web application
Recon → enumeration → analysis → report. OWASP-aligned: injection, auth, SSRF, XSS, access control, business logic — with reproducible evidence.
Generic services
Infra/network pentest: topology, authorized ranges, exposed services and versions. qros_scan cve + qros_scan tls drive enumeration.
Binary exploitation
Controlled-VM PoC design: memory corruption, RCE, stack/heap — for research and testing, never against production.
What the red team actually checks, by category
The methodology is not a single flat list — it is organized by the classes of weakness that matter in real audits. Each category below is its own checklist with reproducible evidence and a severity call, so a finding is never “the scanner said so” — it is shown, reproduced, and scored.
🔒 SSRF
Server-side request forgery: internal URL fetchers, cloud metadata endpoints (169.254.169.254), blind and error-based variants. Bounded egress, no DNS rebinding.
👁️ Information leaks
Verbose errors, stack traces, source maps, backup files, .git/, .env, config dumps, debug endpoints and version banners that fingerprint the stack.
⚡ Injection
SQLi, NoSQLi, command, LDAP, XPath, template (SSTI) and header injection — error, blind and time-based, with a safe, reversible proof.
🛡 Auth & access control
Broken authentication, session fixation, JWT alg confusion, missing/vertical-horizontal IDOR, forced browsing and privilege escalation paths.
💻 XSS
Reflected, stored and DOM-based cross-site scripting; CSP bypass, mutation XSS, and script-injection via JSON/Markdown renderers.
🧮 Business logic
Race conditions, parameter tampering, workflow bypass, price/quantity manipulation, coupon reuse and negative-value tricks.
🧰 Open redirects & CSRF
Redirect parameter abuse, trust-barrier CSRF, SameSite gaps, and post-→get mutation that defeats CSRF tokens.
🔐 Secrets & crypto
Hardcoded keys/tokens, weak ciphers, deprecated TLS, JWT secrets, exposed API keys and quantum-relevant classical-crypto debt.
⚠️ Misconfig & headers
Security headers, CORS wildcards, directory listing, default credentials, exposed admin panels and missing rate limits / DoS bounds.
💣 Binary exploitation
Memory corruption & exploit development: stack/heap overflows, use-after-free, format strings, integer issues and ROP chains — PoC’d on a controlled VM, never in production.
🚀 RCE & code execution
Remote code execution in its main forms: command injection, insecure deserialization (pickle / Java), server-side template injection (SSTI), eval() sinks and upload-to-shell chains.
⬆️ Privilege escalation
Local privesc on Linux and Windows: SUID / sudo / capabilities, kernel exploits, UAC & token abuse, plus container and Kubernetes escape paths to the host.
📁 File upload & traversal
Unrestricted upload → webshell, local/remote file inclusion (LFI/RFI), directory & path traversal, and polyglot files that smuggle executable code past naive filters.
☁️ Cloud, IAM & containers
Cloud & infrastructure abuse: exposed object storage, IAM privilege paths, SSRF to the cloud metadata service (IMDS) and container / Kubernetes escape to the host.
📦 Supply chain & CI/CD
Dependency confusion, typosquatting and malicious packages, poisoned CI/CD pipelines, unsigned artifacts and secrets leaked into build logs.
The agent you'd trust on your production fleet
The agent works like the senior engineer you wish you could clone. It reads the real state, proposes the smallest safe change, dry-runs it first, and keeps every playbook idempotent and reversible. Least privilege by default, no root unless required, and every action leaves a signed trail of evidence.
Two locks before production
No change ships until both are satisfied. The agent proposes; a human decides. Authorization and scope are written onto the change, so who approved what is never a mystery.
- (a) explicit operator authorization, and
- (b) a verified environment — check/audit green, the right target, confirmed scope.
Operating principles
The discipline that keeps a fleet safe at 3am — the boring, non-negotiable rules the agent never bends.
- Idempotent + reversible — if a playbook can't be re-run without harm, it doesn't run.
- Planned change — what, in what order, and what it might break, stated up front.
From raw evidence to an auditor-ready PDF
Every scan and playbook leaves evidence. The agent keeps the raw result, then renders a structured audit report — finding, severity, evidence and remediation — with the operator's identity, authorization and scope recorded on every page. One export: a PDF a regulator can actually read.
How a job moves through the harness
Run the QROS cybersecurity AI agent on your infrastructure
Explore the AI remediation agent →FAQ
What is the QROS AI Harness?
The QROS AI Harness (qros-cli) is a self-hosted AI agent runtime that runs a cybersecurity operator agent on your own infrastructure. It exposes licensed native scanners, Ansible hardening and firewall playbooks, a pentest methodology and report rendering through a Model Context Protocol (MCP) tool interface, with a hardware-bound license and offline store-and-forward sync to the qros.dev enrichment platform.
Is the cybersecurity AI agent on-prem?
Yes. The agent runs entirely on your infrastructure. It resolves and classifies targets client-side, keeps private-IP data on-prem, and only ships public-target scan results to qros.dev for enrichment. When the backend is unreachable it queues scans locally and syncs later.
What scanners and playbooks can the AI agent run?
Three licensed native scanners (TLS/SSL, TCP+CVE, CIS/STIG/PCI file-based) and Ansible playbooks for CIS/STIG/PCI audits and firewall/IPS/IDS/SOC deploys, each in a check (audit-only) and a repair (audit+apply) mode.
How does the agent authenticate to qros.dev?
With a dedicated Agent API Key (qag_) presented as a Bearer token to /api/agent/*, separate from the SaaS user key, scoped to scan:ingest, playbook:pull, deploy:report and enrich:cve, and pinned to an Ed25519-signed hardware-bound license.
Start your cryptographic risk assessment with QROS
Explore now →