Skip to content

Ryan MacDonald

Millions of servers run the world's critical infrastructure, defended by teams too small to keep up.

Code Video Cerebral Valley

Core trick

A bash CLI reads outputs from existing OSS security tools on each host and lets an agent triage and contain threats across a fleet.

Tags

securityagents

Description

Millions of servers run the world's critical infrastructure, defended by teams too small to keep up. They've stitched together 15 years of open-source tooling but attackers now weaponize CVEs in hours while defenders are still grepping logs. Blacklight is a low-dependency agentic harness that turns the hooks already wired into existing OSS security tools into an autonomous defense layer. Detect on one host, triage and contain across the fleet, at attacker speed. The substrate isn't migrating to enterprise XDR. Blacklight makes the substrate agentic.
rfxn/blacklight★ 142 forksShellGPL-2.0Created Apr 22, 2026 · last push Apr 29, 2026

README excerpt

<div align="center">

# blacklight

**Defenders run grep. Attackers run agents. `bl` is the counter.**

A portable bash CLI that puts an agent on the same Linux defensive stack you already run.  
**Observe · Decide · Act · At fleet scale.**

<a href="https://blacklight.rfxn.com"><img src="https://img.shields.io/badge/%F0%9F%93%96%20full%20docs-blacklight.rfxn.com-22d3ee?style=for-the-badge&labelColor=09090b" alt="blacklight.rfxn.com"></a>

[![Version](https://img.shields.io/github/v/tag/rfxn/blacklight?label=version&color=22d3ee&labelColor=09090b&sort=semver)](https://github.com/rfxn/blacklight/tags)
[![License](https://img.shields.io/badge/license-GPL--2.0-22d3ee?labelColor=09090b)](LICENSE)
[![Bash 4.1+](https://img.shields.io/badge/bash-4.1%2B-4ade80?labelColor=09090b)](#why-this-stack)
[![Tests](https://img.shields.io/badge/tests-404%20BATS%20%2F%2019%20files-4ade80?labelColor=09090b)](#proof)
[![Opus 4.7](https://img.shields.io/badge/powered%20by-Opus%204.7-d97757?labelColor=09090b)](#why-this-stack)
[![Managed Agents](https://img.shields.io/badge/Anthropic-Managed%20Agents-a78bfa?labelColor=09090b)](#why-this-stack)

[Install](#install) · [Try it](#try-it-apsb25-94-in-five-minutes) · [Architecture](#architecture) · [Why this stack](#why-this-stack) · [Safety](#safety-model-five-tiers-eight-mechanics) · [Roadmap](#roadmap)

</div>

> [!IMPORTANT]
> **v0.7.0 build, originally written April 2026.**
> Production-shape, not production-tested at fleet scale. External operator

Team