2026
WraithRun: Local-First AI Incident Triage
Agentic ReAct loop in Rust that runs host-level investigations on a local LLM.
An incident-response runtime that triages host evidence on the analyst's machine using a local LLM (ONNX, GGUF, or SafeTensors). An agentic ReAct loop iteratively picks investigation tools (logs, listeners, persistence, accounts, processes) and synthesizes severity-scored findings with full audit trails. Supports multiple backends (CPU, CUDA, DirectML, CoreML, TensorRT, QNN, Vitis) and falls back to a deterministic dry-run so triage never stalls when inference fails.
- ▸Bring your own model. No cloud APIs, no data exfiltration, no vendor lock-in.
- ▸Evidence bundles with SHA-256 chain-of-custody and a JSON adapter for SOAR / CI gating.
- ▸Deterministic fallback when live inference fails, with machine-readable reason codes.