Skip to main content
The classification agent turns raw recon into scored leads. It has no HTTP surface. It listens to domain events and writes its results into the lead records you read through the API.

​
What happens on a new lead

  1. A scan or Hackbot publishes a lead.created event.
  2. The classification agent picks the event and reads the lead.
  3. The agent probes the lead before it scores. Probing beats guessing: the agent checks the evidence it has, then classifies.
  4. The agent writes a classification with a score, a feature category, an analysis, and a diagram of the architecture it saw.
  5. The lead detail view and the dashboard radar show the result.

​
Where you see the output

  • GET /api/leads/{id} carries the classification fields on the lead.
  • The dashboard attack-surface radar groups leads by feature category.
  • Lead priority drives GET /api/leads/top.

​
Skills

The agent classifies through a curated skill set: one skill per asset class. Each skill carries the checks and the severity lens for its class. The platform team maintains the skill set. The API does not expose it.

​
Hackbot’s classifier

Hackbot chat runs its own classification sub-agent for asset questions in conversation. That sub-agent uses a restricted tool set, so a chat answer cannot wander into full recon. The restriction stays internal. Chat clients need no extra calls.