A private engineering practice — innovating on behalf of the American citizen

397 self-hostable, MCP-native tools · 87 stars · flagship c2detect (⭐33)

Cognis Digital (Wyoming, USA) is a private engineering practice. We work quietly, by referral, on the hardest problems in security and autonomy — and we publish the tools that come out of that work as open source, so the operators and analysts who need them can self-host them, air-gapped, with no vendor in the loop.

We don't run ads and we don't cold-sell. The work is the marketing: single-purpose, self-hostable, MCP-native tools that reach where mainstream and SaaS security stop — firmware, ICS/OT, RF, C2, DFIR, OSINT, and compliance-as-code. Every tool ships a CLI, machine-readable JSON/SARIF output, and an MCP server so your agents can scan, audit, and remediate autonomously.

🇺🇸 USA-only, mission-first. We build on behalf of the American citizen — the defenders, the operators, and the small teams holding the line.

Firmware · ICS/OT · RF · C2 · DFIR · OSINT · compliance-as-code. Every tool is single-purpose, self-hostable, and emits machine-readable JSON/SARIF. Counts below are live from the GitHub API.

Our newest work, where the stars haven't caught up to the engineering yet. If one earns a place in your stack, a ⭐ tells us to push it further.

Renamed to single-word brands (old links now redirect here): uefiscan → bootwarden · keyhunt → keyhound · modpot → modlure — among others in the rebrand.

The tools live in the Cognis Neural Suite. Going from catalog to a running tool:

1. Pick a tool — browse the full catalog or the featured tables above.
2. Install it — most tools ship a CLI on PyPI under the cognis- prefix (see the tool's README for its exact package name):

   pip install cognis-mcpharden

3. Run it — machine-readable by default (JSON/SARIF):

   mcpharden scan . --format sarif --out report.sarif

4. Point your agents at it — every tool ships an MCP server, so Claude Desktop / Cursor / Cognis.Studio can drive it autonomously (run the tool's mcp command).
5. Automate in CI — gate builds on findings and upload SARIF to code scanning:

   - run: pip install cognis-mcpharden
   - run: mcpharden scan . --format sarif --out report.sarif --fail-on high
   - uses: github/codeql-action/upload-sarif@v3
     with: { sarif_file: report.sarif }

The suite got a major capability + quality pass — additive across the catalog:

• Real intelligence feeds, edge/air-gap ready — 35 keyless sources (CISA KEV, EPSS, OSV, NVD, MITRE ATT&CK STIX, NIST OSCAL 800-53, abuse.ch C2/IOC, OFAC, GDELT, OpenSky, USGS, Wikimedia) wired into the tools via a stdlib fetch→cache→offline→snapshot module.
• 262,351-vulnerability offline DB bundled into the vulnerability scanners — real OSV records (CVE/GHSA aliases, CVSS, affected packages) queryable with zero network.
• Standards exports everywhere — SARIF (code-scanning), STIX 2.1, OSCAL, Sigma + Suricata, GeoJSON/KML, CSV across the suite.
• Deeper detection — C2 campaign correlation, MCP fleet-posture + supply-chain (OWASP Agentic Top-10 2026), maritime track-interaction (CPA/TCPA), and more — each with expanded test suites and candid docs.
• Passive + authorization-gated active scanning and polyglot ports rolling out across the scanners.

Every tool stays single-purpose, self-hostable, MCP-native, and defensively-scoped.

Polyglot by design. The suite is Python-first but ports outward so a tool exists in the language of your deployment target — mainframe to mobile, kernel to contract. ● live in-repo today, ○ rolling out.

● Shipping now

📱 Mobile — languages & frameworks

⛓️ Smart-contract / Web3 — across EVM · Base · Arbitrum · Blast · Polygon · Solana · Algorand · XRPL · TON · Aptos · Sui · Starknet

_{Every port keeps the suite contract: a CLI, structured output (JSON/SARIF), and an MCP server.}

Led by Christopher Hyatt — Software & AI Engineer, founder of Cognis Digital, smart-contract auditor (Entersoft, intern→lead), and federal cybersecurity SME. 🛰️ Hack-A-Sat 7th worldwide / 3,600+ teams · Top 1% TryHackMe · Eagle Scout · CompTIA Security+ · CISSP Prep · AWS DevOps.

Languages · Python · TypeScript/JavaScript · Solidity · Rust · Go · Move · Cairo · Vyper · SQL · Bash AI / Agents · self-hosted LLMs · RAG · evals & guardrails · MCP · Claude Agent SDK · LangGraph · CrewAI · AutoGen · LangChain · LlamaIndex · Ollama · vLLM · llama.cpp Security & Web3 · smart-contract audit · formal verification · pentesting · Foundry · Slither · Echidna · Mythril · Burp Suite · Nmap · Kali · SIEM/Splunk · NIST 800-53 · MITRE ATT&CK Intelligence · OSINT · SIGINT · GEOINT · HUMINT · ADINT  |  PQC · post-quantum crypto

_{Engagements are private and by referral. Development partnerships via DevPairer.}

⭐ Star the tools you use — it's the signal that tells us which frontier work to push further · 🛠️ Contribute under the collaboration-pull model (see any repo's CONTRIBUTING.md) · 🏢 Commercial use → licensing@cognis.digital

cognis-digital composes across the Cognis suite — JSON in/out and a shared OpenAI-compatible /v1 backbone. See INTEROP.md for the suite map, composition patterns, and reference stacks.

Forward findings to STIX/MISP/Sigma/Splunk/Elastic/Slack/webhooks via cognis-connect. See INTEGRATIONS.md.

_{Featured tables, star counts, and headline numbers on this page are regenerated from the GitHub API daily by scripts/update_profile.py — so they never drift from reality.}