Cortex

A scanner tells you a port is running nginx 1.27.2. Almost none of them can still show you the response that made them say so, because the reasoning left with the process. A false positive is then not diagnosable — it is just a claim you either accept or do not.

Cortex is built the other way round. A finding is a summary of some bytes, so it keeps the bytes: the exact payload sent, the exact response received, the pattern that matched and where, the fingerprint database version that supplied it, and a SHA-256 over the response. The claim references that hash rather than restating a conclusion.

False positives become diagnosable rather than mysterious. Results become auditable by someone who was not there. And the captured responses become the regression corpus that keeps fingerprinting honest as the pattern set grows, which is the failure mode every fingerprint database eventually has.

It also changes what a second scan can answer. Because scans are structured records rather than saved output files, a diff can compare evidence hashes and certificate rotation, not only whether a port is open — so "the claim is identical but the evidence moved" is a state the tool can report.

Most of the design decisions cost throughput deliberately. The default path is unprivileged, because connect, TLS and HTTP observation need no elevation anywhere; raw sockets are opt-in and never a silent fallback to a scan that produces different results.

Privileges are acquired at startup and dropped before any hostile input is parsed, because the response parser is the largest attack surface in a scanner. Rate control — a token bucket, a concurrency ceiling and a per-host cap — is specified as on by default rather than as a flag somebody has to remember; the last section of this page is honest about the fact that it is designed and not yet built. Local failures such as no route or permission denied are their own error class and are never reported as a target state, which is the most common silent data corruption in this category.

Captured responses will contain credentials sooner or later, so the evidence store is written owner-only, known credential patterns are redacted before persistence with the redaction itself recorded, and reports can be exported redacted.

Pre-release, and its own site says so on every screen. At the commit the public documentation is written against, the engine does not compile, there are no automated tests, and no binary has ever been built, signed or published.

The service-probe grammar parser is the oldest working code and the reason the project exists: dynamic delimiters, escape normalisation, and constructs the regexp engine cannot express recorded as unsupported rather than counted as parse failures. TCP connect scanning with three-state classification works. The evidence store, the diff, rate limiting and host discovery are designed and unbuilt.

Publishing that unchanged is the point. A capability register written against a named commit, including the parts that are wrong or missing, is worth more than a feature list.