Katar is a single hyper-lightweight agent that captures every signal modern security tools need — EDR, FIM, vulnerabilities, packages, listening services, identities, network reachability — and exposes it through one GraphQL surface. Any vendor integrates by registering a scoped key. No more five agents per host, no more per-tool collection pipelines.
Endpoints are choking under EDR, FIM, vulnerability scanner, DLP, CSAM, patch-management, and container-security collectors — each gathering overlapping telemetry, each maintaining its own pipeline, each adding kernel hooks that could take a fleet down on the next bad update. And when a pentester hands you an external IP, nothing on your stack can answer which internal asset owns it, who runs it, and what it can reach.
Five overlapping collectors per host. Single-agent failure modes, multiplied across the fleet.
Every new tool means a new agent, new config push, new ticket, new POC cycle.
Cloud platforms map exposure end-to-end. On-prem? Spreadsheets and Slack threads.
Your data sits in five proprietary pipelines. Switching tools means rebuilding collection.
Vendors integrating with Katar get the GraphQL schema, integration guides, and conformance suite. Every customer query is scoped, rate-limited, and audited. No agent of your own to ship; no per-customer collection pipeline; just a key and a GraphQL endpoint.
read:inventory, read:events, actionThe Katar protocol contract lives in kos/proto/ as the single source of truth. The Rust agent does kernel-adjacent work; the Go control plane is the integration hub. Vendors integrate against the contract, not against any one product.
A pentester hands you an external IP. Katar walks the trail in real time — across firewalls, NAT entries, load-balancer pools, all the way to the process running on the host that owns the data. Hover any node to dig deeper.
eBPF on Linux, ETW on Windows. Hyper-lightweight, kernel-resident, zero-copy. Modules load on demand; nothing you don't use ever runs on the host.
The Katar protocol contract is canonical. Both services derive from it. Vendors integrate against the standard, not against any one company's product.
Every enforcement action is Ed25519-signed and verified at the agent with a ±5 s replay window. HMAC-chained audit log on every host. Self-lockout guards.
Bitemporal asset graph spanning hosts, services, packages, identities, and reachability. Pentest finding to internal owner to blast radius — in a single query.
Signed actions, mTLS, audit chain, conformance harness.
Inventory, listening services, expanded GraphQL surface.
Per-tool scoped keys with a durable consent log.
End-to-end exposure mapping across the hybrid estate.
Production scale, structured ops, vendor conformance suite.
The agent and control plane run side by side on a laptop. Read the docs, integrate against the GraphQL schema, or get in touch about an early-design partnership.