Harpoon · authorized-pentest engine · pre-release
Autonomous testing that proves it was allowed to.
Harpoon is Northstar's offensive engine: it runs an autonomous engagement against a target you own or are contracted to test, and it will not start without a scope you signed, a warning you read and a consent phrase you typed yourself. Every finding is re-proven before it counts. The subscription is self-serve; running an engagement still always requires that signed scope and typed consent.
How it starts
Nothing runs until you've signed it twice.
The written authorization is the gate, not a formality in front of it. A target outside the signed scope, a tampered or expired scope, or a consent phrase that doesn't match: each one is refused before anything touches your infrastructure.
- 01
You upload a signed scope
It names the hosts, the techniques and the expiry you're authorizing. The signature is verified before anything else happens; a tampered or expired scope is refused outright.
- 02
You read the warning
What an autonomous engagement can actually do, stated plainly, before you're asked to agree to anything.
- 03
You type the consent, by name
An exact phrase, not a checkbox. It has to match, and it's tied to who you said you are.
- 04
You hold the kill switch
Live status and a stop control for the length of the run. Cooperative cancel, closes in-flight connections, works mid-engagement — not just before it starts.
This same gate is what a scoped customer uses to launch an engagement themselves — there's no human-approval queue in between the scope and the run. The scope and the consent are the authorization.
What makes it trustworthy
Only a re-proven finding ever reaches a report.
An engine that reports what it merely suspects is just a noisier scanner. Harpoon's single job past that point is proof: out-of-band callback, replay, a differential check between two identities, or a harmless canary token actually firing. A finding that can't clear one of those stays a claim, not a result.
- Re-proven, not just detected
- Every finding is independently re-confirmed before it's reported — the same bar whether it came from the web/app path or from testing an AI agent or chatbot. An unconfirmed signal is labeled exactly that, never upgraded for the sake of a cleaner report.
- Hash-chained, offline-verifiable evidence
- Every probe and every finding lands on a tamper-evident evidence trail. You can verify the chain yourself, offline, without trusting our dashboard to tell you it wasn't edited after the fact.
- Human-reviewed before it reaches you
- A finding clearing automated re-proof is necessary, not sufficient. Every result is reviewed by a person before it's in a client report.
Safe by default
Dry-run until proven otherwise.
- Default mode
- Plan and dry-run. Nothing touches a live target without an explicit in-scope hostname and, for any active step, a separate confirmation token — two gates, not one.
- Irreversible actions
- Stay out of scope entirely. Destructive, non-reversible techniques are not something a signed scope can authorize here — they're simply not run.
- Blast radius
- Capped per step and fails closed: a step that can't prove it's staying inside its authorized radius doesn't run rather than running "probably fine."
- Pace
- Rate-limited and polite by default — token-bucket limiting, backoff on errors, and respect for a target's stated crawl delay. An authorized test isn't supposed to look like a denial-of-service.
- On any guardrail failure
- Fails closed on anything safety-relevant, and the kill switch's own trip is itself logged to the same hash-chained trail — a stop is evidence too, not a silent exit.
Scope of testing
Web and app surface, plus the AI/agent surface most scanners skip.
- Conventional surface
- The same class of authorized testing a web app or API has always needed: exposed-service discovery, credential and session handling, server-side request paths that reach further than they should. Findings carry CWE and ATT&CK mapping, not an unlabeled severity guess.
- AI / agentic surface
- Prompt-injection and tool-call abuse against your own chatbot or agent, multi-turn escalation, and the indirect paths an attacker uses when they can't talk to the model directly — a poisoned document or a manipulated tool result. Mapped to the OWASP Agentic and LLM Top 10s and MITRE ATLAS, from pattern shapes, never from a library of working exploit text.
No telemetry, same rule
The engagement reports to you. Not to us.
- What Harpoon reports to Northstar
- Nothing. There's no usage reporting or phone-home built into the engine — the evidence trail and the report are yours.
- What reaches the network by default
- Nothing beyond the target you've scoped. A dry-run plan never makes an outbound request at all.
- What's optional, and off until you turn it on
- A couple of pieces can reach the network when enabled for a specific technique class — an out-of-band callback listener to prove a blind finding actually fired, and an optional hosted model used only as the attacker side of an adaptive multi-turn test. Each is opt-in, each is documented where you turn it on, and neither sends anything back to Northstar.
Who this is for
Authorized customers, on scope they can actually sign.
Harpoon runs only against a target the customer has authorized in writing — their own infrastructure, or an engagement they're contracted to test with the authority to scope it. It isn't offered for a program whose own rules forbid automated or agentic testing; that's on the customer to check, and the signed-scope step is where it gets caught, not assumed away. It can be run standalone, as a one-off engagement, or added to the Leviathan Platform for a customer already running it.
Honesty, check
What's real, what hasn't happened, what won't.
$600/mo, subscribe now. Scope and consent before anything runs.
The subscription is self-serve — no sales call needed to pay. Running an actual engagement is a separate step: a signed scope and typed consent are required every time, no exceptions, regardless of payment. That's not friction for its own sake — it's the same kill-switch-and-re-proof governance this page just described.