Watch your accounts, devices, contacts and exposure surface; flag scams in real time, defend your social channels with approval-gated playbooks, review case timelines, and harden credentials — all on your machine, under your encryption, powered by a local LLM brain.
Identity + finding triage by severity bucket (A/B/C) with evidence-linked detections and a read-only forensics default.
bucket triageInstagram & email accounts registered locally; message classification, session control, meeting import with social-engineering flags, exposure & impersonation findings, and the full approval-gated playbook pipeline.
16 playbooksTelegram-first: verified contacts get opt-in auto replies, probable scams are never engaged, high-risk asks are handed to the account owner for review.
safety-gatedRemediation blueprints and a connector registry with honest state reporting — every remote action fails with "unavailable" until a real adapter is configured.
no fabricated resultsA token-gated service API for other agents (SATURDAY) — overviews and read-only drafting; nothing is ever sent automatically.
bearer-token authEvery playbook action requires owner sign-off before local execution. Emergency mode raises the approval, never auto-executes.
explicit consent| Piece | Role |
|---|---|
| Encrypted vault | SQLite, Fernet under PBKDF2-HMAC-SHA256, passphrase-only access |
| Social layer | Message risk classification (deterministic), quarantine labelling, approval-gated playbooks, honest remote-actions reporting |
| Ollama | Local LLM at 127.0.0.1:11434 — OpenAI-compatible, model llama3.2 |
| Responder | Provider pinned via HVY_LLM_PROVIDER; falls back to an honest heuristic, never silently |
| Transports | Telegram (live), Email best-effort, Discord/Slack outbound-only |
| SATURDAY link | POST /api/service/query, bearer-token auth |