Watch the agent think.
Notra isn’t a black box with a score at the end. Every run is a traceable pipeline — plan, probe, verification gate, verdict — and the full trace ships inside every report. Here is one run, step by step.
It maps before it touches.
Before a single probe fires, Notra writes a plan: what’s in scope, what’s authorized, and which checks run in what order. The authorization check is a hard stop — no proof the site is yours, no scanning. The plan stays in the trace, so every later action points back to a reason.
Safe probes, with traceable observations.
Each plan becomes real tool calls — safe, non-destructive, one at a time. Every call and observation lands in the run trace, and what a tool sees is saved as evidence before the agent reasons over it. Nothing happens that isn’t written down.
Candidates need supporting evidence.
A candidate is a suspicion until the gate checks saved observations and available harmless proof evidence — such as integer math instead of a shell or an empty folder instead of an upload. Low-confidence results are withheld, and findings that pass are stamped with the verdict and evidence available for that run.
Findings ship with their proof.
What survives the gate is ranked by risk, written in plain English, and bundled with the evidence available for that finding. A manifest pins each run — model settings, prompt hash, tool registry — so any finding can be traced end to end, months later.
{
"run_id": "notra-hlg-0412",
"model_settings": "pinned",
"prompt_hash": "sha256:9f3ab2…",
"tool_registry": ["fingerprint", "cve_xref", "http_probe", "exposed-files"],
"gate": { "confidence_floor": 0.8, "poc_mode": "harmless" }
}This is a walkthrough of a synthetic demo run — real runs trace the same steps on your site. A run report can include the trace and its available evidence. See a verified sample report
See it happen on a live run
The demo scan plays the same pipeline in real time — stages, gate activity, and all.