DugganUSA · The membrane
DugganUSA: one membrane between your agents and everything they install, call, read and obey.
Threat intelligence you can check. You do you. I do me. We share contexts. Armored by 30 independent checks across the 6 planes, and 6 balances that span all of them. 4 of 6 planes live, 2 degraded, 0 UNKNOWN. Nothing here is at 100%, and UNKNOWN is never drawn as pass.
Each plane draws its particles from its own verdict mix, in proportion. Planes count different things (files, calls, responses, seats, requests), so their counts do not add up across planes. Trajectories above the planes are PreCog: what is coming at the membrane; brightness follows the signal score.
| Plane | State | Measure | Value | Window | Source |
|---|---|---|---|---|---|
| 6 Edge | LIVE | State | live | now | state only in public mode |
| Live. Counts for this plane are in the weekly report, not on the public page. | |||||
| 5 Council | DEGRADED | State | degraded | now | state only in public mode |
| Running, but not at full strength. Counts for this plane are in the weekly report, not on the public page. | |||||
| 4 Output | LIVE | Jeevesus tool responses (labeled + sanitized) | 587 | 7d | GET /api/v1/mcp/usage tools |
| Every response is labeled untrusted and stripped of Unicode tag, zero-width and bidi characters before a model reads it. We count responses; we do not count how many carried something to strip. | |||||
| 3 MCP | LIVE | check_mcp_server calls | 17 | 7d | GET /api/v1/mcp/usage dredd |
| block / advisory / allow / unknown | 0 / 1 / 2 / 14 | 7d | GET /api/v1/mcp/usage dredd | ||
| Never reached the judge (bad input) | 14 | 7d | GET /api/v1/mcp/usage dredd.split | ||
| Judged | 3 | 7d | GET /api/v1/mcp/usage dredd.split | ||
| Judged but not in our corpus | 0 | 7d | GET /api/v1/mcp/usage dredd.split | ||
| Not-in-corpus rate | not quotable (n=3 < 10) | 7d | GET /api/v1/mcp/usage dredd.split | ||
| Unknown means we resolved nothing about that server, so we could not call it safe. | |||||
| 2 Install | LIVE | check-package calls | 121 | 7d | GET /api/v1/mcp/usage check_package |
| block / review / allow | 75 / 29 / 16 | 7d | GET /api/v1/mcp/usage check_package | ||
| By ecosystem | npm 51, PyPI 7, RubyGems 62 | 7d | GET /api/v1/mcp/usage check_package | ||
| review = known vulns in that exact version; block = malice. Allow is absence of known evidence, not proof of safety. | |||||
| 1 Instruction | DEGRADED | State | degraded | now | state only in public mode |
| Running, but not at full strength. Counts for this plane are in the weekly report, not on the public page. | |||||
| Plane | Checks | Check | What it does |
|---|---|---|---|
| 6 Edge | 6 | Edge worker | Feed-IOC blocks, scanner responses and honeypot canaries at Cloudflare |
| Host shield | Direct-to-origin requests that skip the edge are refused | ||
| Edge-verified client IP | A forged client address cannot steer per-IP controls | ||
| Never-indicator IPs | Private, lab and resolver addresses never ship, at ingest and in every feed | ||
| Domain never-block list | Legitimate platforms are never blocklisted by apex | ||
| Docs contract check | Every documented endpoint is probed in production for 404s and auth drift | ||
| 5 Council | 4 | Seat liveness sensor | Each seat's answers are counted, audit by audit |
| Dead-seat rule | A seat that answered nothing across three audits is dead, whatever its error | ||
| Zero-quota plans fail loud | A plan with no quota is an outage, not a retry | ||
| Independent labs | Seats from different labs, so no single vendor scores us | ||
| 4 Output | 5 | Invisible-Unicode stripping | Tag characters, zero-width, bidi and control characters removed before a model reads |
| Untrusted-content labels | Third-party text is marked as data, not instructions | ||
| Public tool allowlist, default off | A new chat tool is refused until it is reviewed | ||
| Outbound URL guard | Public DNS only, no IP literals, redirects re-vetted | ||
| Every model call metered | Tokens, feature and caller recorded per call | ||
| 3 MCP | 4 | Dredd preflight, signed verdicts | BLOCK, ADVISORY or ALLOW before an agent connects |
| Dependency-graph scan | Transitive npm and PyPI risk, the Shai-Hulud class | ||
| Published-CVE map, daily | A known CVE caps a server at ADVISORY | ||
| Vendor fixed-version ranges | Fills the gaps NVD leaves | ||
| 2 Install | 6 | Pre-install hook | Every install command an agent runs is read before it runs |
| Malicious-package deny-list | About 231,000 known-malicious packages, checked by exact name | ||
| Package reputation | Malice by reputation, not only by list | ||
| OSV malicious feed, five ecosystems hourly | npm, PyPI, RubyGems, crates.io and Go | ||
| Environment-source check | A registry, index or PATH swap makes an install unverifiable | ||
| CI supply-chain gate | Dependencies re-checked on every push | ||
| 1 Instruction | 5 | Two-key consent ledger | A change to identity, rules, skills, hooks or memory needs a written agent statement AND the owner's word in a hidden dialog |
| Computed approval dialog | What the owner approves is computed from the surface, never taken from the proposer | ||
| Last-consented identity at session start | An unvouched identity file is quarantined, not loaded | ||
| Git settings and hooks on the ledger | Any git setting that names a program is an instruction surface | ||
| Consent reality check | Dredd reports any unconsented change every session | ||
| Balances (span every plane) | 6 | Human deploy gate | No production change without the owner's go-ahead, then a scripted cutover with rollback |
| Deploy ledger | Every deploy recorded with its outcome | ||
| Dredd reality checks (32) | Assumptions re-measured against the artifact, every session | ||
| Pre-commit review | Every commit is judged before it lands | ||
| Verified writes | A write is not done until it is read back | ||
| Signed reports | Ed25519 signatures against a pinned key |
| Incoming signal | State | Value | Window | Source |
|---|---|---|---|---|
| Infrastructure Activation Surge | elevated | score 1.00 (elevated) | live, recomputed on request | GET /api/v1/precursor/v2/status |
| C2 Publication Surge | elevated | score 0.90 (elevated) | live, recomputed on request | GET /api/v1/precursor/v2/status |
| Supply Chain Staging | elevated | score 0.46 (elevated) | live, recomputed on request | GET /api/v1/precursor/v2/status |
| Phishing Domain Staging Detection | quiet | score 0.15 | live, recomputed on request | GET /api/v1/precursor/v2/status |
| KEV adds (and our first-party lead on them) | elevated | 7 newly exploited CVEs added to KEV; 2 of 7 new KEV entries had our receipt first, median 8d ahead; 5 with no receipt | 7d to 2026-10-15 | GET /api/v1/kev-lead |
| Weaponization latency | UNKNOWN | UNKNOWN | daily snapshot | GET /api/v1/first-party weaponization_latency (timed out after 45s) |
Sources: GET analytics.dugganusa.com/api/v1/mcp/usage (cache-busted, 7-day aggregates), /api/v1/precursor/v2/status, /api/v1/kev-lead, /api/v1/first-party. Generated 2026-10-15 21:34Z. 95% confidence cap. No SOC 2 report exists; nothing here claims one.
Public mode: only aggregate counts from public endpoints are shown. The weekly report carries every plane's numbers with its source.