What runs today, by track
Every capability below says plainly what it does, and anything still in development is marked as such. Nothing here is dressed up to look further along than it is.
THANGAIL is the instrument of a non-profit initiative, now being incorporated, that teaches cognitive cyberdefence; Qresec, its commercial arm, sells the signed briefings and the deployments that sustain it. It is an operational platform in the narrative intelligence category: the detection engine, the analyst console and the signature chain run today. It is built to be strongest where an institution’s real problem sits: an attribution that holds up under external review, and an evidence chain someone else can audit. Each deployment is scoped and built for the institution that asks for it, and there is a working demo to walk through first.
How this platform competes
No opaque risk score
A single number collapses evidence and judgement into one figure that cannot be defended in front of a tribunal or a board. This platform shows which signals concurred, from which sources and at what analytical level, and a named analyst signs the reading. It is harder to sell and it is the only thing that survives external review.
An anomaly is not an accusation
The detection of coordinated amplification stays separate from any verdict on truth or falsehood. This is not a generic fact-checking tool that depends on contracts with social platforms. It is intelligence infrastructure, and the judgement stays with a person.
A stated ceiling on what the agent can do
Other operators in this segment ship an embedded AI assistant without publicly stating a bounded-harm ceiling for it. Here the ceiling is stated and checkable: read-only tools, zero write paths, and every output subordinate to a human signature.
Human Gate as architecture, not policy
Nothing is published and no attribution is asserted without a named analyst approving it first, and editing an approved draft voids that approval. Accountability sits in the artifact, not in a contract clause.
For learning the method
Separate fact from framing with a corpus scored for reliability and bias, plus coordinated-amplification evidence.
For you if you need to teach the difference between fact and framing, and you need the corpus, not the conclusion.
Accuracy is not a verdict on alignment
The corpus is scored so that an accurate report from a state-aligned outlet never reads as a verdict on its alignment.
An anomaly is not an accusation
Attribution is asserted only after a named analyst signs it. A detection alone never triggers it on its own.
A shared taxonomy, not a private score
Every detection is tagged against a published framework for describing manipulation techniques, and can leave as a standard evidence bundle another tool can read.
The chain, not just the message
A narrative is followed from the news portal or web property through to the amplification node, inside one data model, so the shared infrastructure behind it is a primary link, not an enrichment added once the narrative already spread.
The agent reads; the analyst signs
Every tool the context agent holds is read-only, with zero write paths: it can correlate and resolve techniques already present in the evidence, and it can neither publish nor modify anything.
It states no attribution of its own. A technique it has not seen in the evidence stays unresolved rather than guessed.
Where a narrative started (on the way)
Reconstructing how a narrative first appeared and spread across sources is designed, not built yet: today the platform knows which narratives exist, not their timeline.
A free, asynchronous 45-minute session: no sales call, no NDA required to attend.
For a sector briefing
A signed report built from a publicly documented campaign that already named your sector a target.
For you if you need a signed reference for a board or a regulator, not a private analysis of your organisation.
Sovereign deployment as a design line
A provider switch and a deterministic fallback exist so the pipeline keeps working without an external model provider: the argument a public buyer has to be able to take to its own regulator ahead of the European AI Act applying.
The architecture and the provider switch exist; the local inference node does not yet. Today the platform runs on managed cloud infrastructure, not inside an institutional perimeter.
Naming infrastructure you can defend
Before any infrastructure is named in a report, the link behind it is established from passive technical records, so what a board or a regulator reads is a link a third party can re-check, not a score that has to be trusted.
That is the difference between an attribution that survives external review and one that does not: the evidence for the link travels with the claim.
Cyberdefense-relevant, not generic threat intel
Coordinated disinformation is treated as a cognitive-warfare concern, tagged against the same published framework derived from a widely used cyber-defence taxonomy, not malware analysis or endpoint security.
Follow a declared target, not a generic sweep
Reorienting collection toward a specific actor, figure or region instead of a generic sweep is supported in the data model.
The engine that reallocates collection resources to that target on request is not built yet.
A shareable, standard bundle
Every approved finding can leave as a valid standard collection object, ready for another CTI platform to ingest.
It has never been pushed against a live partner instance yet: implemented, not proven in production.
Hand evidence to your own tools
Once a partner endpoint and credentials are configured, an approved bundle can be pushed to an external threat-intel platform.
The code path exists; a live run against a partner instance does not yet.
One package a third party can verify (on the way)
A single evidence package carrying the detection, the infrastructure, the provenance and the human decision together is designed and not built yet: today the signed report and the standard bundle leave as two separate artifacts.
From a detection to a proposed response
An approved finding can carry counter-narrative actions drawn from the published response framework, tied to the technique they answer, so the response is documented next to the detection instead of somewhere else.
Recording whether a suggested action was carried out, and what happened after, is not built yet: the loop stays open after the suggestion.
Your request goes to an analyst’s review queue: no automatic delivery, and an NDA before the signed report goes out.
For operating the console
Bottom-up traceability from a raw indicator to a signed, exportable report.
For you if you need to run your own investigation, not read a summary someone else signed.
Passive technical lookups, fully logged
Domain, IP and hash lookups over open protocols only: every query is logged with who asked and the result, including a rejection.
Nothing ships without a human signature
No output leaves the platform without a named analyst's approval, and editing an approved draft voids it.
A report someone puts their name on
A draft only becomes a report after that signature, and publishing revalidates the signature at the moment it goes out.
Evidence a person can read, not a metadata dump
The primary output is a human-readable proposal an analyst can accept, reject or act on, with documentary provenance behind every claim.
The visual half of that evidence, beyond text and links, is not built yet.
A pipeline that runs itself, eventually
A collection API is specified but not deployed yet: collection today is triggered by an analyst, not on a schedule.
Finding new sources on its own
A scheduler that discovers new outlets by itself is designed, not built: today the registry is curated by hand.
Beyond the open web
Collecting from platforms that require login is on the roadmap: today those connectors are documented stubs that always decline by design.
Capturing evidence before it disappears
Preserving a durable copy of a page at collection time, because disinformation content is routinely taken down, is designed and not built yet: provenance today means the source link and its context.
Access is reviewed and granted per named analyst, after a signed NDA. There is no self-serve signup.
Most recent releases
A new grid shows which families of the detection taxonomy our detectors have actually hit, per actor -- including the gaps.
A new webhook feeds search-term volume disruption alerts straight into the triage queue.
Connect over MCP
Connect the engine to your AI assistant
What would run on the platform, asked from the assistant you already use: an admitted analyst would read a detection, a campaign, a narrative, infrastructure collisions, a raw item, a DISARM technique, a channel, a draft.
Free access to read signed case files; every other query needs the analyst's own revocable credentials.
No write path at all, by design: not a draft, not a note. Writing keeps happening through a person, in the console.
A request cap per user, lower still for the public door, plus a short allowlist of what could ever be asked: read-only, the eight tools the agent already uses. Nothing that spends a third-party credit goes out this door.
Every call recorded (actor, tool, and whether it answered), plus a master switch that turns the whole endpoint off in seconds, public door included, no exceptions.
- Streamable HTTP
- https://thangail.org/mcp
- Planned to work without extra setup: Claude Code and the OpenAI API.
- By invitation
Full detail on this is covered under our non-disclosure agreement. Request access and we send it as part of that process.
No agreement needed for /training or the public Portal Kombat case file.
Request accessThis page describes what the platform does, not how it does it. Detection thresholds and pipeline design are discussed under NDA: ask, and we will tell you directly.
Detections are tagged against DISARM and MITRE ATT&CK®, and evidence can leave as a STIX 2.1 / TAXII™ bundle (trademarks of their respective owners, used here for interoperability, not endorsement).