Watch the agent think.
Notra isn’t a black box with a score at the end. Every run is a traceable pipeline — plan, probe, verification gate, verdict — and the full trace ships inside every report. Here is one run, step by step.
It maps before it touches.
Before a single probe fires, Notra writes a plan: what’s in scope, what’s authorized, and which checks run in what order. The authorization check is a hard stop — no proof the site is yours, no scanning. The plan stays in the trace, so every later action points back to a reason.
Safe probes, every one logged.
Each plan becomes real tool calls — safe, non-destructive, one at a time. Every call and observation lands in the run trace, and what a tool sees is saved as evidence before the agent reasons over it. Nothing happens that isn’t written down.
Every candidate must prove itself.
A candidate is a suspicion until the gate re-runs it with a harmless proof — integer math instead of a shell, an empty folder instead of an upload. Anything that comes back under 0.8 confidence is dropped, and whatever survives is stamped with the verdict that earned it.
Findings ship with their proof.
What survives the gate is ranked by real risk, written in plain English, and bundled with the exact request and response that proves it. A manifest pins each run — model settings, prompt hash, tool registry — so any finding can be traced end to end, months later.
{
"run_id": "notra-hlg-0412",
"model_settings": "pinned",
"prompt_hash": "sha256:9f3ab2…",
"tool_registry": ["fingerprint", "cve_xref", "http_probe", "exposed-files"],
"gate": { "confidence_floor": 0.8, "poc_mode": "harmless" }
}This is a walkthrough of a synthetic demo run — real runs trace the same steps on your site. The full trace ships inside every report. See a verified sample report
See it happen on a live run
The demo scan plays the same pipeline in real time — stages, gate activity, and all.