m19o/nightagents is a Python tool that monitors the exposure and attack indicators of the redirector infrastructure used by red team operators. There is currently no publicly released latest version. The core presented by the repository description and README is a flow that investigates threats, gathers evidence, and asks the operator for approval of the response.
The tool looks at traffic flow in logs together with VirusTotal, Shodan, certificate transparency logs, and threat intelligence sources. Certificate transparency logs are data that publish records of issued certificates. AI agents take on investigation and response proposals within defined rules. Permission checks and approval, execution authorization, and state transitions are handled by a deterministic safety kernel, and traffic is not moved on model output alone. The README describes Elastic investigation, external threat intelligence, Slack approval, and reversible infrastructure changes as the main flows. It is licensed under Apache-2.0 and also provides an example lab and documentation.
Actual cloud control is introduced at the contract testing stage, and credential verification has not been performed. Callback continuity is confirmed with independent telemetry. If continuity cannot be confirmed, the change is not treated as a success; instead the change is rolled back or administrator intervention is requested. Therefore, while the design of the safeguards is presented, the evidence for cloud control and credential verification is still limited.