Product architecture

How Method manages it’s infrastructure, AI orchestration, and end-user applications layers.

---

Overview

At the highest level, Method’s architecture has three parts:

1. Method infrastructure: The common systems for state, governance, data, Tool execution, C2, and deployment.
2. AI harness: The Agent management and execution loop that reasons over Method data and calls platform capabilities.
3. Apps and workflows: The end-user experiences that apply the platform to defensive, offensive, and customer-specific outcomes.

Method provides the infrastructure layer, an AI harness, and applications, while allowing for customers to use their own custom applications or their own custom or third party AI harnesses. Each path uses the same infrastructure contracts, so changing the experience or harness does not require rebuilding the underlying security platform.

Apps and workflows

Apps and workflows turn the platform into end-user experiences that solve specific security problems. Method’s applications include Reaper for software-defined offensive operations and Bastion for continuous enterprise challenge.

Method’s growing Public API surface enable building custom applications on Method infrastructure. A custom application can use Method APIs and MCP interfaces to access data, coordinate workflows, and expose an experience designed around your team’s operating model. These apps leverage the same state, governance, Ontology, Tooling Framework, and execution infrastructure as Method applications.

Method and custom applications coexist by using Method infra as a shared foundation, work performed through one application remains available to the others. For example, Objects generated during a Reaper Operation can appear in Explorer, and Findings generated through Bastion can become starting points for offensive validation.

AI harness

The AI harness manages Agent context and execution loops. It decides when to call a model, which platform capability to invoke, and how to continue based on the result.

Violet is Method’s AI harness. It specializes in multi-model orchestration and in operating Method infrastructure. You can use Violet with Method applications or call it through headless-capable APIs and MCP interfaces.

The architecture also supports custom harnesses and third-party harnesses such as Claude Code or Codex. These harnesses connect to the same Method APIs and MCP capabilities rather than bypassing the platform. Method infrastructure continues to coordinate state and record activity regardless of which harness initiates the work.

Method treats model choices as separate from harness choice. The Method AI Gateway can route model calls to Method-configured inference, customer-provided commercial inference, or on-premises inference. For a deeper view of Agent execution, model routing, and external harnesses, see Agent orchestration and AI Agents.

Method Core Infrastructure

Method infrastructure is the shared foundation beneath every application and harness, and is comprised of:

• State Machine: Coordinates actions across the system, whether a person, Agent, application, or workflow initiates them.
• Rules of Engagement: Applies global or tailored constraints to data access and actions. These deterministic controls govern both user actions and AI Agents.
• Ontology and Data Ledger: Tracks observations over time and materializes them into a typed knowledge graph. See Data architecture for the full data flow.
• Tooling Framework: Units of security work which are made legible for humans and AI, compiled for execution, and output processed into reusable Ontology data. See Tools and Developer for the Tool lifecycle and extension surfaces.
• Courier and Jackal: Provides the interoperable C2 protocol and security-agent framework that carry out work against target environments. Both Method-managed and self-managed patterns use the same protocol boundary. See Jackal and the Courier Protocol.
• Deployment: Method runs as SaaS, in a customer VPC, or on bare metal, depending on the supported deployment model. See System architecture for the platform and Jackal deployment boundary.

Example deployments

The layers can be composed differently without changing the Method infrastructure beneath them.

Fully deployed Method

Use Reaper and Bastion with Violet and the complete Method infrastructure layer. This gives defensive and offensive teams Method’s managed applications and AI experience while preserving the option to connect custom components.

Headless use of Method infrastructure

Drive Method infrastructure through a custom application and an external harness such as Claude Code or Codex. In this model, Method supplies the state, governance, data, Tooling Framework, C2, and deployment foundation while your chosen interfaces and harnesses provide the user and Agent experience.

Offensive practitioners and developers

Use Reaper for workflows in Operator while developers work through a custom harness and developer interfaces. Both paths share the same infrastructure, so practitioners can use developer-supplied tradecraft without creating a separate execution or governance stack.

Why this matters

This architecture creates a consistent foundation without forcing every team into the same experience:

• Choice above the infrastructure: Method supports using Method applications and Violet or bringing your own components, connecting supported third-party components, or mixing them.
• Governance layer: Every supported application or harness is governed through the same deterministic controls set in the platform.
• Data continuity: All supported paths read from and contribute to the same Ontology and Ledger.
• Reusable capabilities: A Tool or workflow integrated in the platform can serve Method applications, custom applications, and AI-driven workflows.
• Deployment flexibility: The same layers can support managed, customer-hosted, and headless patterns, as those options become available.

---