Architecture

System architecture

System overview

System architecture
System architecture

Method’s core platform coordinates AI-driven security workflows and deterministic security scans. The platform manages access, tracks workflow progress, and stores results. Its compute engine coordinates Tool execution in the environments you assess.

Method tracks each workflow as a directed acyclic graph (DAG): a set of execution steps and the dependencies between them. The graph records which Tools have run, the data each run produced, and which steps should run next. Workflows can branch into parallel scans and use earlier results as inputs to later steps.

You access the platform through an API gateway. Users authenticate through your organization’s single sign-on provider, such as Okta or Microsoft Entra ID. The platform authorizes API access to data based on the requesting user’s or Agent’s groups and permissions.

Method Compute Engine

AI Agents request Tool execution through the Method Tool Execution MCP. This interface gives Agents access to the Method Tool catalogue, which includes both Method-provided Tools and your own Tools. Agents decide what work to request; the compute engine evaluates those requests and coordinates execution.

Each request identifies a Tool in the catalogue, the target Objects, and execution context such as the Agent session. The Method Compute Engine evaluates the Rules of Engagement associated with that context and those Objects. These deterministic checks determine whether execution is allowed and which controls apply, including rate limits and permitted execution times.

The Workflow Lifecycle Manager receives the approved request with its execution controls attached. It dispatches the work, manages its lifecycle, and captures the Tool’s output.

Tools run in a Compute Execution Environment. Method provides a horizontally scalable cluster for scans from outside your security boundary. You can also supply your own cluster or direct work to a Jackal installed inside your network. Jackals are execution agents, distinct from the AI Agents that reason about which actions to request. The Courier protocol carries workflow commands and results between the platform and these execution environments.

After execution, the compute engine starts processing the captured output into Method’s Ontology, making discoveries available to subsequent workflows and analysis. See Data architecture for how Method stores and structures that data.

Headless access

Method’s public APIs let you use the platform from your own applications or AI harness. The Method UI is one way to interact with the platform; an authenticated API client can drive workflows without using that UI. API requests remain subject to the platform’s access controls.

Modularity

You can extend or replace several parts of the platform with components you provide:

  • Compute infrastructure: Run Tools on infrastructure with the capacity and network access your workflows need. Method can work with you to configure a horizontally scalable execution cluster in your environment. See Jackal and the Courier Protocol for the execution and communication architecture.

  • Models and inference providers: Connect models through OpenAI-compatible or Anthropic-compatible interfaces, or configure access to providers such as Amazon Bedrock, Azure, and Gemini. Workflow results depend on the model’s capabilities. See Agent orchestration for how Method selects and runs models.

  • Tools: Method includes Tools for network scans, web application fingerprinting, cloud scans, and other security workflows. Add your own Tools to the same catalogue so AI workflows can use them through the same execution path. See Developer architecture for the extension points.