> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.method.security/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.method.security/_mcp/server.

# Courier

> How Jackals use Courier to run workflows and support custom actions.

Run security work in your environment through Jackals and workflows.

---

## What is a Jackal?

A Jackal is Method's execution agent. Deploy one on a host to run security work from that host's position in your environment.

Jackals fetch the binaries or scripts they need, or use tools already installed on the host. Each Jackal advertises its capabilities so Method can check that it supports the work you assign. You can use Method's Jackal implementation or build your own compatible implementation.

## What is Courier?

Courier is the protocol that connects Jackals to Method. It carries work instructions, results, configuration, and streaming data in both directions.

Courier separates those messages from the transport that carries them. A custom transport can move the same work and results over a link suited to your network constraints. You can also tune communication timing and data sizes as your needs change.

Enrollment establishes a Jackal's identity, and signed messages let Method verify their source. Courier also supports payload encryption across transports. See [Jackal C2](/platform/architecture/jackal-c2) for the architecture.

## What does Courier compatibility mean?

A Courier-capable Jackal can receive and execute Courier workflows. Each Jackal advertises the actions it supports, so a Tool's workflow must use actions available on the selected Jackal. A workflow that runs shell commands also needs the matching shell, operating system, and architecture.

Courier compatibility describes execution capabilities, not where a Jackal runs. A Jackal can run in the cloud or on a deployed host; its location alone does not establish whether it supports Courier or the actions a particular Tool requires. Check the selected Jackal's capabilities against the Tool's requirements.

## What are workflows?

A workflow defines a task as an ordered sequence of steps. Each step pairs an **action**, such as running a command or transferring a file, with declared **outcomes**: the variables, files, or named outputs it expects to produce or use.

Steps can pass data to later steps. The workflow also defines how to handle failures, timeouts, and cleanup. For example, a workflow could download a scanner, run it, return its output, and remove the downloaded file.

**Custom actions** let you add your own tradecraft to workflows. Your Jackal implements the action and advertises support for it; a matching Tool can then invoke it. Custom actions use the same step and outcome model as standard actions, so you can compose them with commands, file transfers, and other workflow steps.

## How do you use workflows?

In an [Operation](/platform/core-platform/operations), you use Tools to request work. For work assigned to a Jackal, the Tool's compiler turns your inputs and targets into workflows. The Jackal returns named outputs as **Signals**, which the Tool's processor turns into Method Objects.

To define your own workflows, including custom actions, see [Bring your own Tool](/guides/best-practices/developer/operator-defined-tools) and the [Courier Tool authoring reference](/platform/core-platform/tools/tool-authoring-reference#courier-tool).

---

> **Note**
>
> To get started, [install and configure a Jackal](/guides/platform-setup/install-a-jackal).