Tools

Deterministic actions that define the available action space for people and AI Agents in the Method Platform.

What is a Tool?

A Tool is an atomic security action in the Method Platform. Each Tool wraps an API, scanner, custom CLI, or Courier workflow to perform one specific technical task, such as scanning a target, retrieving cloud configuration data, or enumerating network resources.

Tools establish the boundary between reasoning and action. Method’s AI can reason about which Tool may advance an objective, but it never receives a raw shell or an arbitrary network primitive. Every interaction with an external system must use a Tool that engineers have defined, typed, versioned, and validated in advance.

This shifts operational risk from an unbounded, real-time action space to Tool development, where you can inspect behavior, test it against representative inputs, and make changes reproducibly. Tools define which actions are possible. The user decides which Tools and parameterizations are allowed for each Operation through its current Rules of Engagement, and can change those Rules as the Operation evolves. Read Trust a Model to Reason, Never to Act for the design philosophy behind this boundary.

Atomic by design

Large security integrations like AWS or Okta are not represented as a single Tool. Instead, Method decomposes them into many small Tools, such as “Enumerate AWS EC2 Instances” and “List IAM Roles.” This gives users fine-grained control over inputs, targets, effects, and output. It also makes the capability composable, auditable, and easier to authorize.

Open-source foundation

Method open-sources many of its Tool implementations as CLI apps. You can inspect the behavior that executes in customer environments and use those implementations as references when you develop your own Tools.

How a Tool works

Method executes and learns from a Tool through a deterministic chain:

Tool definition -> compiler -> Courier workflow -> Jackal -> Signals -> processor -> Ontology Objects

• Tool definition: Describes the capability, its risk, typed inputs, supported target object types, and expected Ontology output.
• Compiler: Converts typed parameters and target Objects into a set of planned executions. It deterministically enforces the current Rules of Engagement and rejects unsupported, unsafe, or out-of-scope parameter combinations before a Jackal receives work.
• Courier workflow and Jackal: Courier describes the work and a compatible Jackal executes it.
• Signals: Preserve raw output and diagnostics for auditability and troubleshooting.
• Processor: Parses and normalizes Signals into durable Ontology Objects and links.

Tools are the verbs of the platform. Ontology Objects are the typed nouns that Tools can discover and, when authorized, target. This lets Rules of Engagement enforce scope against concrete Objects and Tool behavior instead of relying on a model to judge arbitrary commands at runtime.

Tool organization

Tools are organized by one MITRE ATT&CK tactic family that reflects their primary purpose:

• RECONNAISSANCE
• RESOURCE_DEVELOPMENT
• INITIAL_ACCESS
• EXECUTION
• PERSISTENCE
• PRIVILEGE_ESCALATION
• DEFENSE_EVASION
• CREDENTIAL_ACCESS
• DISCOVERY
• LATERAL_MOVEMENT
• COLLECTION
• COMMAND_AND_CONTROL
• EXFILTRATION
• IMPACT

Each Tool also declares its risk level, target types, runtime compatibility, and ATT&CK techniques. This metadata is part of the safety and planning contract, not just catalog information.

Tools app

Click into any Tool to view:

• Details: Purpose, parameters, required inputs, associated links, and the types of Objects it creates
• Examples: Sample use cases and representative executions showing how the Tool is used in operations
• Tasks: All existing Tasks that use the selected Tool

How Tools feed the platform

Every Tool execution feeds the Ledger, which retains the Signals and execution record. The Processor then updates the Ontology with what the Tool actually discovered. A Tool run in an automated Task, manual Operation, or AI Agent workflow therefore contributes reusable, typed knowledge to Method’s continuously updating picture of your environment.