TLDR Tech / InfoSec
Puck (GitHub Repo)
Puck is an MIT-licensed MCP server that drives autonomous, read-only endpoint investigations across a fleet, letting an engineer ask plain-English questions through Claude Code or any MCP client and receive narrative findings with containment recommendations. Rust agents execute only commands from a compiled-in typed allowlist enforced independently by both the Go server and the agent, so the worst case of a compromise is unauthorized read access rather than modification, with mTLS enrollment, audit logging, and cost caps built in. Operators should note that puck-agent reads sensitive files like keychains and process memory and may trip EDR heuristics, so it should be allowlisted before enrollment, and investigations should run under an API key or Teams/Enterprise plan rather than a training-enabled consumer account.
Read the full story