MODULES
Your tools plug in as modules.
The eight access-path layers are universal. Your firewall, your DNS, your identity provider plug in as modules that read a layer. A module is a small folder of plain files, and the standard is free and open.
A module is a folder of plain files.
No plugin SDK, no compile step. A module describes one vendor or one layer in files a person can read. Two files do the work, the rest are optional.
The engine handles the reasoning and the safety. A module just teaches it about one tool.
Three doors for the data.
A module reads evidence through one of three doors. The first ships today. The other two are part of the standard and arrive in a later release.
Export from your tool to CSV or JSON, drop the files in, and the engine reads them. No code, no live connection, nothing to open up. This is how the DNS and Check Point modules work today.
Point the module at a vendor MCP server or a REST API, and the engine reads the evidence directly, read-only. Defined in the standard, not enabled in the engine yet.
For anything else, a small adapter script returns the rows. Defined in the standard, not enabled in the engine yet.
Today pluggable modules are file-drop only. The engine rejects live and custom module connections at load time, on purpose, until that support ships. Separate from modules, the engine ships built-in read-only network probes that do run live. We do not promise doors that are not open yet.
Two official modules ship with the engine.
The $349 bundle includes the engine and these two official modules, ready to run. Both are file-drop modules. Both are built and validated.
Turns name resolution into evidence. Reads exported lookups to find a stale record, a wrong split-horizon view, or a TTL that has not propagated. The reference module for the standard.
Browse the module ›Turns firewall and identity data into evidence. Reads exported logs and Identity Awareness state to find a rule that never matched or a user not mapped to their IP.
Browse the module ›The standard is free. The engine is the product.
The Open Module Standard is free and public. Read it, and write a module for any tool you run. You do not pay for the standard, and you do not ask permission. That is the open half.
The engine is the paid core, $349 paid once. It does the reasoning, walks the access path, and enforces read-only safety so a module author cannot make it unsafe. That is the core half.
More modules, in order.
The roadmap follows the stacks real teams run together. These are planned, not shipped. The names below are targets, not a release date.
You do not have to wait. The standard is open, so you can write any of these yourself today, as a file-drop module.