Introducing TurenOS: An Agent Harness Built for Security Teams

Tom Bowyer

— 2 min read
Share

Most agent harnesses are built around software output.

Give the agent a repository. Ask it to build something. Let it read files, write code, run tests, and keep working until the software works.

Security teams work differently.

A defender might start in a SIEM, pivot to EDR, check cloud logs, inspect a binary, search threat intelligence, review source code, scan a dependency, and then jump back to the original alert.

Tools live everywhere. Dashboards are everywhere. Security work is a constant series of pivots.

We think security teams need their own place to live day to day.

So we're building TurenOS.

A security workbench, not another dashboard

TurenOS is a local-first desktop agent harness built around investigation, analysis, remediation, and security engineering.

We started with OpenCode's agent foundation, then began building the security environment we wanted on top of it. TurenOS is now an independently maintained hard fork.

The goal is simple: instead of making defenders stitch together an agent, a dozen MCP servers, scanners, threat feeds, terminals, and dashboards, bring those capabilities into one agent workflow.

Today, TurenOS already includes:

  • Security and threat data from sources including OSV, deps.dev, CISA KEV, EPSS, GHSA, NVD, MITRE ATT&CK, CWE, D3FEND, ExploitDB, LOLBAS, GTFOBins, and more.
  • Binary and forensic analysis through bounded local analysis tools, including packaged offline analyzers.
  • MCP support for bringing additional tools and code intelligence into an investigation.
  • Permissions and tool controls so agent actions can be allowed, denied, or sent to the defender for approval.
  • Parallel agent work through child tasks and a shared Team Board for notes, evidence, corrections, and coordination.
  • Durable automations for scheduled or event-driven security workflows.
  • Local project memory so important findings, decisions, and observations survive individual sessions.
  • Session history and replay backed by a durable event log so the path through an investigation is not lost.

The security integration layer alone already brings scanners and security data sources behind a common agent-facing interface.

Keep the investigation together

This is the part we're most interested in.

The value of an agent is not just that it can call a tool.

It is that it can help connect the investigation.

An alert can lead to a hash lookup.

The hash can lead to threat intelligence.

That can lead to a binary.

The binary can lead to source code.

The source code can lead to a vulnerable dependency.

The dependency can lead to a patch.

And the patch can lead back through validation to prove the issue was actually fixed.

The defender should not have to restart that thought process every time they change tools.

TurenOS keeps the session, tools, evidence, permissions, and project knowledge together. Its memory system is local and project-scoped, with provenance and historical validity attached to what gets remembered.

Agents that can keep working

Not every security task should begin with someone opening a chat window.

TurenOS also has durable local automations that can run agent or skill workflows on a schedule, when files change, or when another session ends.

That opens up workflows like recurring security reviews, dependency checks, CI failure triage, research collection, and other repetitive work that normally eats up defender time.

And because multiple sessions can run concurrently, TurenOS can delegate work to specialist agents instead of forcing one giant agent to do everything.

This is still early

TurenOS is under active development.

We are building toward deeper application security workflows, evidence-preserving findings, remediation verification, stronger isolation, and richer security workbenches.

A home for defenders and their agents

We think agents are going to become a normal part of security work.

But the answer is not simply giving security teams coding agents with different prompts.

The harness should understand the job.

Investigate. Pivot. Analyze. Act. Verify. Remember.

Most agent harnesses are built to help software teams produce more software.

TurenOS is being built for the people who have to defend it.

TurenOS is open source and MIT-licensed. Check it out here https://turen.io/turenos.

Read more