Job Cybersecurity¶
job_cybersecurity - G6 Cybersecurity job agent.
Cluster: Job Agents | Type: component | MCP Tools: 26
Overview¶
G6 cybersecurity job agent providing defensive security operations including threat assessment, vulnerability evaluation, incident documentation, network analysis, compliance scanning, and security auditing. Built on the job_framework base with Quaternary/Information Technology sector classification, safety-gated high-stake operations, confidence scoring, and a Tier 2 MCP sub-package with 26 operations backed by SQLite persistence via CybersecurityStore.
Production readiness posture: high-stakes operations require structured professional attestation by default; live enrichment is opt-in via G6_JOB_CYBERSECURITY_ENRICHMENT or G6_JOB_ENRICHMENT; successful MCP JSON remains machine-parseable while regulated disclaimers are carried in metadata. When callers request optional enrichment while enrichment is disabled, the component surfaces completion_state: qualified-draft, degraded: true, and a warning card instead of silently omitting grounding or web references. Safety refusals and missing authorization surface completion_state: blocked-escalated with evidence; deterministic local success uses verified.
Scope and production use
The cybersecurity job agent is production-ready for defensive triage, documentation, workflow checks, incident-response planning drafts, vulnerability scoring support, and compliance gap review. It is not a complete SOC, penetration test, compliance certification, security monitoring system, exploit validation system, or substitute for qualified security review. Treat its output as decision support: use dedicated security tooling, manual review, maintained SAST/DAST/secret/dependency scanners, audit evidence, and incident-response procedures appropriate to the deployment before relying on results in production.
High-stakes authorization
High-stakes operations such as plan_response, evaluate_vulnerability, recommend_mitigation, audit_security, and scan_compliance require structured professional attestation by default. A bare security_officer_context=True flag is intentionally insufficient in production mode.
Capability discovery
The get_capabilities and info tools return cybersecurity-specific domain ops, high-stakes ops, sensitive ops, enrichment status, grounded QA status, safety context requirements, canonical envelope fields, and available programmatic recipes. Recipes are currently discoverable but not directly callable as MCP tools.
Public API¶
JobCybersecurityBlock(JobAgentBlock)¶
G6 Cybersecurity job agent - Tier 1 block with MCP delegation and safety gate.
| Field | Type | Default |
|---|---|---|
name | str | 'job_cybersecurity' |
sector | SectorClassification | field(default_factory=lambda: _SECTOR) |
toolkit | ToolkitSpec \| None | field(default_factory=lambda: JOB_TOOLKITS.get('cybersecurity')) |
mcp_module | str | 'mvp.job_cybersecurity.cybersecurity_mcp.server' |
agentic_planner | object \| None | None |
confidence_review_threshold | float | 0.6 |
capabilities | ClassVar[set[type]] | {Extensible, HumanLearnable, Collaborative, ProblemSolvable, KnowledgeGrounded, Memorable, AgentCommunicable, ExternallyAdaptable} |
Methods:
infer(data: JobCybersecurityInput) -> Result[JobCybersecurityOutput]¶
JobCybersecurityInput(JobInput)¶
Input for the Cybersecurity job agent.
JobCybersecurityOutput(JobOutput)¶
JobCybersecurityMCPBlock(AIBlock[MCPJobCybersecurityInput, MCPJobCybersecurityOutput, dict])¶
26-op MCP block for the Cybersecurity job agent.
| Field | Type | Default |
|---|---|---|
name | str | 'job_cybersecurity_mcp' |
state | dict | field(default_factory=dict) |
db_path | str | ':memory:' |
resource_bounds | ResourceBounds | field(default_factory=ResourceBounds) |
usage | ResourceUsage | field(default_factory=ResourceUsage) |
Methods:
infer(data: MCPJobCybersecurityInput) -> Result[MCPJobCybersecurityOutput]¶
MCPJobCybersecurityInput(BaseModel)¶
Input to JobCybersecurityMCPBlock --- 26-op dispatch.
| Field | Type | Default |
|---|---|---|
op | Literal['assess_threat', 'plan_response', 'evaluate_vulnerability', 'recommend_mitigation', 'document_incident', 'audit_security', 'analyze_network', 'scan_compliance', 'assess_risk', 'model_threat', 'create_proposal', 'review_deliverable', 'delegate_task', 'report_status', 'request_feedback', 'store_artifact', 'retrieve_artifact', 'list_artifacts', 'search_artifacts', 'archive', 'plan_sprint', 'track_progress', 'reflect_on_outcome', 'list_patterns', 'get_capabilities', 'info'] | required |
task | str | '' |
context | dict[str, Any] | Field(default_factory=dict) |
parameters | dict[str, Any] | Field(default_factory=dict) |
artifact_id | str | '' |
query | str | '' |
MCPJobCybersecurityOutput(BaseModel)¶
Output from JobCybersecurityMCPBlock.
| Field | Type | Default |
|---|---|---|
op | str | required |
result | str | '' |
artifacts | list[dict[str, Any]] | Field(default_factory=list) |
records | list[dict[str, Any]] | Field(default_factory=list) |
message | str | '' |
count | int | 0 |
found | bool | False |
metadata | dict[str, Any] | Field(default_factory=dict) |
degraded | bool | False |
degradation_reason | str \| None | None |
completion_state | Literal['verified', 'qualified-draft', 'blocked-escalated'] | 'qualified-draft' |
warning_card | dict[str, Any] | Field(default_factory=lambda: {'completion_state': 'qualified-draft', 'reliability_status': 'qualified-draft', 'warnings': ['Cybersecurity MCP output has not been explicitly verified.']}) |
evidence | dict[str, Any] | Field(default_factory=dict) |
request_id | str | '' |
task_id | str | '' |
run_id | str | '' |
CybersecurityStore(JobStore)¶
SQLite store for the Cybersecurity job agent.
Constructor:
| Parameter | Type | Default |
|---|---|---|
db_path | str | ':memory:' |
Methods:
execute(sql: str, params: tuple = ()) -> None¶
Execute a SQL statement and commit. Convenience wrapper for handlers.
fetchall(sql: str, params: tuple = ()) -> list¶
Execute a SELECT and return all rows as dicts.
fetchone(sql: str, params: tuple = ()) -> dict | None¶
Execute a SELECT and return the first row as a dict, or None.
Functions¶
assemble_review_text(output: Any) -> str¶
Collect the reviewable free text from a JobCybersecurityOutput (duck-typed).
assess_cybersecurity_output(output: Any, qa_block: Any | None = None, generate: Any | None = None) -> GroundedRunResult¶
Run grounded four-valued QA over a cybersecurity output.
MCP Tools¶
| Operation | Source |
|---|---|
assess_threat | cybersecurity_mcp |
plan_response | cybersecurity_mcp |
evaluate_vulnerability | cybersecurity_mcp |
recommend_mitigation | cybersecurity_mcp |
document_incident | cybersecurity_mcp |
audit_security | cybersecurity_mcp |
analyze_network | cybersecurity_mcp |
scan_compliance | cybersecurity_mcp |
assess_risk | cybersecurity_mcp |
model_threat | cybersecurity_mcp |
create_proposal | cybersecurity_mcp |
review_deliverable | cybersecurity_mcp |
delegate_task | cybersecurity_mcp |
report_status | cybersecurity_mcp |
request_feedback | cybersecurity_mcp |
store_artifact | cybersecurity_mcp |
retrieve_artifact | cybersecurity_mcp |
list_artifacts | cybersecurity_mcp |
search_artifacts | cybersecurity_mcp |
archive | cybersecurity_mcp |
plan_sprint | cybersecurity_mcp |
track_progress | cybersecurity_mcp |
reflect_on_outcome | cybersecurity_mcp |
list_patterns | cybersecurity_mcp |
get_capabilities | cybersecurity_mcp |
info | cybersecurity_mcp |