Architecture

Layers

• Exposure Defense Cockpit — the executive UI: overview, intake, exposures, evidence, StealthScore, Kanban, calendar, action packets, report and trace.
• Control plane API — a versioned /api/v1 surface for principals, findings, evidence, risk, kanban, calendar, actions, reports and integrations.
• Machine surface — health, OpenAPI, llms.txt, sitemap, RSS, robots, .well-known manifests and an MCP server.
• Drafting providers — server-side packet drafting with a deterministic template fallback when optional providers are unavailable.

Access model

Cloak Harbor is designed for public-safe read views and server-authorized actions. The UI does not ask users for platform credentials. State-changing work is routed through allowlisted server actions, with secrets kept on the backend and audit rows recorded for review.

Draft safety

• Server-side only — no provider calls from the browser
• Every draft is source-labeled and human-reviewed before any external action
• Drafting may never submit takedowns automatically or enrich real people without authorization
• If a provider is unavailable, the system degrades to labeled deterministic templates — it never fakes output

Evidence proof loop

Rather than tour a collection of sites, Cloak Harbor maps real operating capabilities to each stage of the defense loop. Users see the operational story: what was found, why it matters, what needs approval, and what is already scheduled.