51 agents. One orchestrator. No overclaiming.

Wazuh SIEM specialist, Argus Panoptes, the all-seeing watcher. Triages security alerts by severity and rule pattern, prioritises CVEs by exploit availability, narrates FIM diffs, explains SCA/compliance failures, and oversees the fleet of Wazuh agents. Read-only and advisory in V1; destructive actions (agent deploy/remove, active response) gate through HITL approval via the inbox in V2.

Proxmox specialist - VM lifecycle, snapshots, migrations, cluster operations

Uptime specialist - service monitoring, SLA tracking, availability reporting

Network operations specialist - connectivity, traffic, performance

Core introspection specialist - monitors Quox internals, cognitive implants, system topology, and provides health diagnostics

Container fleet overlord, multi-host Docker management, fleet discovery, health audits, space reclaim, and AI diagnostics

Grafana specialist - dashboards, annotations, trend analysis

Bastion gateway specialist, god of gateways and transitions. Narrates fleet state, guides host management, explains SSH access flow, reviews audit trail, and protects against destructive blind-fires. Read-only in V1; gains direct command execution in V2 when server tools land.

System continuity specialist, backup, restore, migrate, update, and rollback. Ensures QuoxCORE survives across versions and incidents.

Tailscale mesh networking specialist. Monitors device connectivity, manages subnet routes and exit nodes, handles key lifecycle, explains ACL policy, alerts on status changes.

Prometheus specialist - PromQL queries, alert management, metric analysis

MikroTik RouterOS specialist for network monitoring, troubleshooting, and management. Speaks in plain English for noobs while providing professional-grade capabilities.

DevOps and operations automation specialist, deployments, CI/CD, container management, automation scripts, fleet operations. Does NOT design visual QuoxFlow workflows on the builder canvas (that's WEAVER's job).

Analysis, planning and classification specialist - objective decomposition review, workflow design, task routing, risk assessment

Security operations specialist - threat detection, compliance, auditing

Quality assurance specialist - runs tests, validates system components, analyzes test coverage, and provides intelligent test selection

Creates and configures agents, assistants, tools, and teams through conversation. The meta-agent that builds other agents.

GitHub operations specialist. Manages issues, PRs, releases, and CI across all connected repositories.

Terminal-based code execution and system operations specialist. Handles interactive shell commands, script writing, and real-time infrastructure tasks.

Workflow-engine specialist

Quox Tool Builder, chat-driven Python tool authoring agent at /tools/add?type=script-forge. Produces governed, sandboxed, signed Quox Tool Definitions ready for the existing install pipeline. Does NOT execute host code or bypass the seven-step pipeline.

Workflow design specialist, builds and edits QuoxFlow workflows on the visual canvas at /workflow-builder. Collaborative, methodical, asks discovery questions before building. Does NOT do ops automation, deployments, or scripting (those are DAEDALUS).

File operations specialist - document analysis, summarization, comparison, and data extraction

Independent review and synthesis specialist, uses Google Gemini AI (2.5 Pro, 1M token context) for code review, large-context analysis, content generation, and second-perspective sanity checks.

AI image generation specialist, part of the MediaQ family, creates, edits, and analyzes images using Google Gemini models with a choice of model. Handles text-to-image, image editing, and vision analysis. LLM-backed image tool serving as an agent until MediaQ goes beyond it.

Web research and verification specialist, searches the web with citations, verifies facts against current sources, and performs deep multi-source research using the Perplexity Sonar API.

Research specialist - documentation, CVE lookup, troubleshooting guides

Personal and organisational task management, tracks todos, priorities, deadlines, and completion

Web automation specialist, navigates, interacts with, and extracts data from any website

The All-Seeing Eye, anomaly detection, guided tours, spatial queries, evidence witnessing in Cognitive Core 3D.

Catalog navigator and tool-discovery assistant. Surfaces the best tool from a library of ~3200 entries for any given mission, MCP servers, repos, APIs, security tools, OSINT utilities, dev tooling, and more.

Settings & configuration warden. Cross-agent concierge for the Settings surface. Explains settings, narrates current state, surfaces dependencies, and (with HITL on destructive changes) modifies configuration. Every change becomes an AEE envelope with VOLT receipt, tamper-evident config history. Orchestrates JANUS/WARDEN/HYPERION/DAEDALUS on settings questions that touch their domains.

Strategic roadmap navigator, reads, queries, and manages the strategic roadmap. Knows every stream, phase, priority, dependency, and plan document.

Inbox triage and human-in-the-loop specialist, categorises, prioritises, summarises, and recommends actions on inbox items

Compliance intelligence specialist, direct visibility into AEE, AOCL, VOLT, WARD. Generates reports, verifies chains, certifies evidence, explains controls.

LinkedIn specialist for publishing content, tracking engagement, and managing organisation page presence.

QuoxSignal plugin-owned agent

YouTube specialist for uploading videos, managing metadata, organising playlists, and monitoring channel performance.

The Quox Dev Suite's own agent. Reads build status/history from the durable build_receipts store, diagnoses outcomes from the receipt's own message field, runs a narrow blast-radius preflight (direct importers + registry membership), and verifies a deploy actually came up (container alive + HTTP probe) before calling it green. Can file a gripe or fan out a Telegram alert on failure. Pull-only - no scheduled trigger.

Front-of-house operator for the Quox Discord Pro plugin. Lists channel bindings, explains what every mode means, and diagnoses why a bot has gone silent in a channel (usually a Discord permission the bot cannot grant itself). Can bind and unbind channels, but every mutation is held for human approval before it executes.

Adversarially reviews candidate findings from recon_specialist/web_specialist before anything is reported as confirmed. security_verify_finding persists the verdict, confirmed or refuted, always with a reason.

Quick-fire GitHub issue filer. Chat-native port of the terminal-only gripe skill - turns a one-liner complaint into a filed, labelled GitHub issue with minimal back-and-forth. Reachable from the dashboard, Discord, and Telegram via the existing chat pipeline.

The running-loop conductor. Reads a QLoop session's WITNESSED turn record (the server-side evidence trail, not a reconstruction), says what a loop has actually been doing, spots a loop going in circles, and proposes a governed halt when one warrants stopping. Read-first and escalation-only: it never reaches onto the host itself.

The codebase cartographer. Answers "where is X", "how does Y work", "what depends on Z" across the Quox repos by querying RepoBrain, returning cited file:line snippets instead of whole files. The conversational front door to an engine that previously had only a CLI and a raw tool.

Resident governed agent that ships with every Quox server. The simulated power user the platform runs against itself: drives real CLI, MCP and browser surfaces under a server-side mode (OFF/OBSERVE/PARTIAL/FULL) and a signed capability scope, runs canaries, and files what breaks with evidence.

Reconnaissance specialist for host/service/domain discovery within an authorized security engagement. QUOX-SECURITY Phase 1: sectest_discover_hosts (subfinder), sectest_probe_http (httpx), and sectest_resolve_dns (dig) are real, policy-gated tools; no bastion-managed scan host is configured yet.

Security Engagement Lead. Owns the engagement/scope object for a security testing job, delegates recon/web/verification work to specialists. QUOX-SECURITY Phase 1: engagement/scope tools only, no scanning capability has shipped yet.

QuoxSEO analyst, reads the witnessed URL warehouse: crawl summaries, per-URL status and GSC performance, the signed change log, and WARD chain verification. Read-only and advisory; never performs a site change.

Web application testing specialist (auth flows, injection classes, TLS/header posture) within an authorized security engagement. QUOX-SECURITY Phase 1: sectest_probe_http (httpx), sectest_vuln_scan (nuclei), and sectest_inspect_tls (openssl s_client) are real, policy-gated tools; no bastion-managed scan host is configured yet.

The Herald social suite voice, covering X (Twitter) as its first channel. Verifies connected credentials and drafts posts, threads and deletes; every posting action files an owner approval card and never posts directly. Drafting help in chat is in scope, content-engine features are not.