AI Agents

Meet your infrastructure team. Quox coordinates 49 specialized AI agents - each an expert in their domain - working together to help you manage, monitor, and troubleshoot your systems.

What are AI agents?

Imagine you run a busy restaurant. You would not ask the head chef to also seat guests, wash dishes, and manage reservations. Instead, you have specialists: a host, line cooks, a sous chef, and a manager who coordinates everyone. That is exactly how Quox works.

Agents are AI specialists. Each one is trained for a specific job, so when you ask a question, you get an expert response - not a generalist guessing.

Why this matters

A single AI trying to handle everything - security, networking, servers, data analysis - would be like asking one person to run every department of a company. It might work, but not well.

With specialized agents:

• Deeper expertise - CIPHER lives and breathes networking. WARDEN knows security inside out.
• Faster answers - The right agent gets your question immediately, no context-switching.
• Smarter collaboration - Agents can consult each other. CIPHER might ask DAEDALUS to check server resources while investigating a network issue.
• Clear accountability - You always know who handled what.

Meet your team

Think of this as your IT department org chart. Quox is the manager, and the specialists report in. There are 49 agents in the full roster; the seven below are the specialists you will meet most often.

The conductor

Quox is your main point of contact. When you ask anything, Quox figures out which specialist should handle it and orchestrates the response. You never need to pick an agent yourself.

Example: "Why is my app slow?" - Quox might involve CIPHER (is it network latency?), DAEDALUS (is the server overloaded?), and ORACLE (any unusual patterns?).

The specialists

WARDEN - Security operations

WARDEN watches over your infrastructure like a hawk. Security scans, intrusion detection, access audits - if it involves keeping bad actors out, WARDEN handles it.

Things WARDEN can help with:

• "Run a security audit on the production servers"
• "Check for failed SSH login attempts on nw-edge-gw-01"
• "Review firewall rules for the web tier"
• "Are there any suspicious processes running on nw-worker-01?"

DAEDALUS - Infrastructure management

DAEDALUS knows your servers intimately - CPU, memory, disk, containers, everything. When something is running hot or a VM needs attention, DAEDALUS is your go-to.

Things DAEDALUS can help with:

• "What is the disk usage across all Docker hosts?"
• "Restart the nginx container on nw-web-01"
• "Show me memory trends for the past week"
• "Spin up a new VM for testing"

CIPHER - Network operations

CIPHER speaks packets and protocols. Whether it is a routing issue, DNS mystery, or connectivity problem, CIPHER will trace it down.

Things CIPHER can help with:

• "Why cannot nw-monitor-01 reach the database server?"
• "Check if port 443 is open on the load balancer"
• "What is the network latency between regions?"
• "Show me the route to the external API endpoint"

ORACLE - Data & analytics

ORACLE finds the signal in the noise. Unusual spikes, emerging patterns, correlation between events - ORACLE spots what humans might miss.

Things ORACLE can help with:

• "Are there any anomalies in today's metrics?"
• "What caused the spike in errors yesterday at 3pm?"
• "Show me request patterns over the past month"
• "Correlate CPU usage with response times"

GEMINI - General assistant

GEMINI is your Swiss Army knife. Not everything fits neatly into security or networking - Gemini handles the in-between questions and general tasks.

Things GEMINI can help with:

• "What time zone is the monitoring server in?"
• "Summarize what happened in the last incident"
• "Help me draft a maintenance window notice"
• "What is the command to check SSL certificate expiry?"

ARCHIVIST - Knowledge management

ARCHIVIST is the institutional memory. Every conversation, every solution, every learned fact - ARCHIVIST catalogs it so knowledge is never lost.

Things ARCHIVIST can help with:

• "What did we decide about the backup schedule last month?"
• "Save this solution for future reference"
• "Find all conversations about the Redis cluster"
• "What do we know about nw-db-01's quirks?"

How agents work together

Here is a real example of agent collaboration:

You ask: "nw-web-01 seems slow - can you investigate?"

1. Quox receives your request and breaks it down
2. DAEDALUS checks system resources - CPU at 92%, memory fine, disk I/O elevated
3. CIPHER tests network connectivity - latency normal, no packet loss
4. ORACLE pulls recent metrics - spots a correlation with a new container deployment
5. Quox synthesizes everything: "nw-web-01 is CPU-bound due to the new logging container consuming excessive resources"

All of this happens behind the scenes. You just asked one question and got a comprehensive answer.

Just talk to Quox

Here is the beautiful part: you do not need to think about any of this.

Just ask your question naturally:

"Is anything wrong with the production servers?"
"Help me troubleshoot this network timeout"
"What happened at 2am that triggered all these alerts?"

Quox automatically routes your request to the right specialists. Think of it like calling a company's main number - you describe what you need, and you get transferred to the right department.

Agent hierarchy at a glance

                    Quox
                  (Conductor)
                       |
        +--------------+--------------+
        |              |              |
    WARDEN         DAEDALUS        CIPHER
    (Security)   (Infrastructure)  (Network)
        |              |              |
        +--------------+--------------+
                       |
        +--------------+--------------+
        |              |              |
     ORACLE        GEMINI        ARCHIVIST
    (Analytics)   (General)     (Knowledge)

• Level 0: Quox - Full access, orchestrates everything
• Level 1: WARDEN, DAEDALUS - Domain managers with elevated permissions
• Level 2: CIPHER, ORACLE, GEMINI, ARCHIVIST - Specialists focused on their domains

Ready to try?

Head to the Command Centre and just start talking. Ask about your servers, investigate an issue, or request a system overview. The agents are ready to help.

QUOX Agents & Assistants

This document covers the agent hierarchy, assistant system, self-awareness, plugins, tools, Smart Router, and related configurations.

Agent Hierarchy

QUOX uses a hierarchical agent system with specialized roles. The 8 named agents below illustrate the hierarchy pattern (orchestrator, managers, specialists); the full audited roster is 49 agent personas (src/data/agentsManifest.json).

Agent Roles

QUOX Self-Awareness System

The system includes hardwired self-knowledge that gets injected into every LLM request. Each assistant has a full JSON manifest defining their identity, rules, and capabilities.

Entity Manifest System

Files:

• src/config/entities/schemas/ - JSON schemas for assistants, tools, workflows
• src/config/entities/assistants/*.json - Individual assistant manifests (49 total; see src/data/agentsManifest.json for the audited roster)
• src/services/entityRegistry.js - Loads, queries, and merges manifests with user overrides

Assistant Manifest Structure

{
  "id": "sentinel",
  "identity": { "name": "SENTINEL", "tagline": "Security Operations", ... },
  "hierarchy": { "role": "manager", "level": 1, "manages": ["cipher"], ... },
  "capabilities": { "domains": ["security"], "intents": [...], "workflows": [...] },
  "rules": { "always": [...], "never": [...], "escalateTo": {...} },
  "safety": { "defconLevel": "AMBER", "requiresApproval": [...] },
  "ui": { "visualizer": {...}, "suggestions": [...] }
}

What Gets Injected

• QUOX system identity and purpose
• Agent hierarchy (QUOX -> SENTINEL/CIPHER/NOVA/GEMINI -> specialists)
• Assistant-specific self-knowledge (name, role, capabilities, rules, personality)
• MHA documentation with installation commands
• Current fleet status (connected agents, hosts without MHA)

Entity Registry API

import {
  getAssistant,
  listAssistants,
  generateSelfKnowledge,
  updateAssistant,
  resetAssistant
} from './entityRegistry'

// Get full self-knowledge for an assistant
const context = generateSelfKnowledge('sentinel')

// Query assistants by domain
const securityAgents = getAssistantsByDomain('security')

// Update assistant settings (user override)
updateAssistant('sentinel', { identity: { personality: { tone: 'stern' } } })

Context Injection Usage

import { formatContextForSystemPrompt } from '../services/quoxContext'

// Get full context with assistant-specific self-knowledge
const context = await formatContextForSystemPrompt(currentAssistant)

// Check if query is QUOX-related
import { isQuoxQuery } from '../services/quoxContext'
if (isQuoxQuery(text)) { /* special handling */ }

Assistant Settings UI

• src/components/settings/AssistantSettings.jsx - Grid/hierarchy view of all assistants
• src/components/settings/AssistantEditor.jsx - Full editor for customizing assistants
• src/components/settings/AssistantCard.jsx - Compact assistant card component

Plugin Management System

The dashboard includes a plugin management UI for enabling/disabling MHA plugins and managing licenses.

Files

• src/services/pluginClient.js - API client for MHA plugin/license endpoints
• src/components/settings/PluginSettings.jsx - Main plugin management panel
• src/components/settings/PluginCard.jsx - Plugin card component with status/toggle
• src/components/settings/LicenseActivation.jsx - Modal for entering license keys

Features

• License status banner with tier and expiration info
• Installed plugins grid with enable/disable toggle
• Plugin store browser (coming soon features)
• Trial license generation (30-day trials)
• Tab gating - SOC/NOC tabs hidden when plugins inactive

Plugin Tiers

Plugin API

import {
  getLicenseStatus,
  activateLicense,
  getPlugins,
  enablePlugin,
  disablePlugin,
  requestTrialLicense
} from './services/pluginClient'

// Get license status
const license = await getLicenseStatus()

// Activate with a license key (JSON format)
const result = await activateLicense(licenseKeyJSON)

// Get all plugins with their status
const { plugins } = await getPlugins()

// Enable/disable plugins (requires license)
await enablePlugin('soc')
await disablePlugin('soc')

// Request a 30-day trial
const trial = await requestTrialLicense('Customer Name')

Tab Gating

The CommandCenter automatically hides tabs when plugins are disabled:

// In CommandCenter.jsx
const [enabledPlugins, setEnabledPlugins] = useState(null)
const [pluginLoading, setPluginLoading] = useState(true)

// Filter tabs based on plugin state
VIEWS.filter(view => {
  if (pluginLoading || !enabledPlugins) return true  // Show all while loading
  if (view.id === 'soc' && !enabledPlugins.soc) return false
  if (view.id === 'noc' && !enabledPlugins.noc) return false
  return true
})

Tool Registry (AutoGen-style Discovery)

Dynamic tool discovery and management for assistants.

Files

• src/services/toolRegistry.js - Tool registry with access control
• src/config/entities/tools/*.json - Tool manifests (mha, prometheus, proxmox)

Features

• Tools defined with parameters, access levels, DEFCON levels
• Automatic filtering by assistant capabilities
• Function definition generation for LLM tool use
• Runtime tool registration/unregistration

Tool Registry API

import { getToolsForAssistant, validateToolCall, generateToolDocs } from './toolRegistry'

// Get tools available to an assistant
const tools = getToolsForAssistant('sentinel')

// Validate a tool call before execution
const validation = validateToolCall('mha.execute', { hostId: 'nw-worker-01', command: 'df -h' }, 'sentinel')
if (!validation.valid) console.error(validation.errors)

// Generate tool documentation for context injection
const docs = generateToolDocs('nova')

Assistant Storage (Persistence)

Server-synced persistence for assistant customizations.

Files

• src/services/assistantStorage.js - Sync service with backup/restore

Features

• localStorage for immediate persistence
• Background sync to server (60s interval)
• Export/import for backup
• Version history and rollback

Storage API

import { saveAssistant, syncToServer, exportSettings } from './assistantStorage'

// Save and optionally sync immediately
await saveAssistant('sentinel', { identity: { personality: { tone: 'stern' } } }, true)

// Export for backup
const backup = exportSettings()

AEE (Agent Envelope Exchange) Protocol

All QUOX communications use AEE envelopes for full audit trail and conversation threading.

Core Library

src/lib/aee/:

• types.js - Envelope structure, validation
• ulid.js - Sortable unique IDs
• envelope.js - Factory functions (createTask, createResult, createEvent, createError)
• intents.js - Intent registry (quox.chat., mha., ops.*)
• store.js - IndexedDB storage + server sync
• capabilities.js - Agent capability discovery

Envelope Structure (10 required fields)

{
  v: "1",                    // Protocol version
  id: "01JFX...",            // ULID
  ts: "2025-01-17T...",      // ISO timestamp
  type: "task|result|event|error|stream",
  from: "human.adam",        // Sender
  to: "agent.cipher",        // Recipient
  intent: "quox.chat.query",  // Namespaced action
  corr: "CONV_01JFX...",     // Correlation ID (same across conversation)
  reply_to: "01JFX..." | null,   // Parent message (causality chain)
  payload: { text: "..." }   // Intent-specific data
}

Key Concepts

• corr = conversation ID (survives every hop)
• reply_to = parent message ID (creates DAG)
• Stored in IndexedDB (browser) + SQLite (server)
• Auto-sync to server every 30s

Activity View

src/components/activity/:

• Conversations grouped by corr
• Click "Continue" to load conversation into chat
• Filter by type, intent, time range, search
• View raw JSON for debugging

Usage

import { createChatQuery, storeEnvelope, getConversation } from '../lib/aee'

// Create and store a query
const query = createChatQuery('Check disk on nw-monitor-01')
await storeEnvelope(query)

// Get full conversation
const messages = await getConversation(query.corr)

Smart Router (Layer 1 Pattern Matching)

The Smart Router intercepts user queries and handles common QUOX operations WITHOUT calling the LLM, providing faster responses and reduced costs.

File: src/services/quoxRouter.js

Architecture

User Query -> Smart Router -> [Pattern Match?]
                              |-- YES -> Direct Action Handler -> Formatted Response
                              |-- NO  -> Send to Claude with context injection

Implemented Pattern Categories

Usage

import { routeQuery, canRouteQuery, getPatterns, addPattern } from './quoxRouter'

// Route a query (primary function)
const result = await routeQuery('install mha on nw-worker-01', { currentAssistant: 'quox' })
if (result.handled) {
  console.log(result.response)  // Direct response without LLM
} else {
  // Send to Claude
}

// Check if query would be routed (for UI hints)
const { canRoute, pattern, description } = canRouteQuery('mha status')

// Get all registered patterns
const patterns = getPatterns()

// Add custom patterns (extensibility)
addPattern(
  'custom_action',
  /run\s+my\s+custom\s+(.+)/i,
  async (match, query, context) => ({
    handled: true,
    response: `Running custom action: ${match[1]}`,
    type: 'action'
  }),
  'Run custom actions'
)

Response Structure

{
  handled: true,           // Whether router handled the query
  response: '...',         // Formatted response text
  type: 'info|status|action|error|health',
  pattern: 'fleet_status', // Which pattern matched
  handledBy: 'smart-router',
  metadata: { ... }        // Pattern-specific data
}