paniq Join the waitlist

Incident response as code · paniq 0.1.0-dev

The incident gets a file.

When a service is on fire, paniq moves it into a safe state with one command. A second one takes everything back. Every step is shown up front, verified against the host afterwards, and recorded in an evidence chain.

Join the waitlist See how it works
  • One binary, about 9 MB
  • No daemon
  • No cloud
  • No telemetry
Replayed session. Every line is real output from paniq 0.1.0-dev.
  • Linux lab: 226 + 5 checks, no failures
  • macOS lab: 108 + 17 checks, no failures
  • Windows lab: 55 checks, no failures
  • Back after 5 min without paniq confirm
  • Every safeguard expires after 14 days
  • Exit codes 0 to 4
  • No call-home, no telemetry
  • --json · MCP · SARIF 2.1.0
Stance

No dashboard. No agent. No cloud. One command moves the service into safety, a second brings it back, and every step is proven.

5 minto rollback if nobody confirms
14 dexpiry of every safeguard
0network calls on its own

How it works · four commands

Inspect. Secure. Prove. Roll back.

The procedure is always the same, whether nginx, sshd, IIS, a database, or a Cloudflare zone. Every step has a rollback, every change an expiry date.

  1. 01Inspect

    Inspect against the real host.

    paniq reads the machine’s inventory and matches it locally against public vulnerability data. status --verify compares every service with what actually runs, not with a note. If anything differs, the signal turns red and the exit code becomes 2.

    paniq check --fetch
    $ paniq check --fetch paniq check · srv-01 ──────────────────────────────────── Inventory 231 components, 35 ports Feeds kev:abruf Registry /usr/share/paniq/registry (4 modules) ● No matches – nothing to do → Next step: paniq status $ paniq status --verify paniq status · srv-01 Services 1 service Signal green ● normal web

  2. 02Secure

    The plan first, then the protection.

    paniq shows every step and the rollback up front. Then it sets shield the state. Anyone who does not confirm within 5 minutes with paniq confirm gets the old state back automatically. Every safeguard expires after 14 days.

    sudo paniq shield web --state isolated
    $ paniq plan web --state isolated paniq plan · web ──────────────────────────────────── web: normal → isolated (expires in 14d) The service is cut off from the network – emergency only. Steps 2 Rollback paniq undo + restrict_port tcp/22 (allow=203.0.113.0/24) + restrict_port tcp/5432 (allow=203.0.113.0/24) $ sudo paniq shield web --state isolated --yes paniq shield · web State normal → isolated Until 2026-11-07 14:02 Steps 2 reset in 5m without paniq confirm – reachable? paniq confirm web 2 steps applied. Undo: paniq undo web $ sudo paniq confirm web Confirmed: web – protection stays until expiry. Next step: paniq status

  3. 03Prove

    Every step lands in a chain.

    What was inspected, what changed, who triggered it, what was rolled back. The evidence entries are chained and can be verified and anchored. A drill with drill switches states, verifies, and rolls back, with its own evidence.

    paniq evidence verify
    $ paniq evidence verify Chain OK: 3 entries (no anchor set – next step: paniq evidence anchor --to FILE). $ sudo paniq drill web --state secured --live Drill web → secured: verified=true, rolled_back=true (evidence #4) $ paniq report --pdf nachweis.pdf

  4. 04Roll back

    Everything back, verified step by step.

    paniq rolls back every change in reverse order and verifies after each step. The evidence stays, because an incident must be proven after it ends, too.

    sudo paniq undo
    $ sudo paniq undo web: isolated → normal Rolled back. Next step: paniq status $ paniq status paniq status · srv-01 Services 1 service Signal green ● normal web

Paniqfile

Four states. One file in the repository.

paniq init reads the inventory and writes the Paniqfile: service, components, states. The file is text, belongs in the repository, and is checked with paniq lint checked. Four levels, from harmless to strict.

normal

Everything as usual. No intervention, nothing expires. The signal is green, exit code 0.

  • Ports, paths, and services as configured
  • ● normal web
/etc/paniq/services/web.yaml normal
version: 1 service: web kind: webapp runs_on: [server/testhost] components: [nginx] states: secured: mitigations: registry degraded: web: static_snapshot paths: /admin: restrict isolated: ports: 22: restrict 5432: never_public

paniq lint: 1 file checked – no problems. Next step: paniq plan SERVICE

Plattformen

Ein Binary. Vier Plattformen.

paniq sets rules with the platform’s real tools, not simulated. Tested in labs with real services, including restart and rollback.

  • Linux nftablessystemdnginxapache2sshd 226 + 5checks
  • macOS pf anchorlaunchdnginxapachephp-fpm 108 + 17checks
  • Windows netsh firewallServicesIISRegistry 55checks
  • Cloudflare Zone firewallruns on any OS APIno agent needed

Six standards

Not claimed, but measured.

Every claim is tested on real machines. What is not tested does not appear here.

Reversible

Every change has a rollback and an expiry date, 14 days by default. Without paniq confirm a safeguard resets itself after 5 minutes.

Checks per lab run on real machines, plus restart checks.

Light

9MB

One binary. No runtime, no daemon.

Fast

4commands

inspect, secure, prove, roll back. The next step appears in every output.

Portable

paniq sets network rules with the platform’s tools, locally, no cloud, no telemetry. No call-home, no auto-update.

  • nftables
  • systemd
  • launchd
  • pf
  • netsh
  • IIS

Stable

Fixed exit codes. Failures end hard, never half applied.

Flexible

Das Paniqfile ist Text für Menschen. Registry-Module liefern erprobte Abwehr, und über MCP nutzt ein Agent dieselben Befehle wie du.

  • --json
  • Exit codes 0–4
  • MCP
  • SARIF

For agents & CI

Built to be called.

Every command speaks JSON and ends with a fixed exit code. Cron jobs, pipelines, and agents need no special handling.

cron, CI, monitoring
# JSON on stdout only, exit code as the signal $ paniq --json status || notify "not green" # What can this binary do? $ paniq --json capabilities

Das Manifest paniq.capabilities/v1 nennt Befehle, Flags und Exit-Codes.

License

Free for everyone, who does not make money with it.

The source is under PolyForm Noncommercial 1.0.0. Anyone using paniq commercially pays for a license.

Free

Free to use

  • Individuals, for any purpose
  • Clubs, education, and research
  • Non-profit organizations

Commercial license

License required

  • Companies of any size
  • Freelancers on client work
  • Managed service providers and hosts
commercial@paniq.dev

A license never turns off the emergency brake. paniq undo works at all times.

May my company use paniq?

Yes, with a commercial license. That applies to companies of any size.

I manage servers for clients as a freelancer or MSP.

Then you need a license, even if the servers belong to the client. Tell us how many hosts you betreust.

What does a license cost?

We agree on scope and price with a quote via commercial@paniq.dev.

What happens if a license is missing?

The emergency brake stays. paniq undo works at all times, so no service gets stuck in a secured state.

Does paniq send data home?

No. No telemetry, no call-home. Network access only when a command explicitly asks for it, e. g. B. check --fetch (KEV catalog from CISA) or --feed NAME=URL; everything else needs only files in the repository.

Waitlist

Be there when paniq launches.

We write rarely: once at launch, then only for security advisories that affect your install. No newsletter, no sharing.

For MSPs and companies: state in the “Context” field how many hosts you manage. Then you get a license to test first.

You are on the list.

We will get in touch at launch. Revoke at any time by mail to waitlist@paniq.dev.

Prefer email? waitlist@paniq.dev