Connect your workflow.
Use endpoint evidence from scripts, security tools and MCP clients. Start with a customer key and one enrolled endpoint.
Current release: customer-scoped API keys, asynchronous read-only questions and six MCP tools. OAuth and granular team access are planned.
Start here
Your first endpoint query ↗
Discover an enrolled endpoint, ask a question, and retrieve its attributed answer.
Authentication & scopes ↗
Use a revocable customer key with only the permissions your integration needs.
Connect through MCP ↗
Let an MCP client discover endpoints, submit questions and retrieve attributed answers.
Guides
Integration examples ↗
Copy a complete TypeScript or Python workflow, or compose a pipeline with curl.
Queries & evidence ↗
Understand completion, partial answers, cancellation and what the API actually stores.
Customers & access ↗
Every customer is a separate tenant. Provider access must be explicit.
Troubleshooting ↗
Diagnose credentials, protocol errors and endpoint timeouts without guessing.
Local evidence embeddings ↗
An optional endpoint retrieval capability, separate from hosted finding search.
Operate
Install an endpoint ↗
Install Recursift on a supported Mac, enroll it with a one-time token, and confirm its first heartbeat.
Check protection state ↗
Confirm that an endpoint is enrolled, collecting, following your policy, and delivering findings.
Triage health and incidents ↗
Read events, findings, detection results and question states, and find the logs, without changing the endpoint.
Recover an endpoint ↗
Handle lost evidence keys, revoke and re-enroll, and compare a machine to a known state, knowing what cannot come back.
Data retention ↗
What stays on the endpoint, what leaves and why, the bounds on each store, and how deletion works.
Update Recursift ↗
How endpoint and console updates arrive today, how to verify them, and the rollback stance.
Support and escalation ↗
Who is responsible for what, how to escalate, the release inventory, known gaps and the controls that stay in place.
Deploy
Deployment profiles ↗
Which ways of running Recursift are available, which are pending because the software is not there, and the starting footprint for a customer-hosted server.
Install a customer-hosted server ↗
Verify the offline release, install the core server on one Linux machine, create the first administrator, enroll an endpoint and ask it a question.
Customer-hosted sign-in and recovery ↗
How people sign in to a customer-hosted console, how the first administrator is created and recovered, and what the Recursift-hosted service keeps instead.
Back up, restore and remove ↗
Back up a customer-hosted server, restore it onto an empty server, remove it, and the current gaps for upgrades and key rollover.
Troubleshoot a customer-hosted server ↗
Health endpoints, service logs, and what each installer, backup and restore error means and how to recover.
Reference
REST API reference ↗
The current v1 contract, from endpoint discovery to query results and audit events.
MCP tool reference ↗
Nine tools, all bounded by the calling customer key and its scopes.
Detection capabilities ↗
What detection does today, what has been measured, and what is not yet qualified, with every count and its denominator.
Limits & availability ↗
Build against the current release with explicit boundaries and predictable retries.
Data flows and retention ↗
Exactly what stays on the endpoint, what the console and Query API store and return, what the relay sees, how long each keeps it, and the security log schema.