The platform
A workflow engine for security — not another SOAR.
Skydra is built on four small ideas: typed steps, declared data, durable execution, and evidence-first findings. The security capability is the moat; the engine stays honest about what it is.
The vocabulary
Ten nouns carry the whole product.
Every product decision we make returns to this list. Nothing is reinvented in a second place; everything that exists has a job.
Workspace— the tenant
People, data, runbooks and credentials live inside one. A workspace is the thing a team shares; a personal account model would be wrong from day one.
Action— one unit of security work
Resolve DNS, audit a cloud account, probe a URL, send a Slack message. 250+ ship with Skydra; adding one is a single file.
Runbook— the automation
A graph of steps with typed inputs and outputs. Versioned. Scheduled, triggered by webhook, or called from another runbook.
Step— one node inside a runbook
The platform's unit of execution: an Action, a nested Runbook, a Wait, or an Approval. Data shaping happens inside a step, never as one.
Run— one execution of a runbook
Status, timing, inputs, outputs, logs, retries, and full history. "Last 20 runs" is a question the engine answers natively.
Trigger— why a run started
Manual launch, schedule, webhook, another runbook. Triggers are a property of the runbook, so adding one is editing the runbook, not visiting a scheduling section.
Connection— a configured external service
Credentials plus endpoint, sealed in the vault. The runbook graph never sees plaintext; a connection reference is what crosses the wire.
Finding— a security-relevant conclusion
Severity, evidence, affected asset, remediation. Industry-standard shape; evidence-first — a public identifier or soft-404 stays a lead until a stronger check proves impact.
Asset— a thing that exists in your estate
A domain, host, IP, repository, cloud account. Enriched by every run that touches it; the asset page shows provenance.
Collection— a durable, typed, deduplicating set
The gap between one remembered value and a Finding. Field-mode identity for records with their own fields; first-seen, last-seen, and observation count come free.
Execution model
Four step kinds. Nothing else is a step.
A unit of execution means a durable task row, a queue message, a retry, and a line in your run history. Everything that does not deserve all four — filtering, mapping, deduplication, formatting — is a primitive inside a step, not a step of its own.
Action
One typed capability from the catalog. Resolves DNS, audits an account, probes a URL, sends a notification.
Runbook
A nested call: another runbook, run as a step. Chained for reuse — write it once, invoke it everywhere.
Wait
Pause for a duration, or until a computed time. Parked in the database, so a 24-hour wait costs nothing.
Approval
A step that waits for a human decision. Records who approved, when, and the comment they left — part of the run.
The step/primitive boundary is the single most load-bearing decision in the architecture. Making to_lower a durable task would produce a run history no human could read, and we would be back to scanning logs.Typed data flow
Every input and output has a meaning, not just a shape.
A Domain is not a string. A port is not a number. A CloudAccount is not a UUID. Forty-one semantic types ship with the platform, and they power validation, compatibility, intelligent step selection, and generated form inputs.
inputs:
domains: list<Domain>
steps:
resolve:
action: dns.resolve_a
with: { hosts: inputs.domains }
refine: filter(step.output ne [])
probe:
action: http.get
forEach: resolve.output.hosts
with: { url: concat("https://", item) }
flag_broken_tls:
action: tls.audit
condition: probe.output.status_code >= 400
with: { host: probe.output.host }
notify:
action: slack.post
with:
channel: "#security-ops"
summary: templates.scan_summary.render(flag_broken_tls.output)Durable execution
Everything a run touches, persisted and attributed.
There is no in-memory state Skydra forgets. Runs survive restarts, retries resume where they left off, and a run from last month is still readable after the runbook changes.
Durable state
Every run, step, attempt, log and event is a row. The exec schema is the single source of truth; the dashboard reads it, the retry logic writes it, and nobody computes a derived number twice.
Retries and resume
Per-step retry policy: attempts, backoff, jitter, retry-on classification, circuit breaker. A fallback step is the recovery path. One click re-runs just the failed step and resumes the run.
Collections
A deduplicating, typed, durable set of elements. Runs keep adding to it with declared identity rules; "what is new since last time" is a free property of the data model.
Backpressure built-in
Per-run concurrency, per-workspace rate limits, per-action timeouts. Scanning a hundred thousand hosts is a fan-out shape; running it is a scheduling problem the engine already solved.
Audit trail
Who did what, when, from where, with which API token. The organization audit log is the viewer's own history; the platform audit is the operator's.
Scope policy
A runbook refuses to probe a target that is not on the workspace's allow-list, regardless of what the runbook author typed. The policy is a separate control from the manifest.
Platform shape
Four services, two schemas, one invariant.
The architecture is deliberately small. Each service owns one thing and only that thing. The invariant: the console never holds a database or cloud credential — every byte of security data crosses the API.
The console
- Next.js App Router UI
- No database or cloud credentials
- All reads and writes through the API
Identity authority
- Owns identity, tenancy, policy
- Validates every untrusted input
- The only writer to the app schema
Execution runtime
- Owns run, step and task state
- Fan-out, scheduling, retries
- Transactional outbox for findings
AI-facing surface
- Model Context Protocol server
- Capability-shaped tools
- Scoped personal access tokens
See it on your own targets.
Scope policy is on by default, so probing actions refuse until you declare what Skydra is allowed to touch. Clone a starter runbook, add your domain, and watch it execute.