Threat hunting workflow commands, agents, and hooks for agentic IDEs.

From signal, to swarm.
No gods. Only Thrunt.

Threat hunting command system for agentic IDEs.
Claude Code · OpenCode · Gemini · Codex · Copilot · Cursor · Windsurf

/thrunt:autonomous  |  one command, full hunt

Install  ·   Phases  ·   Commands  ·   Flows  ·   Artifacts

Installation

npx thrunt-god@latest --claude --local

Bootstrap the hunt command surface into your local IDE environment.

Install the VS Code extension alpha

Download thrunt-god-0.3.0.vsix from the v0.3.0 release.

Then install it one of two ways:

1. In VS Code, open Extensions, click the ... menu, choose Install from VSIX..., and select the downloaded file.
2. From terminal:

code --install-extension thrunt-god-0.3.0.vsix

After install, open a folder containing .planning/MISSION.md or .hunt/MISSION.md and the THRUNT sidebar will activate automatically.

The Five Phases

Every hunt resolves through five phases. Each step is explicit.

Hunt Commands

Thrunt Commands

Utility and orchestration commands (/thrunt:*) for workspace management, diagnostics, settings, and agent control.

Common Flows

/hunt:new-case
/hunt:shape-hypothesis
/hunt:plan 1
/hunt:run 1
/hunt:validate-findings 1
/hunt:publish

/hunt:new-program
/hunt:map-environment
/hunt:new-case
  ... repeat per signal ...

/hunt:new-case --pack domain.identity-abuse
/hunt:run 1
/hunt:validate-findings 1

/thrunt:autonomous

Artifacts

All hunt state lives in a planning directory at the project root (.planning/ by default). Every query, receipt, and finding is a file, not a summary.

.planning/
├── config.json             # Project settings (mode, profile, connectors, workflow toggles)
├── MISSION.md              # Hunt program mission and scope
├── HYPOTHESES.md           # Testable hypotheses with status tracking
├── SUCCESS_CRITERIA.md     # Definition of done for the program
├── HUNTMAP.md              # Phase breakdown and execution roadmap
├── STATE.md                # Current phase, progress, blockers
├── FINDINGS.md             # Validated findings only
├── EVIDENCE_REVIEW.md      # Evidence chain audit
├── QUERIES/                # Exact queries run, with timestamps
├── RECEIPTS/               # Execution receipts per phase task
├── DETECTIONS/             # Detection rules promoted from findings
├── environment/
│   └── ENVIRONMENT.md      # Data source inventory and access map
├── phases/                 # Per-phase plans, research, and results
├── workstreams/            # Parallel hunt cases (optional)
├── milestones/             # Archived completed milestones
└── published/              # Final deliverables

Configuration

Settings live in .planning/config.json, created by /hunt:new-program and editable via /thrunt:settings. Global defaults in ~/.thrunt/defaults.json are merged into every new project config.

Full schema and connector profiles: docs/CONFIGURATION.md

Custom planning directory

Set THRUNT_PLANNING_DIR to change the directory name. This affects all path resolution, project root detection, and artifact storage.

export THRUNT_PLANNING_DIR=".hunt"

Storage

By default, .planning/ is committed to git so hunt artifacts travel with the repo. To keep artifacts local:

1. Add .planning/ to .gitignore
2. Set planning.commit_docs: false and planning.search_gitignored: true in config
3. If previously tracked: git rm -r --cached .planning/

Workstreams (/thrunt:new-workspace) create isolated artifact trees under .planning/workstreams/{name}/ for parallel hunts in the same project.

Bootstrap fills confirmed fields immediately. TBD only marks live environment or operator-supplied facts that are still unknown.