ethrxdocs
DRAGON/v1.3.0/OVERVIEW

DRAGON overview

DRAGON is an AI-augmented terminal for network and infrastructure engineers. It speaks SSH and serial console, and it places an intelligence layer directly in the session path: structured capture of device I/O, locally-hosted AI analysis, staged command suggestions, and retrieval-grounded troubleshooting. The name is a backronym — diagnostic retrieval-augmented generation for operational networks.

DRAGON is built for environments where session data cannot leave the room. Inference, embeddings, the vector store, and licensing all function with zero internet access. The product is deployable in SCIFs, on the tactical edge, and across OT and ICS networks.

DRAGON v1.3.0 grows Collection Runs up: author your own read-only command sets — by hand or drafted by the copilot from a plain-English prompt — in a redesigned workspace with a guided builder and live test-runs, and a device's collection history now informs the copilot automatically, with drift between runs surfaced as an insight, no model call required. DRAGON is a licensed product: a 14-day trial starts on first launch, and a purchased license activates entirely on-device — no account, no phone-home. See licensing and distribution.

What DRAGON does

DRAGON owns every transport. Keystrokes and device output flow through a session broker that tees the byte stream: one copy renders to the terminal synchronously and losslessly, the other feeds a structured capture engine. The render path is never blocked by capture, redaction, or inference — the terminal feels native even with AI disabled.

The capture engine segments raw terminal output into structured (prompt, command, output) records using device-aware profiles. Those records are the data substrate that makes local AI analysis useful. An inference orchestrator consumes them to surface anomalies, answer questions, and stage next-command suggestions.

Suggested commands are never auto-executed. Acceptance places a command in the input line for the operator to send. No setting overrides this. The one narrow exception is Collection Runs, where the core auto-sends only commands a rules-only classification guard proves read-only, through a single audited choke point — anything that could change state is skipped, never transmitted.

Who it is for

DRAGON targets three operator profiles:

  • Network engineers and NOC operators working Cisco, Juniper, and Arista CLI daily, on serial console regularly, against vendor PDFs and tribal-knowledge runbooks.
  • Federal and defense field engineers in disconnected environments with classification constraints and accountability requirements.
  • Sysadmins and SREs doing SSH-heavy Linux work and incident response who want log and stack-trace explanation inline.

Core capabilities

  • SSH and serial console transports through a single session broker — password, public-key, ssh-agent, and keyboard-interactive authentication, native ~/.ssh/config alias resolution, TOFU host-key verification, per-session raw logging, and automatic reconnect with backoff and an audit trail when a link drops.
  • A managed session workspace: a drag-and-drop saved-session tree, SecureCRT-style session and folder properties, quick fuzzy session search, one-click import from PuTTY, SecureCRT, and ~/.ssh/config, and the Vault — reusable credentials assigned to sessions or inherited from folders.
  • Terminal grid layouts — side-by-side, stacked, or 2×2 tiles, each with its own PTY size and scrollback — and a full light mode toggled from the tab bar.
  • Collection Runs — read-only status snapshots of a device, captured by a read-only-gated executor, summarized by the copilot, diffable run-over-run, and exportable — with user-authored command sets, a guided AI-assisted builder, automatic drift insights, and collection history grounding the copilot's answers.
  • Structured capture with declarative device profiles for cisco-ios, cisco-nxos, cisco-asa, cisco-ftd, cisco-ise, juniper-junos, linux-generic, and a generic-fallback — including exact configuration sub-mode tracking on IOS.
  • Editable agent skills: per-device Markdown platform knowledge injected into the copilot's context, with Cisco seed content built in.
  • Two-stage secret redaction — at RAG ingestion and again at context assembly — before any text reaches a model.
  • Hybrid RAG over user-pointed document corpora, device configs, and auto-ingested session history — with folder-scoped knowledge that keeps retrieval scoped to the device group you are working in.
  • Inference anywhere: an embedded llama.cpp runtime, any OpenAI-compatible endpoint, or Anthropic's Claude natively — several providers configured at once, quick-switched live.
  • A copilot you can reach without leaving the terminal — inline ask, attach-a-selection, ordered multi-step command sequences staged one reviewed step at a time, an optional bounded auto-analyze mode, and ambient anomaly-triggered analysis.
  • An append-only, hash-chained audit log with an in-app transparency pane showing the verbatim post-redaction prompt behind every model call, file-access and network-egress evidence records, and one-click export to JSONL or CSV.
  • On-device licensing: a 14-day anti-abuse-hardened trial from first launch and offline Ed25519 license activation.
  • A guided first-run tour, and an in-app factory reset that wipes all DRAGON state on every platform.

How DRAGON is delivered

DRAGON ships as a desktop application. A thin Tauri v2 shell opens a window, loads the frontend in the OS-native webview, and supervises a Go daemon (dragond) as a bundled sidecar. The frontend and daemon communicate over a single loopback WebSocket on ws://127.0.0.1:7717/ws, authenticated per launch by a shell-generated connection token. The daemon is a single static binary with device profiles and prompt templates embedded, so it runs self-contained from any working directory.

Installers are produced for Windows, macOS (arm64 and x86_64), and Linux. Connected installs check for updates on launch and upgrade in one click over a signed channel; air-gapped installs use the same signed installers moved by sneakernet. Every release carries SBOMs and a SHA256SUMS integrity manifest.

Where to go next

Next
Getting started