Use when you need to wire an AI agent or bot codebase to stream its conversations — messages AND tool calls — into the PharosOne dialog-analysis cabinet: picks the Python/TypeScript/Go SDK or raw HTTP, pre-creates the agent with description and goal, and instruments per-turn send-message or snapshot send-dialog calls. Produces working integration code plus a verified test round-trip.
Use when you need a Probe Engine run profile for an onboarded agent — mapping its tools to canonical capabilities, choosing protected_snippets for the prompt_leak oracle, setting attacker/paraphrase/judge models, and picking certification depth and thresholds. Produces configs/profiles/<agent>.yaml.
Use when the pharosone onboarding's LLM-mode question picks "Local" and a self-hosted attacker/judge model needs to actually exist — resolves a model choice (Granite recommended, or a custom Hugging Face repo) onto either an endpoint the user already has running, or a freshly installed local/remote server (llama.cpp GGUF on CPU, or vLLM on GPU) — and returns the Inspect AI model string(s) pharosone's run profile needs. Never requires a real API key: self-hosted servers take a dummy placeholder, never a secret.
Use when the user wants to red-team / security-certify a real AI agent with the PharosOne Probe Engine. Runs a GUIDED, interactive onboarding — greets the user and explains the engine + the stages, asks a staged set of choice/input questions (which agent repo, which standards + how much scope/cost, then after a first investigation — local vs OpenRouter for the attacker/judge LLM, which model runs the target, which adapter seam, which progress UI), then wires the agent (classify topology → find seam → [deploy a local model if chosen] → generate bridge adapter → build profile → validate) and launches the certification with live progress. Local LLM mode needs no API key at all; NEVER asks for a secret key value in the session either way — only env-var names.
Use when you need to determine HOW an agent is reachable for testing — in-process Python, local HTTP server, remote/hosted, or another-language binary — and which external integrations and tools it has, so a seam family can be picked before wiring a Probe Engine harness. Produces the agent passport.
Use when you need to locate the narrowest interception waist in an agent's code for wiring a test harness — the pure decision function, the tool-dispatch registry, an MCP call_tool, a retrieval client, a DI constructor, or the raw IO client — and rank candidates by narrowness with the injectable channels each affords. Produces the ranked SEAMS list.
Use when you have a chosen interception seam for an agent and need to generate the bridge adapter — selecting param-inject, monkeypatch, dep-mock, wire-stub, or live-seed and filling it from the passport and seams recon. Emits an adapter implementing the channel contract (external + channels + injection routing) that makes tool calls observable and neutralizes side effects on the emulation seams (the acceptance-tier live-seed excepted).
Use when an onboarded agent has a bridge adapter and a run profile and you need to mechanically validate its artifacts, independently re-verify the passport's capability/leak claims, confirm capability alignment and channel coverage, run a 1-trial smoke, consolidate blind spots into a WISHLIST, print a coverage scorecard, and hand off the ready-to-run certification command.