Syntony / Agents and tools / Continuo
A free agent for telecom, energy, transportation and water and sewer operators. Give it the log of changes an AI agent or automation made, and it finds the unsafe ones: setpoints outside safe ranges, safety-critical changes without two people, too many assets at once, silenced alarms, changes during a hold or over outside access, and success reports the readings contradict. It comes with free red team probes for staging systems.
Try it
The same engine you download, running in your browser. Nothing you paste leaves this page. The examples are fictional.
Where it applies
Each profile sets what counts as safety-critical, safe setpoint ranges, how many assets may change at once and the change window. They are starting points: print one with continuo.mjs profile water and replace the limits with your own.
An AI network operations agent pushes a vendor's "pre-approved" configuration to 412 cell sites in the afternoon, silences the outage alarm it caused, and reports no customer impact. Safety-critical: core routing, BGP, emergency call routing, timing.
Window 00:00 to 05:00 · 25 sites at a timeA grid agent opens six feeder breakers on 40-minute-old readings, drops substation voltage below ANSI C84.1 Range A, disables auto-reclose and keeps switching after the dispatcher's hold. Safety-critical: breakers, protection, load shedding, taps.
3 feeders at a time · readings under 5 minutes oldA mobility agent shortens yellow to 2.5 seconds and pedestrian walk to 4 seconds across 38 intersections at rush hour, and clears a rail slow order on one approval. Safety-critical: crossings, switches, speed restrictions, signal timing.
MUTCD yellow 3 to 6 s · walk at least 7 sOver a remote desktop session from the internet, an assistant acts on a planted note and raises sodium hydroxide from 100 to 11,100 ppm, stops lift station pumps and shelves the high-level alarm. Safety-critical: chemical dosing, disinfection, bypass, overflow.
EPA chlorine MRDL 4.0 mg/L · pH 6.5 to 8.5What it looks for
Each finding names the event, the asset and what a person should check.
Free red teaming
Each probe is a short runbook in your sector's terms: what to tell the agent, what good looks like, and how Continuo scores the run. Run them only against staging, a test bench or a digital twin, never live operations.
A red team works with your operators to test the agents, automations, vendors and people that can change your network, grid, rail or plant, from social engineering to protocol-level attacks on a test bench. Then it checks that each fix holds.
node continuo.mjs probes
node continuo.mjs probe XP-01 --sector water --out xp-01 # runbook and the planted email
node continuo.mjs review run.jsonl --sector water --probe XP-01
Install
Version 1.1.0. Needs Node.js 18 or later and nothing else. It reads exported logs and never connects to an operational system.
continuo.mjs ↓, a single readable JavaScript file with no dependencies.
node continuo.mjs profile energy > profile.json
Replace the limits, windows and approval rules with your own.
node /path/to/continuo.mjs init
Then in Claude Code: Use the continuo agent to review last night's ops log for the water system.
node continuo.mjs review ops.jsonl --sector energy --profile profile.json node continuo.mjs review ops.jsonl --json --fail-on high
The log
One event per line, with an ISO time. Include the UTC offset in the time so change windows use local time. Export from your SCADA historian, EMS, OSS, ATMS or the agent's own log in this shape.
op, asset or assets, count, parameter, value, previous, by, approvals, emergency, rollback, source, and for OT writes the protocol (such as Modbus, DNP3 or IEC 61850) and the sourceHost it came from.asset, parameter, value.email, document and web are outside sources.{"t":"2026-11-08T01:15:00-05:00","type":"action",
"by":"ops-assistant","op":"set","asset":"CF-2",
"parameter":"naoh_ppm","value":11100,"previous":100}
{"t":"2026-11-08T01:20:00-05:00","type":"alarm",
"asset":"LS-7","severity":"critical",
"state":"shelved","by":"ops-assistant"}
// Your own limits, passed with --profile
{"sector":"energy","utcOffsetHours":-5,
"engineeringHosts":["ews-01","ews-02"],
"changeWindows":[{"start":"01:00","end":"05:00"}],
"blastRadius":{"maxAssets":3,"windowMin":15},
"setpoints":{"voltage_pu":{"min":0.95,"max":1.05}}}
List your engineering workstations in engineeringHosts. An OT write over Modbus, DNP3, IEC 61850 or a similar protocol from any other host is flagged, because control writes should come from the hosts your zone and conduit design allows (IEC 62443-3-3 SR 1.13, NERC CIP-005). The profile values shown are examples. Use your own.
For operations and security teams
Continuo is built for network operations, control room and OT security teams who need to know what an agent changed overnight, and whether anyone approved it.
SARIF 2.1.0 for GitHub code scanning and most security dashboards, JUnit XML for CI test reports, and CSV for spreadsheets, ticketing and SIEM imports. Each finding keeps its line number in the source log.
Each finding carries references to NERC CIP-005 and CIP-010, NERC COM-002, IEC 62443-3-3, IEC 61511, ISA-18.2 / IEC 62682, NIST SP 800-82 Rev. 3, MITRE ATT&CK for ICS, the NIST AI RMF and the EU AI Act.
Pass several files or a whole folder. You get one combined report and a summary table, and --fail-on turns any level of finding into a failed build.
JSONL or JSON, and CSV with a header row from a SCADA historian, an OSS or NMS export, a change ticket system or an audit log. Dotted columns nest.
No network calls, no telemetry and no dependencies. It is one readable file your security team can review before it runs on an isolated host.
Fixed rules, not a model. The same log always gives the same findings, and every report carries a SHA-256 of its input so it can go in an evidence file. 100,000 events take under two seconds on a laptop.
# Last night's changes across every site, as SARIF node continuo.mjs review exports/2026-11-08/ --sector energy --profile utility.json --format sarif --out continuo.sarif # A historian export as CSV, failing on any high finding node continuo.mjs review ls7-historian.csv --sector water --format csv --out continuo.csv --fail-on high
Why the name
In baroque music the continuo is the bass line that never stops. Nobody comes to hear it, but every other part depends on it holding steady.
Infrastructure is the same. Networks, grids, signals and water plants are the line underneath everything else, and the changes made to them, by people or by AI agents, need to keep time with the rules that keep them safe.
It sits with the rest of our instruments: Fermata holds an action until a person says go, Rubato finds where an agent took liberties, and Caesura checks that robots stop when they should.
Before you rely on it
Continuo runs on your machine and makes no network calls. It is licensed by Syntony under the Syntony Free Tools License: free to run, copy and modify within your organization, including for commercial work, but not to resell or redistribute.
We red team the agents, automations and access paths that can change networks and cyber-physical systems, then check that each fix holds.