One canopy. A coordinated set of tools.

Sloth

Local-first intelligence for sensitive environments.

Sloth operates inside the customer's trust boundary — where data sensitivity, latency, or regulatory constraints make cloud-only analysis insufficient. It performs local reasoning during incidents and sustained operations, without forcing sensitive context to leave the environment.

• Local-first posture
• Operates under air-gap conditions
• Low-latency crisis support
• Reports into CANOPY on its own terms

Mycelium Net

Distributed observation across environments.

Mycelium Net extends discovery and signal correlation across assets, environments, and perimeters. It maintains a coherent view across fragmented infrastructure — cloud, edge, hybrid — and feeds that view into the reasoning layer continuously.

• Distributed asset observation
• Cross-environment signal routing
• Resilient to partial connectivity
• Continuous rather than episodic

Predator

Jungle-labs' native offensive-security language.

Predator is a purpose-built language for offensive security operations — implemented in Rust with LLVM JIT compilation, native offensive primitives, and integrated AI reasoning. It gives operators a coherent substrate for expressing, compiling, and executing offensive logic under the same reasoning layer as the rest of the platform.

• Rust-based with LLVM JIT compilation
• Native offensive primitives
• Integrated AI reasoning
• Reports into CANOPY

Macaw

Small AI models on the endpoint, securing AI use itself.

Macaw deploys compact AI models directly onto endpoints, running in parallel to the existing EDR rather than replacing it. Where the EDR watches processes and files, Macaw watches AI behaviour — prompts, copilots, agentic tooling, model calls, and the data moving through them — reasoning locally on the device and reporting into CANOPY.

• Runs on-endpoint, alongside the EDR
• Secures prompts, copilots, and AI agents
• Detects data exposure via AI tooling
• Local inference, reports into CANOPY