Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Turn a signal into testable hunt hypotheses, scope, datasets, and success criteria
Generate a comprehensive project summary from milestone artifacts for team onboarding and review
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Execute a hunt phase with parallel telemetry work, query logging, receipt generation, and optional wave targeting
Post-mortem investigation for failed THRUNT workflows — analyzes git history, artifacts, and state to diagnose what went wrong
Validate hunt conclusions against receipts, contradictory evidence, and success criteria
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Generate tests for a completed phase based on Evidence Review criteria and implementation
Create a clean PR branch by filtering out .planning/ commits — ready for code review
Execute a quick task with THRUNT guarantees (atomic commits, state tracking) but skip optional agents
Capture a forward-looking idea with trigger conditions — surfaces automatically at the right milestone
Archive completed milestone and prepare for next version
Generate developer behavioral profile and create Claude-discoverable artifacts
Insert urgent work as decimal phase (e.g., 72.1) between existing phases
Systematic debugging with persistent state across context resets
Audit milestone completion against original intent before archiving
Generate UI design contract (UI-SPEC.md) for frontend phases
Surface the agent's assumptions about a phase approach before planning
Remove a THRUNT workspace and clean up worktrees
Capture idea or task as todo from current conversation context
Manage parallel workstreams — list, create, switch, status, progress, complete, and resume
Retroactive 6-pillar visual audit of implemented frontend code
Add phase to end of current milestone in huntmap
Retroactively audit and fill Nyquist validation gaps for a completed phase
Request cross-AI peer review of phase plans from external AI CLIs
Remove a future phase from huntmap and renumber subsequent phases
Route freeform text to the right hunt or THRUNT command automatically
Zero-friction idea capture. Append, list, or promote notes to todos.
Resume project or hunt work from the previous session with full context restoration
Add an idea to the backlog parking lot (999.x numbering)
Create an isolated workspace with repo copies and independent .planning/
Manage persistent context threads for cross-session work
Run all remaining phases autonomously — discuss→plan→execute per phase
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Interactive command center for managing multiple project or hunt phases from one terminal
Automatically advance to the next logical step in the active hunt or THRUNT workflow
Execute a trivial task inline — no subagents, no planning overhead
List pending todos and select one to work on
Cross-phase audit of all outstanding Evidence Review and findings validation items
Generate a session report with token usage estimates, work summary, and outcomes
Display project statistics — phases, plans, requirements, git metrics, and timeline
Diagnose planning directory health and optionally repair issues
Configure THRUNT workflow toggles and model profile
Create phases to close all gaps identified by milestone audit
Reapply local modifications after a THRUNT update
Review and promote backlog items to active milestone
Show available THRUNT commands and usage guide
Update THRUNT to latest version with changelog display
Check project or hunt progress, show context, and route to the next action
Create context handoff when pausing work mid-phase
Switch model profile for THRUNT agents (quality/balanced/budget/inherit)
Archive accumulated phase directories from completed milestones
Show available THRUNT threat hunting commands and artifact layout
Find the current THRUNT community channels
List active THRUNT workspaces and their status