> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Architecture

> How the Myrmex software agent works: an AI-agent-driven collect → enrich → respond model where the software agent gathers host telemetry and the AI agents decide and act — not a standalone antivirus.

The Myrmex **software agent** — the program installed on a host — is built around a simple model: **collect → enrich → respond**. It gathers rich telemetry from the operating system, enriches and normalizes it, and streams it to the platform, where the [AI agents](/documentation/multi-agent-system/overview) decide what it means and what to do about it.

<Note>
  This page is about the **software agent** installed on a host. The **AI
  agents** (Perseus, Centurion, and the rest) are what interpret its telemetry
  and drive its response actions. It is not a standalone antivirus — the
  intelligence lives in the platform and its AI agents, not in a local signature
  engine.
</Note>

## Collect

The software agent observes the host across kernel and user space to build a complete picture of what's happening:

<CardGroup cols={2}>
  <Card title="Kernel-level activity" icon="microchip">
    System calls and low-level interactions — file access, filesystem changes,
    permission changes — and network activity.
  </Card>

  <Card title="Processes" icon="diagram-project">
    Process and thread creation, termination, and hierarchy, and the commands
    behind them.
  </Card>

  <Card title="Files & network" icon="folder-tree">
    File and filesystem operations, network connections, and heavy DNS
    resolution.
  </Card>

  <Card title="System events & inventory" icon="clipboard-list">
    Windows Event Log (via ETW) and registry on Windows, audit and syslog on
    Linux, plus hardware and software inventory.
  </Card>
</CardGroup>

For the full breakdown of what the agent collects on each platform, see [Agent capabilities](/documentation/agent-endpoint-security/features).

## Enrich

Before telemetry leaves the host, the agent normalizes and enriches it so it's ready for analysis:

* **Normalization** — events are mapped to the Myrmex event model, so data from Windows, Linux, and macOS is consistent.
* **Context** — events are annotated with detail like source IP and the relationships between processes.
* **Classification** — events are tagged so the platform and its AI agents can prioritize what matters.

## Respond

The software agent doesn't decide on its own what to do — it carries out **response actions** on the host when the AI agents direct it. [Perseus](/documentation/multi-agent-system/agent-endpoint-specialist), coordinated by [Centurion](/documentation/multi-agent-system/agent-orchestrator), operates the agent to isolate a host, quarantine a file, kill a process, or run a remediation — always following the **AI proposes, you approve** pattern.

<Note>
  The agent also runs on-demand **host-hardening audits** that feed
  [Security Posture](/documentation/security-posture/overview), and applies
  approved OS updates through [patch
  management](/documentation/agent-endpoint-security/patch-management).
</Note>

## Secure by Design

Everything the agent sends travels over a persistent, outbound-only encrypted connection. Data is protected with AES-256-GCM inside a TLS transport, and each device authenticates itself cryptographically. See [Agent communication & security](/documentation/agent-endpoint-security/communication) for the enrollment and transport details.

## On-Host Files & Layout

Everything the agent keeps on disk lives under a few well-known locations. The paths below are for **Linux**; Windows and macOS store the equivalents in their platform-standard locations.

<Note>
  Two long-running services back the agent: **`myrmex-endpoint`** (the agent itself — collect / enrich / respond) and **`myrmex-supervisor`**, which keeps it running and applies the silent [auto-updates](/documentation/agent-endpoint-security/installation).
</Note>

**Configuration — `/etc/myrmex/`**

* **`config.yml`** — the active configuration and the file that **binds the host to a context**. It holds the `context_id`, the `agent_id`, a derived `secret` (`<context_id>_<agent_id>`), and the platform endpoints it talks to: `host` / `http_host` / `wss_host` (the fleet channel) and `check_host` / `download_host` (updates). Root-only (`0600`).
* **`env.conf`** — environment variables the service reads (`ENVIRONMENT`, `HOST`, `CONTEXT`, `AGENT`, and the `*_HOST` URLs). Root-only.
* **`private_key.pem` / `public_key.pem`** — the agent's **RSA-4096 key pair**, generated locally at enrollment. The private key never leaves the host (`0600`) and proves the agent's identity; the public key is registered with the platform. These are the "certificates" created during registration — see [Agent communication & security](/documentation/agent-endpoint-security/communication) for the full handshake.

**Logs — `/var/log/myrmex/`**

* **`mrx_rCURRENT.log`** — the current agent log (rotated to `mrx_r000NN.log`).
* **`mrx_sup_rCURRENT.log`** — the supervisor log (rotated to `mrx_sup_r000NN.log`).
* Sub-folders such as `audit/` (host-hardening audit reports) and per-device backup folders produced by response / ops actions.

**State — `/var/lib/myrmex/`**

* **`version_info.json`** — installed endpoint and supervisor versions, and the last update time.
* **`quarantine/`** — files placed in quarantine.
* **`patch/`** — patch-management working data.
* **`endpoint_backups/`** — previous binaries the supervisor can roll back to.

**What registration writes.** On install the agent generates the RSA key pair, registers with your installation token against the chosen context, receives its `agent_id`, and writes `config.yml` + `env.conf` binding it to that context. The full cryptographic exchange — token, key registration, signature challenge, AES session key, and rekeying — is covered in [Agent communication & security](/documentation/agent-endpoint-security/communication).

## Where to Go Next

<CardGroup cols={2}>
  <Card title="Agent capabilities" icon="list-check" href="/documentation/agent-endpoint-security/features">
    The telemetry and response actions in detail.
  </Card>

  <Card title="Agent communication" icon="lock" href="/documentation/agent-endpoint-security/communication">
    Enrollment, cryptography, and transport.
  </Card>

  <Card title="Perseus" icon="terminal" href="/documentation/multi-agent-system/agent-endpoint-specialist">
    The AI agent that drives host response.
  </Card>

  <Card title="Collector mode" icon="tower-broadcast" href="/documentation/agent-endpoint-security/collector-mode">
    Run the same agent as a bridge to other systems.
  </Card>
</CardGroup>

<Tip>
  Curious what a specific host is reporting? Open it in [Device
  details](/documentation/agent-endpoint-security/device-details) or
  `@`-mention it in chat.
</Tip>