Security Monitor — Guardian

The Security Monitor is Mode 3 of HelixMind. It is an autonomous security system that watches your codebase for vulnerabilities, suspicious changes, and potential threats. in real-time. While you write code, the Guardian runs silently in the background, scanning every file change, every new dependency, every configuration update.

Choose from three protection levels: Passive (observe only), Defensive (auto-respond to known threats), or Active (full autonomous protection with an approval queue). Each level gives you a different balance between convenience and control.

Available in both the CLI terminal and the Web App dashboard. Same engine, same detection, two interfaces.

Where does it run?

Interface	How to start	What you get
CLI Terminal	/security for one-time audits, /monitor for continuous monitoring	Runs as a background session. you keep coding while it watches. Findings appear in the session output and the Brain's findings panel.
Web App	Monitor tab in the dashboard	Real-time threat timeline, defense actions with undo, approval queue for Active mode. Visual severity indicators and historical trend charts.

Both interfaces report findings to the 3D Brain visualization. Security nodes light up in the helix as threats are discovered, giving you an instant visual map of your project's security posture.

Three Protection Modes

Passive Mode

Observes and reports. Takes no action. This is the default.

Perfect for: Getting a security overview, understanding your threat landscape before committing to automated defenses.

What it does:

• Scans source files for secrets, injection patterns, and insecure code
• Checks dependencies against known vulnerability databases
• Monitors file changes and flags suspicious modifications
• Logs every finding with severity, location, and recommended fix

What it does not do: Modify files, block connections, kill processes, or change any configuration. Passive mode is read-only.

Defensive Mode

Detects threats and auto-responds with pre-approved actions. No confirmation dialogs, no waiting. the Guardian handles known threats the moment it finds them.

Perfect for: Hands-off protection during active development. You define the rules, the Guardian enforces them.

What it does automatically:

• Alerts on known CVEs in your dependency tree
• Flags hardcoded secrets and API keys with exact file locations
• Reports insecure code patterns (SQL injection, XSS, command injection)
• Executes pre-configured defense actions from your allowedDefenses list

Requires: Pre-configured allowed defenses in your .helixmind/config.json. The Guardian will only execute actions you have explicitly approved in advance.

Active Mode

Full autonomous protection with human-in-the-loop. The most powerful mode. the Guardian detects threats and proposes defensive actions, but every action goes through an approval queue before execution.

Perfect for: Production environments, high-security projects, teams that need an audit trail for every security decision.

How it works:

• Threat detected. Guardian creates an approval request with full context
• You review the request in the Web App dashboard or the CLI
• Approve or deny each action individually
• Approved actions execute immediately, denied actions are logged with your reasoning

What Active mode can do (with your approval):

• Block suspicious IPs via firewall rules
• Kill malicious or suspicious processes
• Close unexpectedly open network ports
• Rotate exposed secrets and API keys
• Isolate compromised services from the network
• Deploy honeypot decoys to track attacker behavior

What it detects

Category	Examples
Secrets Exposure	API keys, tokens, passwords hardcoded in source files
Injection Risks	SQL injection, command injection, XSS patterns in your code
Dependency Vulnerabilities	Known CVEs in npm, pip, gem, and other package managers
Path Traversal	Directory traversal attempts, symlink attacks
Auth Weaknesses	Missing session management, weak password handling, insecure token storage
Config Drift	Unauthorized or unexpected changes to configuration files
Privilege Escalation	Unexpected permission changes, SUID bit modifications
Supply Chain Risks	Suspicious new dependencies, typosquatting packages, compromised maintainers
Info Disclosure	Stack traces in production, debug info exposed, verbose error details
Race Conditions	TOCTOU bugs, concurrent access issues, unsafe file operations

The detection engine combines static analysis (pattern matching across your source code) with dynamic checks (process monitoring, port scanning, dependency resolution). Every finding includes a severity level, the exact file and line number, and a concrete recommendation for how to fix it.

Defense Actions

When threats are detected, the Guardian can take action. In Passive mode, it only reports. In Defensive mode, it executes pre-approved actions. In Active mode, it creates approval requests.

Action	What it does
Block IP	Blocks a suspicious IP address via firewall rules. Reversible.
Kill Process	Terminates a malicious or suspicious process immediately.
Close Port	Closes an unexpectedly open network port.
Rotate Secret	Automatically rotates an exposed secret or API key, updating references.
Isolate Service	Network-isolates a compromised service to prevent lateral movement.
Deploy Honeypot	Creates a decoy service to observe and track attacker behavior.

Every action is logged, reversible, and visible in the Brain. The Guardian keeps a full audit trail. who approved what, when it executed, and what the state was before and after.

Using the Monitor in the CLI

One-time Security Audit

Run /security for an immediate, thorough scan of your codebase. No background process, no continuous monitoring. just a snapshot of your current security posture.

/security                    # Full codebase audit
/security ports              # Check open ports
/security processes          # Check running processes
/security configs            # Check config file changes
/security packages           # Check for vulnerable dependencies

Findings are ranked by severity and handled accordingly:

Severity	What happens
CRITICAL	Flagged for immediate attention with detailed remediation steps
HIGH	Highlighted prominently with fix recommendations
MEDIUM	Reported for manual review at your convenience
LOW	Informational. logged for awareness

All findings appear in the Brain's findings panel (the left sidebar in the 3D visualization). They persist across sessions, so you can track your security posture over time.

Continuous Monitoring

Start the Guardian as a background process that scans at regular intervals:

/monitor                     # Passive mode, 5 minute interval
/monitor active 60           # Active mode, rescan every 60 seconds
/monitor defensive 180       # Defensive mode, 3 minute interval

The monitor runs as a background session. Your interactive prompt stays available. you keep coding, chatting, or running other commands while the Guardian watches.

Use /sessions to see the monitor's status. Use /stop to end monitoring. Press ESC ESC (double Escape) for an emergency stop that halts the monitor and all other background sessions immediately.

Using the Monitor in the Web App

The Web App gives you a visual command center for the Security Monitor:

• Threat Timeline: A chronological view of every detected threat, color-coded by severity. Scroll back through history to spot patterns.
• Mode Switcher: Toggle between Passive, Defensive, and Active mode with a single click. No CLI commands needed.
• Approval Queue (Active mode). Each pending defense action shows full context: what was detected, what the Guardian wants to do, and why. Approve or deny with one click.
• Active Defenses: See every defense action currently in effect. Each one has an undo button to reverse it instantly.
• System Baseline: View the baseline snapshot and see exactly what has drifted since the last clean scan.
• Trend Charts: Track finding counts over time by severity. See whether your security posture is improving or degrading.

The Web App connects to your running CLI instance. You can start the monitor from the CLI and manage everything from the browser. or start it directly from the dashboard.

Configuration

Configure the Security Monitor in .helixmind/config.json:

{
  "monitor": {
    "enabled": true,
    "defaultMode": "passive",
    "scanInterval": 300,
    "maxThreatHistory": 1000,
    "autoApproveLow": false,
    "allowedDefenses": ["block_ip", "kill_process", "close_port"]
  }
}

Key	Description	Default
enabled	Whether the monitor is available	true
defaultMode	Starting mode when you run /monitor	"passive"
scanInterval	Seconds between scans	300 (5 minutes)
maxThreatHistory	Maximum threat entries to keep in history	1000
autoApproveLow	Auto-approve defense actions for LOW severity threats	false
allowedDefenses	Which defense actions Defensive mode can execute	[]

You can also set individual keys from the CLI:

helixmind config set monitor.defaultMode defensive
helixmind config set monitor.scanInterval 120

Brain Integration

Everything the Security Monitor does is reflected in the 3D Brain visualization:

• Security findings appear as colored nodes in the helix. red for critical, orange for high, yellow for medium, blue for low
• Active defenses show as animated connections between nodes, pulsing while the defense is in effect
• Threat patterns emerge visually. clusters of red nodes in the same area of the helix point to systemic issues
• Historical threats are preserved in spiral memory, allowing the Guardian to learn from past incidents and detect recurring patterns

Open the Brain (/brain in the CLI, or the Brain tab in the Web App) while the monitor is running to watch your security landscape in real-time.

Requires Login (Free+)

The Security Monitor requires a free HelixMind account. Run helixmind login in the CLI to unlock it. free forever, no credit card needed.