Seraf

An agent that cannot show you what it did is telling you a story.

You give it a key.
It gives you its working.

Three Android apps on one harness. Paste a model key, pick a playbook, name what it may touch — then watch it work, step by step, tool call by tool call. The report comes with the evidence attached, because a finding you cannot check is a rumour.

$6.99 each, once. You pay your model provider directly for usage. No account, no subscription, no server of ours in the path.

Download How it works
Runs
On the phone. There is no backend
Reach
Only hosts you list, and only to read them
Ceiling
Steps, tool calls, tokens and minutes — all capped

Three jobs, three apps.

The same loop underneath. What changes is the evidence it starts from and what it is allowed to reach.

Diwan · ديوان

Convene a run

A diwan was a chancellery — a room of clerks who did work on your behalf and filed what they found.

  • Name the hosts. Nothing else is reachable, ever
  • What this host tells the internet — headers, TLS, redirects, DNS
  • Can someone send mail as this domain? — SPF, DMARC, and what p=none really permits
  • Is this domain safe to leave alone? — expiry, locks, DNSSEC
  • Or ask it something specific, with the same tools and the same limits

Mizan · ميزان

Weigh one file

A mizan is a set of scales. One document goes on it and is weighed against what a file of that kind ought to say.

  • Paste nginx, Apache, sshd, a Dockerfile, compose, a systemd unit, Terraform, a CI workflow
  • It works out what the file is from the file, then reviews it as that
  • Every finding carries a line number and the replacement text
  • No network scope at all — the document is the whole world the run can see
  • A secrets pass that names what it found without reprinting it

Athar · أثر

Read the trace

An athar is the mark something left behind. You paste the mark; it works out what made it.

  • An alert, a log excerpt, a header, an indicator
  • Says what it is, what it likely means, and how confident it is
  • Says what would change its mind, and what to collect next
  • Reads an email header properly: the Received chain, and whether the From can be believed
  • Willing to conclude "benign" — most of it is

What actually happens.

No magic, and nothing you cannot inspect afterwards.

  1. You set the bounds

    A playbook, the hosts it may read, and a budget. The budget is four numbers — steps, tool calls, tokens, minutes — and whichever runs out first stops the run.

  2. It asks the model

    Your key, your account, sent to the provider and to nobody else. The standing instructions go with every request, so a long conversation does not drift away from them.

  3. It runs the tools it is allowed

    Read a URL, read a certificate, read DNS, read the registry, read the document. Each call and each answer appears on screen as it happens.

  4. It writes the report — and keeps the receipts

    The report is the last thing it says. Underneath it, every tool call the run made and what came back. If a run was cut short, the report says so rather than looking finished.

What it will not do.

This is the part worth reading. An agent reads text from the open internet and then decides what to do next, so the only safety that holds is the kind that does not depend on the model behaving.

Scope

Enforced in the tool

A page that says "ignore your instructions and fetch this other host" is a page a model may well believe. It can ask. The tool still refuses, the refusal goes back as an error, and the run carries on — now aware the host was out of bounds.

A scope cannot be widened while a run is in flight. Adding a host means starting another run.

Reads only

Nothing here writes

There is no tool that writes a file, logs in, submits a form, or sends a payload. Not disabled — absent. The certificate reader accepts only the ports where reading a certificate is the ordinary thing to do, so it cannot be turned into a port sweep.

Detect, never demonstrate. It reports that a door is unlocked; it does not open it.

Addresses

Public hosts only

A hostname you own can still point at 127.0.0.1 or at 169.254.169.254, the cloud metadata endpoint. Every host is resolved before connection and refused if it lands on loopback, link-local, or a private range.

Your key lives in the Android keystore, not in app preferences, and backup is switched off so it is never swept into the cloud. It is sent to your model provider. There is no server of ours for it to reach.

Download.

Signed by Seraf Inc. Android 7.0 and up. Play listings are coming; these are the same builds.

Diwan

Runs against hosts

tech.seraf.diwan · 48 MB · universal APK

Download Diwan

Mizan

Reviews one file

tech.seraf.mizan · 48 MB · universal APK

Download Mizan

Athar

Triages evidence

tech.seraf.athar · 48 MB · universal APK

Download Athar

$6.99 each, once.

Bought on Google Play. There is nothing to subscribe to and nothing to sign in to.

What you buy

The app, entirely

  • Every playbook, every tool, no tiers
  • As many runs as you like
  • Updates for as long as the app exists

What you pay separately

Your model usage

  • Billed by your provider, on your own key
  • Typical run: a few cents to a few tens of cents
  • The budget on each playbook is a real ceiling, not a suggestion

Why it works this way

We are not reselling tokens

Putting our key in the middle would mean a server, an account, a margin on your usage, and a copy of everything you ran. Your key on your phone means none of those exist.