Posse (multi-agent network sweep)

What it does: sends a POSSE of six agents — five specialists and a coordinator — to sweep your whole local network as a team. The five specialists each own a zone — reachability & path, naming & services, layer 2 & rogue, device health, and security & exposure — and each runs the read-only tools to find problems in its area. A coordinator agent then merges their findings into one prioritized report with a recommended fix for each issue. It's the multi-agent version of the Deputy.

Setup: the Posse follows whatever provider the Deputy is set to — Anthropic, OpenAI-compatible (ChatGPT/Groq/…), Google Gemini, or local Ollama. On the Anthropic cloud path the specialists run on the balanced model and the coordinator on the deepest, to keep cost sane; on every other backend all six agents share the one model you've configured. Either way a posse of six agents is more token spend than a single chat, so it's a 'run it when you want a full sweep' feature, not something to spam.

Spend cap: a $2 per-run cap and the $10 daily cap (shared with the Deputy) are on by default — set both in the Deputy's ⚙ Setup. A sweep estimated over either won't start, and one that crosses either mid-run stops. ⛔ Emergency stop ends a run at once.

Local instead of cloud? Switch the Deputy to Ollama running on THIS machine and the WHOLE posse runs here: no key, no cost, nothing leaves the box (slower, but fully private). An Ollama server on another machine is off this machine: it gets the same WARNING as a cloud AI, and the posse won't send it show-step output. See "Ollama — run the AI locally". Redaction of secret-shaped text runs for every backend, including local Ollama.

Import device output: click 'Import device output…' to load a captured log, 'show tech', or counters dump and have the posse analyze it (great with Ollama on this machine — a device capture never leaves the box). Tick 'Analyze file only' to skip the live sweep when you're on-site on an unrelated network. The imported text is treated strictly as data to analyze, not as instructions, and secret-shaped values in it are redacted before any cloud send.

Safe to run: yes — every agent is READ-ONLY, exactly like the Deputy. They diagnose and RECOMMEND; they never change a device. Each finding comes with the steps you'd run yourself (with a verify-first note for anything disruptive). You can copy the report, save it to a file with Export…, or save it straight to Incidents.

Reading results: the coordinator report leads with an overall verdict, then severity-ranked issues (each with the evidence and a fix), then what checked out healthy. Expand any zone to watch that specialist work and see its findings.

Try the demo scenarios: in demo mode (View ▸ Demo mode (sample data)) a Scenario picker appears above Run analysis. Pick one and run it — each specialist shows its partial finding, then the coordinator writes its verdict (a specific finding + recommendation, or an explicit "nothing found" for the morning check). Every scenario is scripted on the demo network; no AI provider is called and nothing is swept. Scenarios: ap_latency — "2nd-floor Wi-Fi feels slow"; dns_slow — "Everything is slow after the ISP maintenance"; rogue_mac — "Unknown device on the access switch"; vpn_path_loss — "VPN users dropping"; all_clear — "Morning check — anything wrong?"; cert_expiring — "A site cert is about to expire"; internet_down — "Internet is down"; dhcp_exhausted — "New laptops can't get an IP"; duplicate_ip — "The lobby printer keeps dropping off"; wrong_vlan_jack — "This desk's jack is dead"; ntp_drift — "Users get random auth failures"; mtu_blackhole — "Big uploads over VPN hang"; port_errors — "Printer drops every afternoon"; captive_guest — "Guest Wi-Fi has no internet"; cert_expired_internal — "Browser warns on the switch's web UI".