The Ninja Intelligence Context Mesh is in dev 6 platforms.

The Ninja Intelligence Context Mesh is in dev

6 platforms. 1 graph. Zero silos.

I've built something that doesn't exist anywhere else: a federated intelligence mesh where threat intel, SIEM detections, OSINT investigations, identity exposure, and financial intelligence all live in a single graph database — queryable in one traversal.                                            

Here's what that looks like:

A Raz0r EDR agent detects anomalous memory injection. That detection links to an IOC in Signal's threat intelligence graph. The IOC maps to a threat actor with known TTPs. Nexus reveals that actor's OSINT footprint — shell companies, sanctions connections, infrastructure overlap. 1D exposes which identities have attack paths to the compromised asset. Kin0bi flags correlated financial anomalies in the same window.

One graph query. Six intelligence domains. Seconds.

This isn't an integration layer bolted on top. The mesh is the architecture:

- Ninja Signal — Threat intelligence. 95+ ingesters, risk propagation, adversary digital twins.
- Ninja Fusion — Security fusion center. Cross-network enrichment, collaborative analysis.
- Ninja Raz0r — Detection & response. Rust EDR agents, ransomware kill-chain prediction, auto-generated detection rules from threat intel.
- Ninja Nexus — OSINT intelligence. Sanctions screening, UBO resolution, money flow tracing. Fed by OpenSanctions, OFAC, ICIJ, Companies House, SEC EDGAR.
- Ninja 1D — Identity intelligence. Attack path analysis, Kerberoasting detection, shadow admin discovery.
- Ninja Kin0bi — Financial intelligence. Real-time market data, anomaly detection, cross-asset correlation.

All six share a Neo4j knowledge graph (for all you graph engineers out there who think you have invented AI context orientation and acceleration; suck on this...you don't even do the ML 🤣 ) with 160,000+ entities. Graph-native ML — GCN/GAT embeddings, Hawkes process forecasting, Monte Carlo campaign simulation — operates across the full mesh. WebSocket streams propagate events in real time.

The infrastructure is deliberately simple: FastAPI, Next.js, Caddy, Docker Compose. No Kubernetes. No message bus. The graph is the mesh.

Every platform makes every other platform smarter. A new threat actor in Signal immediately enriches Raz0r's detection rules, Nexus's entity graph, and 1D's risk scores. A SIEM detection creates edges that Fusion's ML picks up in its next cycle.

Built solo. Full stack — Rust memory sensors to React force-directed graphs.

The silos are the vulnerability. The mesh is the fix.

Now of course a way to go, but signal is now enterprise grade, so scottg is still #ontrack2026

ship it baby

scottg/out

https://ninjasignal.ninja | https://ninjafusion.ninja | https://ninjaraz0r.ninja | https://ninjanexus.ninja