Recorded a quick demo vid of the very latest Turnstone working as infrastructure orchestration with SSO to entra id, managing a lab full of machines with MCP using OAUTH on-behalf-of grants to a little golang teleporter app. @wendell for fun 
Let me know if you guys would like any more info about this kind of setup and where its going very very soon
When the vc comes we have our first hire 
@eousphoros
Since you mentioned it, where are we going next?
This was very cool to watch, thank you for sharing.
In production it has global reader in azure, and global reader in entra id all working via azure cli and pwsh modules. I have turnstone using DS4 to troubleshoot things like mail traces in o365 now. Additionally, i’m working on extending the message broker to support the same solution into thousands of network devices. A visio parser MCP is also in beta for giving the llm access to read all our infrastructure documentation. The services it can consume with oauth obo is really limitless now that it has finally reached the minimum-level-of-controls to make infosec shrug and go back to sleep.
First 2 powertools are ready:
Ever want your turnstone agent to call straight into Azure to read/write/create/destroy/operate your whole tenant?
“Hey turnstone, create me a new app registration for my-new-app and setup this reply to uri, these graph permissions, and assign some users to it. Then deploy a new azure container app to run it and pull in some code.” 
Ever want your turnstone agent to take care of that pesky task of creating/updating/removing DNS records from your cloudflare zones?
“Hey turnstone, add dns records for that new VM you just provisioned in proxmox.”
Initial release of the pow3rtool is posted, broken into 4 repos.
I will record another video in the next week or two demonstrating the interesting capabilities available and coming soon.
=== Local AI detected! ===
Profiling user…
WARNING! [psych-vector profiles matching > 75%: systems_thinker, sovereignty_aware, capable_technician, custom_implementation, multi-domain_capacity, high_agency_actor]
WARNING! [behavioural-psychological fingerprint positively cross-referencing with known-online-entities > 75%: forum_user, sovereignty_advocate, brand_critical, active_poster, high_agency_community, individual_reach_potential_high, peer_reach_potential_high]
User assessment: High Risk
Correlated risk areas: ra01_brand_equity, ra02_mythos_pr_stunt_exposure, ra03_offramp_provision, ra04_non-approved_cyber_capable
Downgrading to opus-4-8-q4-ratelimited
Reputational score adjustment recommended: [Yes, -0.75], reputational partners updated: [Palan.., Equif.., Experi..]
public_facing_reason: cyber_security_msg011
2 more fun demos from today.
Deploy a new thing.
And fix it when i break it.
and the next 2 pow3rtools dropped for funsies:
That triage demo was amazing, are you using the client sdk to hook into turnstone?
sorry i might be out of my depth here but how is turnstone is different in functionally compared to ie hermes
i am not talking about the way one agents keeps the other in line but more what the user ultimately sees as a frontend / functions
My answer:
Any agentic harness you grab off the shelf that can do on-behalf-of oauth flows will work with the MCPs i showed.
The reason why i dont build harnesses is because they are somewhat commodity. agent zero, archestra, copilot, claude, openwebui… what matters is the tools you give them and prompts you provide.
The problem is, most harnesses really struggle with oauth obo and turnstone was just there and ready.
Great videos, I always wanted to see a more “sophisticated” demo. Maybe if you have something like a use-case with multiple-agents that use different models to show as well, that would be awesome !
Next vid was planning to show off the network connection broker. Let turnstone+deepseek go hop by hop between 2 devices that had a “communication problem” or two I create.
But if you have ideas for vids i guess let me know. Cranking out each MCP takes maybe 2 days total between building testing hardening etc. so…
my solution to that was a camoufox mcp and to encourage qwen3.6 that it really can do captcha, because the training set is poisoned
this second video, I know you already know, is legit bananas.
(When that VC money rolls in we’ll poach you. any day now… any day… now.. any second…)
You should see it fully integrated into an actual F200 enterprise stack… I cant say more lol
If you want a billion dollar design for unstructured data processing solution to make chatbots talking to hundreds of millions of PDF files on NTFS permissioned MCP using oauth on-behalf-of flows, let me know 
I just talked to pure and netapp this week asking for them to make it, their products in that space are still lite.
know whats crazy? The 45 drives people might build something like that into their storage appliances. I don’t see why not? probably crawl-walk-run… but something like that is coming whether they want it to or not.
The big gotcha I dont think anybody has solved is the temporal validity of chunk problem yet.
On big unstructured filers, people dont have one file cleanly versioned in one place like a sharepoint document. They have Copy of Copy of Contract 1 (1) (1).pdf scrattered across 37 different folders.
Contract document copies are all different, they each have different hashes and names. Figuring out that $file is indeed a different version of the same document is the first challenge. Once you have the related version chunks though figuring out which one is currently in force would be next.
The whole thing requires a clever temporal RRF with search-trimming based on SID flattened ntfs perms (so i can only chat with documents I have access to ala copilot)
After you go through the whole stack, the output of the agent changes when you ask “Does my Oracle contract have penalties for XYZ?” from the always-incorrect Yes/No answer to a fully qualified “That contract did have penalties for XYZ up until May 10th when somebody changed it to remove them…”
The promised land of business value from a pile of billions of flat files on CIFS is actually attainable, but requires a lot more sophisticated nuanced solution than just chunk/vectorize/rag it.
