Which critical vulnerabilities are open, and what did we fix last month?
Intruder scans your systems for vulnerabilities, and Memtro reads what it has found: current issues by severity with a short remediation, where each occurs by target and port, fixed findings, targets, scans and occurrence comments. Scanner output and stored scan credentials are never returned. When asked and once an administrator has granted the action by name, it can comment on or snooze an occurrence, start or cancel scans on named targets or tags, add, tag or delete targets, and create or delete scan schedules. A scan probes those systems from the internet. A snooze cannot be undone from Memtro.
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right Intruder tool, reads what it needs, and answers with the source cited.
These tools change something in Intruder. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.
Once Intruder is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.
Intruder + MemtroWhich critical vulnerabilities are open?
What did we fix last month?
Where does the OpenSSH issue occur?
Which targets are unresponsive?
Start a scan of the web-prod tag now that the patch is deployed.
Tom Reilly, security engineer at BigCo, asked which critical vulnerabilities were open. Memtro listed the critical issues with CVSS and exploit likelihood. It then showed each occurrence's target, port and when it was last scanned.
After the OpenSSH patch went out, Tom asked Memtro to scan the web-prod targets again. Memtro started a scan on that tag only, which probed those systems from the internet. When it finished, Memtro confirmed the OpenSSH occurrences had moved to fixed.
The teams that lean on Intruder most, a question each of them asks, and what they connect beside it.
A record in Intruder is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
UptimeRobot
Honeycomb
Cronitor
FireHydrant
StatusCake
GlitchTip
GLPI
Langfuse
LibreNMS
NetBox
Snipe-IT
Woodpecker CI
Zabbix
LangSmith
Helicone
GrowthBook
Drata
GitGuardian
Secureframe
ilert
JumpCloud
ConfigCat
Split
Aikido Security
Astronomer
Comet Opik
CrowdStrike Falcon
Detectify
Domotz
LambdaTest
LangWatch
LlamaCloud
Logz.io
Lunary
NinjaOne
Northflank
Portkey
PromptLayer
PRTG Network Monitor
Raygun
Retell AI
Runpod
Shodan
Spike.sh
Squadcast
Tenable
UpGuard
Uptime.com
Vanta
Zenduty
Cortex
WorkOS
Kandji
Automox
Huntress
SimpleMDM
Healthchecks.io
Rapid7 InsightVM
ZenhubCreate a dedicated Intruder user for Memtro, so the token keeps working when a person leaves. The token has no scopes and carries that user's whole access.
In the Intruder portal, open My account → API Access Tokens. Create a token with a name and optional expiry, confirm with your password and copy it.
In Memtro, open Connections → Intruder and paste it into API access token.
Ask: which critical vulnerabilities are open?
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The Intruder tools are the same everywhere.
Only when you ask, and only what it has been granted: add a comment to a vulnerability occurrence; snooze a vulnerability occurrence (accepted risk, false positive or mitigating controls); start a scan on named targets or tags, or cancel a running scan; add a target to scanning, tag it, or delete it; create a recurring scan schedule for named targets or tags, or delete one. Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.
A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.
API access token. Create a dedicated Intruder user for Memtro, so the token keeps working when a person leaves. The token has no scopes and carries that user's whole access.
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.
Sign in, add a provider key, create an API key and point your tools at Memtro. It takes about five minutes.
7-day free trial · card on file, nothing charged until it ends · cancel any time
