Tessera Viz
PX-02
Cyber security
The blast radius, before it spreads.
An asset graph answers a question an alert cannot: if this host is owned, what else is. The answer is a path, and paths are what graph analysis is for.
01
03
From a single alert to the full attack path.
01
What the analyst gets
Asset and identity graphs, attack-path analysis, a timeline of detections and the alert grid, sharing one selection. Select a host and the timeline shows its detections and the grid shows its alerts.
02
Shortest path
The route in. Given an entry point and a crown-jewel asset, the path is the thing to break, and it is a query rather than a meeting.
03
Min-cut
The chokepoint that closes it. The smallest set of edges whose removal separates the attacker from the target — which is to say, the shortest list of changes worth making.
04
Community detection
The segment that moves together. Where the network says one thing and the traffic says another, the clustering shows it.
05
Scale matters here
An enterprise asset graph is a WebGL graph. It is the same API and the same layouts as the thousand-node view an analyst started on — the renderer changes, the code does not.
06
No runtime dependencies
A security team is the audience least willing to accept a few hundred transitive packages in the browser. The 31 Community packages import nothing outside the workspace at runtime, and a build check fails if one appears.
02
And with an agent
03
Ask in words. Get the path back.
01
What it changes here
An agent triaging an alert can return the attack path itself — the hosts, the identities, the shortest route to the crown jewels — drawn and selectable, instead of describing it in a paragraph the responder then has to picture.
02
A document, not a picture
The model returns one JSON document — the graph, the layout, the algorithm, the theme — and the library draws it in the page. Nothing renders server-side, so there is no image to regenerate when the next question changes the filter.
03
Checked before it draws
The document is validated first. A field the model invented comes back as a list of issues rather than as a blank panel or a thrown error, which is the difference between an agent that can be trusted in front of an analyst and one that cannot.
04
It can arrive as it is written
The stream reader takes the document while the model is still producing it, so a large graph starts appearing at the first complete object instead of after the last token.
05
MCP carries it; this draws it
Expose that document as the return value of an MCP tool and an agent draws straight into the conversation. The library does not implement MCP, any more than an image decoder implements HTTP — it is the renderer at the end of whichever transport you already run.
06
Why this is possible at all
Because the drawing runs in the browser and takes its instructions as data. A library that renders server-side hands an agent a picture; this one hands it a surface that the next question can change.