Flocks Docs

English

Simplified Chinese

English

Simplified Chinese

Appearance

Overview

Flocks is an agent-powered platform for security operations. It is not a simple chat assistant or an automation engine limited to fixed rules. It brings conversation, analysis, execution, orchestration, integration, knowledge capture, and continuous operations into one place, helping teams turn everyday security work into repeatable workflows and closed-loop operations.

Project Introduction

The difficulty of security operations is often not just "too many alerts". The task chain is long, context is scattered, and collaboration across systems is expensive. A typical alert investigation may require switching between an intelligence platform, asset system, host environment, web console, and ticketing system. Traditional SOAR is strong at fixed processes, while general chat-style AI often stops at advice and does not execute the operational workflow.

Flocks is designed for problems with long task chains, many systems, and continuous operations requirements. The platform uses the main Agent Rex as the unified entry point and builds its foundation around the session runtime, tool system, Workflow engine, expert Agents, Skills, memory system, task scheduling, and multiple access entries. For users, the interaction entry can be WebUI, CLI, TUI, or a messaging channel. For the platform, these entries share the same backend and runtime.

Typical scenarios for Flocks include:

  • Security operations teams that need multi-source correlation and initial triage for alerts
  • Teams that need to turn investigation steps into Workflows, Skills, or expert Agents
  • Scenarios that need to connect multiple security devices, APIs, web consoles, or internal systems
  • Teams that want to turn one-off analysis into continuous operational workflows

Flocks WebUI home overview

Figure 1.1: Flocks WebUI home page, including core navigation, session, Workflow, and Agent entry points, and operational metrics.

Community and Feedback

The following content is a historical summary of community co-building and incentive programs, kept for reference:

Thank you for supporting Flocks. Since the release three weeks ago, we have received many useful suggestions and scenario ideas. To thank seed users for their support, Flocks will add 30 days of free license time for eligible users. Existing daily 10 million Token and MCP-related usage benefits will continue normally during this extension period.

We invite users to continue exploring the product, report issues and improvement suggestions, contribute scenario ideas, share feedback, and help make Flocks more practical for day-to-day security operations.

License rules:

  • Existing users registered from March 30 to April 29 will have their license automatically extended to 60 days.
  • New users registered after April 29 still receive the default 30-day registration license.

Benefits:

Application Scenario Exploration Reward

Submit an application-scenario case for Flocks, or provide scenario ideas to the Flocks team. After team evaluation, rewards are issued based on scenario quality. Scenarios must meet these requirements:

  • Related to security business scenarios.
  • Use any one of the four plugin types: tools, workflow, skills, or agent. Here, tools mainly refer to API integration for a cybersecurity device.

Reward plan: 5 million to 50 million Token per day, valid for 30 days after review and verification. Rewards can be stacked.

Submission method: send to flocks@threatbook.cn, or submit an Issue or PR through GitHub.

Campaign period: April 2 to May 6.

In-depth Interview Reward

If you have deep thoughts about Flocks application scenarios, code quality, deployment methods, or related topics, and are willing to take a 15-minute in-depth interview, you are welcome to discuss business scenarios with the team, co-create, and provide product suggestions.

Reward plan: 30 million Token per day, issued after the interview, valid for 30 days. Rewards can be stacked.

Submission method: send to flocks@threatbook.cn, or submit an Issue or PR through GitHub.

Submission content: personal WeChat ID, API key, and detailed content.

Campaign period: April 2 to May 6.

Product Optimization Reward

Users who participate in co-creation and submit Pull Requests, Issues, or feature requests that enter the development schedule during Flocks use may receive rewards.

Reward plan: 5 million to 20 million Token per day based on quality, issued after review, valid for 30 days. Rewards can be stacked.

Submission method: send to flocks@threatbook.cn, or submit an Issue or PR through GitHub.

Submission content: personal WeChat ID, API key, and detailed content.

Campaign period: April 2 to May 6.

Flocks Sharing Reward

You can participate by using either of the following sharing formats:

  • Post usage experience on WeChat Moments. The content must include the Flocks download link or group QR code, must not be visible only to yourself, and must remain available for more than 2 days. Identical content posted within one week is counted as one post.
  • Post product usage experience, scenarios, tips, or similar content in technical communities such as GitHub Discussion, Xiaohongshu, Zhihu, FreeBuf, CSDN, or Kanxue. The content must include the Flocks download link or group QR code. Identical content posted on the same platform within one week is counted as one post.

Reward plan: 5 million Token per day for each post. The same platform is counted once; multiple platforms can stack rewards.

Submission method: send to flocks@threatbook.cn, or submit an Issue or PR through GitHub.

Submission content: personal WeChat ID, API key, and detailed content.

Campaign period: April 2 to May 6.

Core Capabilities

Flocks' core capabilities can be summarized in five layers: understanding tasks, connecting capabilities, executing actions, capturing experience, and sustaining operations.

1. Multi-Agent Collaboration

The platform is not limited to one chat role. Rex understands goals, decomposes steps, coordinates execution, and summarizes conclusions. Expert Agents handle specific problem domains such as intelligence analysis, host investigation, vulnerability analysis, and web data collection. This preserves a unified entry point while avoiding putting every responsibility into one "universal Agent".

2. Tools, MCP, and External System Integration

Flocks provides a unified tool system with built-in tools, API tools, Python tools, and MCP integration. For many security teams, this means ThreatBook, VirusTotal, GreyNoise, FOFA, internal platform APIs, and web consoles can be brought into one execution context instead of being connected manually as isolated scripts.

3. Workflows and Task Center

Tools define what can be done, while Workflows organize those actions into stable processes. Flocks Workflows are not static flowcharts. They are automation playbooks that can be created, validated, tested, and run. Task Center further extends these capabilities into scheduled execution, batch processing, and continuous operations.

4. Skills and Organizational Knowledge Capture

Skills are suited for carrying standards, policies, methodologies, and task templates. They can come from internal team knowledge or be installed from external sources. For enterprises, this means personal experience does not have to remain in conversations. It can gradually become shared operational knowledge.

5. Multiple Models and Multiple Entries

Flocks supports multi-model management, default model settings, custom compatible integrations, and collaborative access through WebUI, CLI, TUI, and channels. Models are no longer fixed configuration inside a local component. They are platform-level resources shared by Agents, Workflows, and Task Center.

Architecture and Components

From a product perspective, Flocks can be understood as a five-layer system:

LayerRole
Multi-entry access layerProvides interaction entries such as WebUI, CLI, TUI, and channels
Platform service layerCentrally manages sessions, models, tools, Workflows, Skills, and tasks
Agent runtime layerHandles task decomposition, tool calling, follow-up interaction, and result synthesis
Capability extension layerHosts extension capabilities such as tools, workflows, agents, skills, and MCP
Platform support layerProvides configuration, memory, Workspace, Task Center, and storage capabilities

In short, entries provide access to the platform, the backend organizes capabilities, the Agent runtime drives tasks forward, and tools, Workflows, Skills, and expert Agents keep extending the system.

This is also the biggest difference between Flocks and a single chat assistant. Users see one operational workspace, backed by an orchestratable, extensible, and governable SecOps foundation.

Is Flocks a "OpenClaw Wrapper"?

Technically, Flocks and "OpenClaw" both use a multi-Agent technical architecture. Flocks' Agent design mainly follows the opencode architecture: opencode is developed in TypeScript, while Flocks reimplements it in Python. The memory module design mainly follows OpenClaw's memory capability. At the same time, Flocks provides a Workflow module, which OpenClaw does not have, making it more suitable for cybersecurity-specific scenarios.

From a scenario perspective, Flocks pre-integrates a large amount of cybersecurity data, tools, devices, and Agents, with a stronger focus on security operations and cybersecurity implementation.

Whitepaper and Public Materials

If you want to understand Flocks quickly before installation and use, read in this order:

  1. README_zh.md: understand the project positioning, installation methods, and default access entry first
  2. Flocks Whitepaper: understand why the platform is built around agent-powered SecOps workflows and how its overall architecture works
  3. Quick Start: complete installation, startup, and first-time setup through the shortest path

Public materials for deeper reading:

Built with VitePress

Copyright © Flocks