Documentation

Tenet connects focused on-device capture with reproducible offline analysis. The Tenet backend targets Windows, Linux, and macOS on x86_64 and arm64. Because uSockets does not yet provide the required IOCP backend, Windows builds disable TENET_ENABLE_WS by default, so the separate Tauri desktop/Web frontend cannot currently connect to the Windows backend; CLI, TUI, RPC, and MCP remain available. Choose the path that matches your current goal.

Start here

Install Tenet
Record a trace with QBDITrace or a compatible collector
Open it and verify the session

Explore an execution

Navigate the timeline, inspect registers and memory at any moment, set breakpoints on a static history, and follow dynamic calls and returns. Use the separate Tauri desktop/Web frontend or the TUI; the tenet executable itself is a pure backend with no native GUI.

Analyze a trace

Recover program structure — functions, CFG, XRefs, loops
Trace data flow — forward and backward taint, critical path
Inspect memory and strings — snapshots, search, entropy, YARA
Recognize algorithms — patterns, constants, loop semantics
Platform semantics — ObjC, syscalls, C API intercepts
Trace tools — fold, diff, profile
Virtual machine analysis — handler identification and dispatch recovery

Automate an investigation

Use the CLI for batch jobs, JSON-RPC for programmatic access, and MCP Hub and the IDA bridge for static/dynamic navigation and LLM integration. There are two distinct WebSocket channels: the MCP Hub JSON WebSocket (/ws/<instance-id>) serves AI tools, IDA, and other clients, while the FlatBuffers binary WebSocket started by --ws-port is dedicated to high-throughput access from the Tauri desktop/Web frontend.

Reference

Pass catalog — every analysis pass, its CLI flag and dependencies
Compatibility and limits — what each capability requires and how it degrades
Trace format — binary format specification for custom collectors

Tenet Desktop is a separate Tauri application that launches and connects to a local tenet --ws-port <port> <trace> --mcp-hub backend as a sidecar; it is not a window built into the tenet binary. Trace files are analyzed locally, and the documentation website never receives your trace data.