Sovereign network diagnosisIt reads. It never touches.
Auspex is an on-premise, read-only fault-diagnosis assistant for your network. It runs entirely inside your closed environment — air-gapped, on your own hardware — powered by Kestrel, a compact model trained in our synthetic network lab.
The problem
The networks that need help most can't phone home.
Enterprises won't expose their network configuration to an outside service — and many of the sites that need diagnosis most have no internet at all. A cloud AI assistant simply cannot run there.
Auspex answers that constraint directly. Everything — the assistant, its tools, and the model — lives on the customer's own hardware, inside the closed network. Nothing leaves the site.
How it works
A data factory, not a data grab.
Auspex learns from faults we manufacture in a virtual lab — so it never needs a single byte of your production network to get good.
Synthetic lab
A virtual network of multi-vendor switches and hosts. We inject thousands of realistic faults — no customer data ever required.
Expert distillation
A large teacher model diagnoses each fault using only read-only tools, then a deterministic verifier keeps solely the traces that are provably correct.
The model learns
The compact Kestrel model learns from those verified traces — distilling an expert's judgment into something small enough to run offline.
The modelKestrel — purpose-built on purpose.
A kestrel hovers dead still, reads the ground below, then strikes with total precision. The model at the heart of Auspex is built the same way: compact enough to live inside your network, sharp enough to name a root cause on the first pass.
We didn't chase a bigger model. We trained a focused one — narrow by design, expert at a single discipline, and light enough to run where the network actually lives. That's what makes on-premise diagnosis possible at all.
Kestrel is scored against its expert teacher on a held-out exam before any performance claim is published.
Compact
Small enough to run on a single modest on-site machine — no GPU cluster, no data center.
Offline
Runs fully air-gapped. No cloud calls, no telemetry, no internet connection ever required.
Purpose-built
Trained on one job — network fault diagnosis — not a general chatbot stretched to fit.
Read-only hands
Reasons over the same read-only tools as its teacher. It can look; it can never change a thing.
Safe by design
A diagnostic that can look, but cannot break anything.
The name says it: an auspex reads the signs. Ours is guaranteed to read and nothing more.
Read-only by architecture
The model can never change a configuration. Read-only is enforced at the transport layer — a three-layer, fail-closed allowlist — not by a prompt that can be talked around.
Air-gapped by design
Auspex runs 100% inside your closed network. No cloud calls, no telemetry, no data leaving the site. Your network topology never travels.
Updated on your terms
New capabilities and vendor support ship as signed model files over USB or an internal share — no internet connection needed to stay current.
Coverage
What Auspex diagnoses today.
Adding a new vendor means adding an image to the lab and running the same pipeline — coverage grows without touching a customer network.
Benchmark — validation in progress
We grade the model before we ship the claim.
Kestrel is scored on a held-out exam of network faults it has never seen, against an expert-model baseline on the exact same cases. We publish the number when the exam is complete — not before.
Get in touch
Bring Auspex to your network.
Running a closed or air-gapped network and curious what on-premise diagnosis could do for your team? Reach out for a demo and we'll get back to you.
hello@calexislabs.com →