help
CommandShow available THRUNT threat hunting commands and artifact layout
Create an isolated workspace with repo copies and independent .planning/
name: thrunt:new-workspace description: Create an isolated workspace with repo copies and independent .planning/ argument-hint: "--name <name> [--repos repo1,repo2] [--path /target] [--strategy worktree|clone] [--branch name] [--auto]" allowed-tools: - Read - Bash - Write - AskUserQuestion
<context> **Flags:**
</context>
<objective> Create a physical workspace directory containing copies of specified git repos (as worktrees or clones) with an independent `.planning/` directory for isolated THRUNT sessions.
**Use cases:**
**Creates:**
**After this command:** `cd` into the workspace and run `/hunt:new-program` to initialize THRUNT. </objective>
<execution_context> @~/.claude/thrunt-god/workflows/new-workspace.md @~/.claude/thrunt-god/references/ui-brand.md </execution_context>
<process> Execute the new-workspace workflow from @~/.claude/thrunt-god/workflows/new-workspace.md end-to-end. Preserve all workflow gates (validation, approvals, commits, routing). </process>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…