Skip to main content
A probe is the component that physically connects to a running OS process and reads its internal state — no screenshots, no UI automation, and no source code required. NSP ships four probes, each engineered for a different runtime environment. When a new process starts on the host machine, NSP’s axon-daemon detects it, classifies its runtime, selects the matching probe, attaches to the live process, and begins emitting structured SubstrateState JSON within seconds.

​
What a Probe Does

Every probe performs the same three jobs, regardless of the underlying runtime:
  1. Connect — Establishes a channel into the live process (CDP WebSocket, JVMTI agent socket, MMF bridge, or ptrace/ReadProcessMemory handle).
  2. Extract — Reads the application’s in-memory data model and converts raw runtime objects into dot-notation key-value pairs.
  3. Normalize — Applies semantic labels (field names, object types, action signatures) and writes the result as a SubstrateState object with a confidence score.

​
The Four Probe Types

V8 / JavaScript

Connects via the Chrome DevTools Protocol (CDP). Uses the ASO fast-path (~5–50ms) or heap snapshot fallback (~47s). Covers Gmail, Slack, VS Code, Notion, Discord, and any Electron app. Accuracy >99%.

JVM / Java

Attaches a native JVMTI agent via the JVM Attach API and uses JNI reflection to read fields and invoke methods. Covers SAP ERP, IntelliJ IDEA, Jenkins, and Elasticsearch. Accuracy >97%.

CLR / .NET

Injects a managed C# bootstrapper via the Windows CLR Hosting API and communicates over a Memory-Mapped File bridge. Covers Mission Planner, WinForms, WPF, and Microsoft Office. Accuracy >97%.

Native / C++

Reads process memory via ptrace (Linux) or ReadProcessMemory (Windows) and applies Visual-Memory Grounding for semantic labeling. Covers Bloomberg Terminal, Photoshop, and AutoCAD. Accuracy ~75%.

​
Probe Comparison

​
App Lifecycle

Every tracked application follows the same deterministic lifecycle from first detection to steady-state fast polling.
1

Process detection

axon-daemon continuously scans all running OS processes and registers any new PID, executable name, and command-line arguments.
2

Runtime classification

The daemon inspects the process to determine whether it is running a V8 engine, a JVM, a CLR, or native code, and selects the appropriate probe.
3

App identity assignment

The classified process is matched against the app signature database. A matching entry assigns a stable app_id (e.g. gmail-chrome-12847) and human-readable app_name that survive process restarts.
4

Probe attachment

The appropriate probe connects to the target runtime. This is the cold probe phase — the first full state extraction and schema discovery. Duration is 3–90 seconds depending on runtime and app size.
5

First SubstrateState cached

Once confidence reaches 0.80 or above, the first SubstrateState is written to the in-memory cache and made available via the REST API.
6

Fast poll loop begins

The probe enters its optimized fast-path poll loop. By default, state refreshes every 2 seconds at ~50ms per cycle. Any state change triggers a WebSocket event broadcast to all subscribers.
When the tracked application exits, the probe detaches automatically, the state is removed from cache, and the probe_status transitions to detached. No manual cleanup is required.

​
Probe Status Values

The probe_status field in AppSummary reflects the current lifecycle phase:

​
Confidence Score by Runtime

Each probe produces a confidence score (0.0–1.0) reflecting how completely its semantic labeling covers the application’s state. Confidence determines which action tiers are unlocked.

​
Forcing a Fresh State Read

By default, state is served from the 2-second rolling cache. To bypass the cache and trigger an immediate probe cycle:
Do not call fresh=true in a tight loop. For continuous updates, use WebSocket streaming — the daemon pushes state-change events on every poll cycle automatically.