See Runzee in action

Bring your hardest Android questions.

Request a focused demo built around your research workflow, deployment environment, and visibility requirements.

Application · System · Kernel research

See what Linux systems are really doing — from an application to the kernel.

Observe runtime behavior at the kernel, trace it back to code, and let AI agents investigate the system directly.

Runzee is an AI-native runtime research platform for Linux-based systems — from Android devices to distributions such as Ubuntu. It captures system activity, code execution and device state — then exposes that evidence to researchers and AI agents through the UI, Python SDK and MCP.

Kernel-levelCode attributionOffline

Capture: Files, network, IPC, logs + content
Trace: Every operation back to code
Cover: Native, JNI + compiled Java
Scope: App, process, kernel or entire device
Control: UI, Python SDK + MCP
Deploy: On-premises + fully offline

Reduce the search spacefrom runtime behavior
to relevant code

Move from observed behavior to the code that executed.

At the bench

Collapse the search space with execution coverage — reduce hundreds of thousands of possible functions to the functions that actually executed during the scenario.
No instrumentation stack to maintain — write against the Python SDK while Runzee handles kernel details, symbol resolution and Android-version differences underneath. No eBPF C, custom compiler pipeline or per-release hook rewrites.
Observe beneath the application — capture behavior at the operating-system layer, including execution paths userspace instrumentation can miss.

For the business

Reach relevant code faster — reduce a large application to the functions involved in the behavior under investigation.
Turn investigations into repeatable workflows — reuse the same scenarios across application versions, Android releases, devices and fleets through the SDK or MCP.
Preserve machine-readable evidence — keep runtime behavior, executed code and scenario results together for review, comparison and agentic follow-up.
Keep sensitive research inside the environment — deploy fully on-premises or air-gapped when code, binaries and research data cannot leave the organization.

Interfacesfor humans
and for agents

One research engine. Human and agent interfaces.

Explore captures, system activity and coverage interactively

Python SDK

Automate scenarios, instrumentation, capture and analysis

MCP

Give AI agents direct access to runtime evidence and research operations

UI, SDK and MCP operate on the same capture and analysis engine. Humans and agents investigate the same underlying system state.

Coverageexecution coverage

Turn execution into a searchable code surface.

executed — investigate not executed — deprioritize

Runzee records the functions reached during a scenario and reduces the application to the executed set — searchable, filterable and ready for investigation.

Visibilitybelow the app surface

Open the event. Inspect everything attached to it.

The selected network write carries its plaintext buffer, TLS destination, process context and resolved native call stack. The same record is available through the UI, Python SDK and MCP.

Runzee Network events view with a selected outbound HTTP write, captured plaintext bytes, TLS connection details and a twelve-frame native call stack — **One event, full research context.** Captured bytes before TLS encryption, connection metadata and the native path from the application library to the kernel boundary.

System researchthe whole device

Treat the entire Linux system as the target.

Investigate processes, kernel threads, memory pressure and CPU state without selecting an application package first.

Tasks

Processes and kernel threads

Memory

Available memory, pressure and slab caches

CPU

Core activity, load average and pressure

Start with a device-level anomaly. Drill down to the process, kernel activity and captured events responsible for it.

Why kerneluserspace hooks
cannot promise this

A hook can be walked around. A syscall cannot.

Userspace instrumentation sees only execution through its hooks; applications can bypass them and invoke syscalls directly. Broad hook sets add overhead. Runzee captures the operation at the kernel boundary, independent of the userspace path.

AutomationPython SDK

Write the investigation in Python. Runzee handles the kernel machinery.

Configure collectors, attach probes, run scenarios and stream runtime records through one Python SDK. Runzee handles the underlying instrumentation, symbol resolution and platform-specific plumbing.

Runzee Python SDK example configuring file, Binder and Logcat collectors with syscall tracers, then streaming runtime records — **One Python workflow.** Configure collectors and tracers, run the session and stream runtime records as they are captured.

Targeted probesuprobes and kprobes

Hook native and kernel functions from Python.

Attach uprobes to native functions and kprobes to kernel functions, inspect their arguments, and record the values relevant to the investigation. Use typed arguments where type information is available, or access raw ARM64 registers when it is not.

class TargetedHooks(RunzeeScript):
    @probe.user(
        lib="libbinder.so",
        method="android::BpBinder::transact",
        name="binder/transact",
    )
    def binder_transact(args, save):
        save(code=args.code, flags=args.flags)

    @probe.kernel("do_sys_openat2", name="kernel/open")
    def kernel_open(args, save):
        save(dfd=args.dfd)

Compose userspace and kernel probes in the same reusable research program and persist their output in the same capture.

Product viewcapture and
coverage in the UI

One capture, from system behavior to executed code — in the UI or from Python.

Runzee capture overview showing Processes, Libraries, Coverage, Binder, Network, File System, File Watch, JNI and Logcat collectors — **One capture. Every research surface.** Processes, libraries, Binder, network, files, JNI, logs and coverage are synchronized against the same running target.

Runzee coverage overview showing 3,978 executed functions across 148 libraries, with hottest functions and symbol resolution — **3,978 of 163,521 functions executed.** Coverage reduces the investigation from the full application to the functions reached by this scenario.

Runzee named-functions view listing executed functions, their libraries and run counts — **Executed code, resolved to functions.** Filter the named set and inspect each function, its library and run count from the same capture.

The same capture, coverage and runtime data are available through the Python SDK for automated investigation and analysis.

Deploymenton-premises
and offline

Nothing has to leave the building.

Runzee runs entirely on-premises and can operate fully air-gapped. Connect its AI layer to any OpenAI-compatible inference endpoint, including locally deployed models. Source code, binaries, captures and findings remain inside your environment.

Installationdevice-side
deployment

One binary on the device. Connect from any host.

Deploy Runzee like gdbserver or frida-server: place one dependency-free binary on the Android device, start it, then connect and investigate from Linux, macOS or Windows.

adb push runzeeServer → start it → connect from the host.

01 Deploy

Single device binary. No runtime dependencies.

02 Connect

Linux, macOS or Windows host.

03 Investigate

UI, Python SDK or MCP.

Roadmaptoday, and next

Today — Android

Application, system and kernel research on Android. UI, SDK, capture engine, coverage, collectors and MCP are available today.

Next — General Linux

Extending the same research architecture from Android devices to general Linux systems, servers and workloads.

Applicable towhere it earns
its keep

Mobile vulnerability research Android platform & kernel research Malware runtime analysis VRP & exploit validation AI-assisted security research

AI-native runtime research for Linux systems

Turn AI from passive analysis into active system investigation. Runzee lets agents observe Linux-based systems at the kernel, connect behavior to code, run probes and collect evidence through the same research platform used by human operators.