Reads what you have
list_dir, glob, grep and read_file find and read your existing policies, contact lists and notes in the working folder.
Product
Incident response guidelines, written and reviewed in your folder
01
Buncha Build is an agent for the documents around incident response. It finds your existing notes, drafts incident response guidelines and checklists, and edits them as diffs you review, working on Windows 10 and 11 in the chat's working folder. It detects nothing.
Drafts and edits
write_file saves a new checklist or scenario, and edit_file changes an existing one and shows a diff to accept.
You pick the pace
Auto-run, Ask first or Plan only: choose how much the agent may do before it waits for you.
What the agent can do with your documents
- Filesread_file, grep, glob and list_dir find and read documents; write_file, edit_file and append_file create and change them in the working folder.
- Shellruns your own commands, such as a spell-check or link-check command, and reports the real exit code when the command ends.
- Webweb_search searches the web and http_get fetches one page, so the agent can read public guidance such as NIST SP 800-61.
- Screenshots and imagesocr reads text from a screenshot, such as an old contact table; gen_image saves image files.
- Orchestrationtask reviews several documents in parallel with sub-agents; run_on_model sends a hard step to a bigger model; skill reuses a playbook.
- Approval modesAuto-run acts at once, Ask first pauses before actions that change something, and Plan only writes a plan and runs nothing.
- Cronruns a prompt on a schedule, for example one that reads your contact list and reports entries without an owner or a review date.
- Modelsconnect a cloud AI provider, a model running locally on your PC, or the built-in model; the Test button checks the endpoint.
Changes you can read before you accept
In Ask first mode every edit appears as a diff in its action card, so you see the added and removed lines before you accept. Auto-run does not wait.
List what our escalation notes are missing and draft a short checklist.
- list_dir
.5 files - glob
**/*.md4 files - grep
escalat3 matches - read_file
docs/escalation.mdread - write_file
ir-checklist.mdsaved - edit_file
ir-checklist.md+10 lines - Shell
your link-check commandexit 0
Waiting for your OK before the next stepRejectAccept
Two jobs to hand the agent
Write a first-hour triage section
Getting ready for your first critical incident starts with a severity table that has an example for each level, a contact list and a decision on who approves containment. read_file opens your current notes, grep finds where severity is never defined, and write_file or edit_file adds a triage section with severity levels, examples and first-hour questions. The new section becomes part of your incident handling checklist. Use Ask first. Read the diff for every example, and reject any example that does not fit your own systems, because only you know what a serious event looks like there.
Add a timeline and a report outline
A purpose and scope section at the top of a procedure states why we need incident management in your organisation, and the agent drafts it with write_file before adding a report outline. To build an incident timeline for a rehearsal, it writes a table with 4 columns: time, source, event and who noted it. grep searches the procedures for the outline's heading, so you see which ones lack it, and Shell can run your own export command to list the documents. Start in Plan only. It lists the intended edits first; then switch to Ask first, read each diff and accept the changes yourself.
What Buncha Build does not do
Buncha Build is a Windows app, not a hosted service or a plugin. It is meant only for your own documents and systems, or ones you have written permission to work on, and keeping to that is your responsibility. You review every result. Nothing guarantees that its drafts or analysis are correct.
