AI Agents for Manufacturing: Bridging OT/IT, Firmware, and Supplier Risk

The plant floor at a mid-size manufacturer runs on systems that were never built to talk to each other, and everyone who has tried to connect a SCADA historian to a cloud dashboard knows it. The PLC network was commissioned in 2014 by an integrator who is no longer under contract. The IT team owns the firewall but has no idea what protocol the injection molding line speaks. The edge gateways bridging OT to IT have firmware that has not been touched since the machines were installed, because touching it means a scheduled outage, and outages on a three-shift line cost real money per hour. Layer on a supply chain that traces back cleanly to the tier-one vendor and then vanishes into a fog of subcontractors, and you have the actual daily reality of running a plant: not a greenfield IoT project, but a patchwork of legacy control systems, undocumented firmware, and vendor relationships nobody has fully mapped. Generic AI tools are not built for this. They are built for web apps and Python scripts, not Modbus registers and firmware partition layouts.

Why ChatGPT and Cursor stop at the plant floor door

Ask ChatGPT or Claude.ai how to bridge an OT network to a cloud historian and you get a generic explainer on industrial protocols, the kind of overview you could find in a vendor whitepaper. It will describe VLANs and DMZs in the abstract. It will not read your actual firewall rules, will not know that your historian ingestion is running unbounded on S3 at full resolution with no lifecycle policy, and will not flag that the jump box between the OT VLAN and the corporate network has a routing rule that defeats the segmentation it was built for. A generalist chatbot answers the question you asked. It does not audit the network you actually have, because it cannot see it, and it has no framework for industrial network design beyond what is publicly documented.

Cursor and GitHub Copilot are worse fits, not better ones, for this specific audience. They autocomplete code inside a repository. Most of a manufacturing engineering team's real risk does not live in a repository at all: it lives in PLC ladder logic that predates version control, in firmware binaries flashed onto edge gateways a decade ago, and in a bill of materials for a torque sensor module that was assembled by a subcontractor nobody at the plant has ever spoken to. An autocomplete tool has nothing to say about firmware update cadence across 40 devices from six vendors, and nothing to say about whether the embedded C library in a third-party HMI panel has a live CVE. It is optimized for a domain that manufacturing OT/IT work barely touches.

Forge, Volt, and Chain: three specialists for one plant

Tonone does not send a generalist at this problem. It sends three specialists who each own a slice of it. Forge is the infrastructure engineer, the one who audits the network segmentation between OT and IT, sizes the historian ingestion pipeline, and catches the cloud cost bleed that nobody in the plant is watching because it is buried in an AWS bill. Volt is the embedded and IoT engineer, the one who reads firmware architecture, audits patch cadence on devices that cannot be casually rebooted, and designs the over-the-air update flow that lets you patch a gateway without shutting down a line. Chain is the supply chain security engineer, the one who builds the software bill of materials for everything running on the equipment, tracing embedded libraries down through vendor, subcontractor, and sub-subcontractor until the actual dependency tree is visible.

Tonone's Forge, Volt, and Chain agents cover the three blind spots of manufacturing engineering: OT/IT network boundaries, firmware patch cadence on the floor, and the embedded software supply chain hiding inside third-party equipment.

Forge: mapping and hardening the OT/IT boundary

The forge-recon skill is where most plant engagements start. It inventories what is actually running: the VLANs, the firewall rule sets, the jump boxes, the cloud resources ingesting historian data, and it flags the connections that do not match the network diagram on the wall, because there is almost always at least one. From there, forge-network designs or repairs the actual segmentation: proper VPC and subnet boundaries on the IT side, firewall rules that enforce the OT/IT split instead of just documenting it, and DNS and load balancer configuration for whatever gateway sits at the boundary. forge-audit catches the misconfigurations that recon surfaces but does not fix: a security group left open from a vendor's remote support session two years ago, or a historian bucket with public read access nobody remembers granting. And because cloud cost is a real line item for any plant streaming sensor data continuously, forge-cost audits what the historian ingestion pipeline is actually costing and where the waste is, unbounded retention, wrong storage tier, redundant regional replication, and produces a concrete plan with estimated savings attached to each change.

Volt: firmware that runs on hardware you cannot casually patch

Volt's job starts with volt-recon, a firmware reconnaissance pass across the fleet of edge gateways, PLCs, and HMI panels: what MCU or SoC each one runs, what RTOS or embedded Linux distribution, what protocols it speaks, and critically, when it was last patched and by whom. This is the step that turns a vague sense of unease, nobody has touched these gateways in years, into a concrete inventory with dates attached. Once the inventory exists, volt-firmware produces an architecture spec for any device that needs rework: layer diagram, HAL interface, the state machines that matter for a device sitting on a factory floor rather than a lab bench. And because the real blocker to patching plant equipment is almost never the patch itself but the deployment risk, volt-ota designs the over-the-air update system: partition layout, rollback conditions, validation checks, and a fleet management approach that lets you push a firmware update to forty gateways without needing to schedule forty separate maintenance windows.

Volt's volt-recon skill turns "nobody has touched these gateways in years" into a dated, per-device firmware inventory across every vendor on the floor.

Chain: the software bill of materials hiding inside your equipment

Every piece of industrial equipment on a modern floor runs software, and that software has dependencies the equipment vendor did not write and often does not track closely. Chain's chain-recon audits what is already exposed: unscanned firmware packages, license violations buried in vendor-supplied binaries, and gaps in whatever SBOM documentation exists, which on most plant floors is close to none. chain-sbom then designs the actual generation pipeline, the format, the tooling, and how it plugs into whatever CI/CD or firmware release process the plant or its integrators use, so that every future firmware drop produces a real, current bill of materials instead of a vendor's marketing PDF. And chain-scan builds the ongoing program: CVE detection against that SBOM, license checks, and gates that catch a vulnerable library before it ships to a gateway in production rather than after it has been running unpatched for eighteen months.

A worked example: Ridgeline Precision

Ridgeline Precision runs a three-shift contract manufacturing plant: 46 CNC and injection molding machines across six PLC vendors, feeding a historian that an IT contractor stood up on AWS four years ago and nobody has revisited since. The engineering lead's brief to Tonone: "we need to know what we're actually running, and whether it's safe to connect this floor to the cloud dashboard sales wants." Forge runs forge-recon first and finds the historian ingesting raw, full-resolution telemetry from all 46 machines into an S3 bucket with no lifecycle policy, at roughly $14,200 a month, and a jump box between the OT VLAN and the corporate network with an inbound rule that was supposed to be temporary for a vendor's remote commissioning session in 2023 and was never removed.

While Forge redesigns the segmentation with forge-network and closes the stale rule, Volt runs volt-recon across the 40 edge gateways bridging the PLCs to the historian. The finding: 24 of the 40 gateways are running a Linux-based gateway OS last flashed in 2021, before the plant's OT/IT bridge project even started, and the embedded TLS library on those units is three major versions behind. Rebooting all 24 gateways in one maintenance window is not viable, the plant runs three shifts with no clean downtime long enough. So Volt scopes volt-ota: a staged rollout across four maintenance windows over two weeks, gateway groups selected by production line so no single line loses more than one gateway at a time, with a rollback path if a gateway fails to check in within 10 minutes of the update.

Chain runs chain-recon against the firmware images Volt pulled during the audit and finds the real second-tier problem: a torque sensor module used on 18 of the machines bundles an embedded HTTP client library, sourced not from the sensor's listed vendor but from an ODM three subcontractor layers down that the plant has never had a direct relationship with. That library has an open CVE rated high severity for remote code execution. Nobody at Ridgeline or its tier-one vendor knew the library was in there, because no SBOM existed for the module at all. Chain's chain-sbom designs the generation pipeline going forward, and chain-scan sets the CVE gate so the next firmware revision from that vendor gets checked before it is accepted, not after it has been running for a year.

Ridgeline Precision, OT/IT + Firmware + Supply Chain Findings

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Forge, forge-recon + forge-network
  Historian ingest:     46 machines, full-res, no lifecycle policy
  Monthly cost:         ~$14,200 (S3 + compute, unoptimized)
  Finding:              Stale jump-box rule bridges OT VLAN to
                        corporate net since a 2023 vendor session
  Fix:                  Segmentation rebuilt, rule removed,
                        tiered storage plan, est. ~$5,100/mo savings

Volt, volt-recon + volt-ota
  Gateways audited:     40, across 6 PLC vendors
  Stale firmware:       24 gateways, last flashed 2021
  Risk:                 Embedded TLS lib 3 major versions behind
  Rollout plan:         4 maintenance windows over 2 weeks,
                        grouped by production line, auto-rollback
                        if no check-in within 10 min

Chain, chain-recon + chain-sbom + chain-scan
  Module affected:      Torque sensor, 18 machines
  Finding:              Embedded HTTP client from an unlisted
                        3rd-tier ODM, high-severity RCE CVE
  SBOM status before:   None existed for this module
  Fix:                  SBOM pipeline stood up, CVE gate added
                        to next firmware acceptance cycle
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Net result: cloud dashboard connection approved after segmentation
fix; firmware rollout scheduled; vendor put on notice re: SBOM.

None of this required Ridgeline's team to become network engineers, firmware engineers, and supply chain analysts overnight. It required routing each part of the problem to the specialist built for it, and having those specialists hand off findings to each other, Volt's firmware pull became Chain's SBOM input, in a single engagement rather than three disconnected consulting reports.

How this compares to generic tools

The gap is not subtle once you lay the capabilities side by side. A generalist chatbot can describe what a segmented OT network should look like in principle. It cannot read your firewall rules, cannot pull firmware off your gateways, and has no concept of an SBOM gate in a CI pipeline it has never seen. Cursor and Copilot are even further from this domain, they are built to complete code inside a repository, and most of what puts a plant at risk lives outside any repository entirely.

Chain's chain-sbom skill exists because most industrial equipment ships with a dependency tree nobody has ever generated, let alone scanned for a live CVE.

Tonone is free and MIT-licensed. Install it once and Forge, Volt, Chain, and the rest of the 100-agent roster are available inside your Claude Code session. You pay only for the Claude Code token usage during the work itself, there is no separate consulting engagement to schedule and no vendor NDA to sign before the recon pass can start.