The definition of headless is taking shape. More software is shipping with an MCP. Teams are starting to require it in procurement. Your CLI and Claude Code can now talk directly to the tools you already run.

LimaCharlie was one of the first platforms in the SOC to build everything through the command line....long before the post-Claude boom. Maxime Lamothe-Brassard (their founder) joins Dispatch to explore what going headless actually means for security operations.

In this episode we get into:

• What headless actually means mechanically and why it's a very old computing idea security is only now fully inheriting
• Why the UI becoming optional levels the playing field and kills the faith-based vendor pitch
• The eager intern problem: permissions control what an agent is allowed to do, not whether its answer is right
• Why passing the MCP boundary and trusting the LLM on the other side is a front door left wide open
• GPT wrappers vs. real headless infrastructure: who owns the detection logic and who's just reselling tokens
• The customer who told their MSSP they'd rather their CEO get locked out for 30 minutes than wait on a human to respond
• The one thing Max won't let a headless agent do...ever

Follow Max's work on:

• limacharlie.io | limacharlie.io/blog
• LinkedIn: linkedin.com/in/maximelb
• Free Build Your Own Headless SOC Workshop with BlackHills Infosec @ BlackHat, August 5, 2026 https://luma.com/black-hat-headless-soc-workshop?tk=crcMy4

Detection Dispatch (Alex's Version) is an independent detection engineering & threat hunting podcast. Rebuilt. Community-first. Featuring a lineup of the real and active projects pushing the limits of detection engineering, threat hunting, and everything in between.