Windows 10/11
64-bit (x64) desktop app
Official Buncha Build website
Incident response procedures you can write, review and rehearse
Buncha Build is a Windows 10/11 agent that reads your existing documents, drafts checklists and exercise scenarios, and, in Ask first mode, shows each change as a diff you accept. Version 2.9.22.
Find the gaps in the incident notes in this folder and draft a one-page checklist.
- list_dir
.5 files - grep
severity3 matches - read_file
docs/contacts.mdread - write_file
ir-checklist.mdsaved - edit_file
ir-checklist.md+4 lines - Shell
your spell-check commandexit 0
Waiting for your OK before the next stepRejectAccept
2.9.22
Released 28 October 2026
About 34 MB
Portable single .exe about 25 MB
13
Interface languages in the app
None needed
No sign-up to run the app
3 modes
Auto-run, Ask first, Plan only
Incident response procedures, drafted and checked in your folder
Incident response procedures are written, step-by-step descriptions of who is told, who decides, what is checked and what is recorded when a security incident happens. A policy states the high-level rules, a plan sets roles, and a procedure lists the concrete steps. Teams use all 3. Buncha Build writes and reviews these documents on your PC; it does not detect or handle incidents.
Find the gaps in your current documents
Finding gaps comes first, and Ask first suits it because reading goes ahead while any change waits for your OK. list_dir and glob list the policy, contact and notes files in the working folder, grep searches them for words such as severity and contact, and read_file opens the files that matter. The agent then lists the gaps, for example a missing 24-hour contact list or an undefined severity level. You read that list. Nothing is rewritten until you accept a diff.
Tool trace
list_dir . → 5 files
glob **/*.md → 4 files
grep severity → 3 matches
read_file docs/contacts.md → readDraft an incident response checklist from your notes
A first checklist can come from your own notes in one request. write_file creates ir-checklist.md with 5 headings, Prepare, Triage, Contain, Communicate and Review, and each heading gets short task lines such as opening an incident record with date and time. Under Contain, one line asks who approves each decision and another says to note times and keep copies of logs, which is how teams preserve evidence from security logs. The file stays plain text. edit_file adjusts the wording, and in Ask first mode you read the diff before you accept it.
Tool trace
write_file ir-checklist.md → saved
edit_file ir-checklist.md → +4 lines
Shell your spell-check command → exit 0Prepare a tabletop rehearsal for your team
A tabletop exercise is a discussion in a meeting room about a made-up scenario, so the agent only writes documents for it. A tabletop exercise template needs a scenario, questions for each role and a column for notes and follow-up tasks. write_file saves the scenario as a new file, and read_file brings in your contact list so the roles match the 24-hour contact list you already keep. Run the session yourselves. Before the meeting, read the scenario for anything that points at real systems, and reject any diff that does.
Keep each incident handling procedure current
After a rehearsal the written steps need updating, and the agent works from the review notes you saved. A report outline written in advance gives the review a fixed shape, with a summary, a timeline table with 4 columns (time, source, event, who noted it), impact, actions taken and follow-up tasks. edit_file changes the procedure and shows a diff, and the version-control skill can commit accepted changes, so an earlier copy exists. Start in Plan only. It lists the intended edits, and after you switch to Ask first you approve each diff one by one.
How it differs from a typical chat assistant
Version 2.9.22 reads your files. A typical chat assistant returns text that you paste yourself, while Buncha Build opens the documents, writes the new ones and shows each change as a diff.
| Typical chat assistant | Buncha Build | |
|---|---|---|
| Files | Usually replies in text that you copy and paste yourself | Reads and writes files in the chat's working folder |
| Changes | Often returns a whole new version of the text | Ask first shows each edit as a diff to accept |
| Approval | Usually nothing to approve, because it only replies | 3 modes: Auto-run, Ask first and Plan only |
| Sources | Often answers from memory unless you paste the text | Reads public guidance with web_search and http_get |
How it works
- Install Buncha Build on Windows 10 or 11 and compare the SHA-256 checksum of the setup program with the published manifest before you run it.
- Connect a model: a cloud AI provider, a model running locally on your PC, or the built-in model. Press Test to check the endpoint.
- Choose the working folder that holds your procedures, then pick Plan only or Ask first.
- Describe the task, read each action card and the diff, and accept or reject the change.
Who uses it and when
IT administrators in small organisations often write their own incident management procedures, because the work lands on whoever knows the systems best. Notes live in one folder. In Plan only the agent lists the edits it would make, such as adding a 24-hour contact list, and after you switch mode it drafts them as diffs you accept.
SOC and CSIRT members review their procedures after every rehearsal, and the agent helps with the paperwork around that review. It reads the public NIST SP 800-61 guide, lists which of the 4 phases a procedure does not mention, and proposes edits as a diff. You review the result.
Team leads and IT managers who prepare tabletop sessions use it to turn a loose idea into a written scenario with discussion questions, roles and a notes page. They run the session themselves. Real incidents belong to trained responders and your organisation's own plan, not to this app.
Common questions
What are incident response procedures?
Incident response procedures are the written steps a team follows from the first report of a security incident to the review afterwards, covering roles, severity levels, evidence notes, communication and recovery. A policy sets rules instead. A checklist is the short form that people can tick off during a drill.
Is bunchacode.com the official Buncha Build website?
Yes, bunchacode.com is the official Buncha Build website. Verify the download. The setup program is not code-signed yet, so compare its SHA-256 checksum with the published manifest before you run it, and use the Send feedback button in the app to report anything odd.
What do people mean by incident response protocols?
Incident response protocols are one of several names for the written steps a team follows, and the words plan, policy, procedure and checklist are often mixed up. Agree the words early. A policy sets the rules, while a procedure or checklist gives the concrete steps.
Can AI help with incident response tabletop exercises?
Yes, with limits. Buncha Build can draft a made-up scenario, discussion questions and a notes page as files that you review, but the discussion happens among your own people in a meeting room. It does not simulate attacks or touch real systems.
Does Buncha Build handle a real incident?
No. It is not an incident response, detection or monitoring product, so it does not watch networks, contain machines or remove malware. During a live incident, follow your organisation's own plan and call your responders.
Do my files leave the PC?
Yes, with a cloud model. The prompt text, including any file text the agent reads, goes to that provider; with a model running locally on your PC, nothing leaves the machine. Secrets in tool output are redacted before they reach the model.
Are the results always right?
No. Every draft is a first version that you read, test and correct yourself, which is why the diff and Ask first mode exist. A legal adviser must confirm notification duties, because they differ by country and sector, and trained responders handle real incidents.
Start with the documents you already have
Setup is about 34 MB. Download Buncha Build for Windows 10 or 11, connect a model, then point it at the folder that holds your documents and choose Plan only if you want to read the plan first.
Download Buncha Build for Windows ↗Explore the site
Each page below exists in 20 languages.
What Buncha Build can do with your documents ↗ Connect a cloud, local or built-in model ↗ Step-by-step guide to your first checklist ↗ Download and verify the Windows installer ↗ Answers to common questions ↗ What stays on your PC and what is logged ↗
