attackmap-analyzer-c 0.1.0__tar.gz

attackmap_analyzer_c-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_c-0.1.0/PKG-INFO

@@ -0,0 +1,89 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-c
+Version: 0.1.0
+Summary: C ecosystem analyzer plugin for AttackMap (libmicrohttpd, civetweb, mongoose; libcurl; OpenSSL/mbedTLS/libsodium; sqlite3/libpq/mysql/hiredis/mongoc).
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-c
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-c
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-c/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-c/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.1.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-c
+
+C ecosystem analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+C is more fragmented than language-specific ecosystems — there's no dominant web framework, and routing patterns vary widely. This analyzer captures what regex can reach reliably from common third-party libraries.
+
+- **Web frameworks** — civetweb (`mg_set_request_handler` extracts routes), libmicrohttpd (`MHD_start_daemon` entrypoint), mongoose (`mg_http_listen` entrypoint + `mg_http_match_uri` pseudo-routes), libonion (`onion_url_add` routes)
+- **HTTP clients (external calls)** — libcurl (`curl_easy_setopt(handle, CURLOPT_URL, "...")` URL string literals)
+- **Databases** — sqlite3 (`sqlite3_open*`), libpq (`PQconnectdb*`, `PQsetdbLogin`), MySQL/MariaDB C client (`mysql_real_connect`, `mariadb_real_connect`), hiredis (`redisConnect*`), MongoDB C driver (`mongoc_client_new`)
+- **Auth/crypto** — OpenSSL (TLS context, EVP cipher, RAND), mbedTLS (SSL/X.509), libsodium (`crypto_pwhash`, `crypto_secretbox`, `crypto_aead_*`), Argon2 reference impl (`argon2id_hash_*`), bcrypt-c, scrypt, JWT C libraries (`jwt_encode`, `jwt_decode`)
+- **Secrets** — `getenv`, `secure_getenv`, `getenv_s` with secret-shaped names (`*SECRET*`, `*TOKEN*`, `*KEY*`, `*PASSWORD*`, `*PASS*`, `*PWD*`)
+- **Service hints** — project name from `CMakeLists.txt` (`project(NAME ...)`)
+
+All emissions populate AttackMap's Signal v2 fields (line numbers + evidence snippets + confidence) so downstream insights can cite `path/to/file.c:NN`.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-c.git
+```
+
+The analyzer is auto-discovered by AttackMap via the `attackmap.analyzers` entry-point group.
+
+## Usage with AttackMap
+
+```bash
+# Auto-discovered when installed:
+attackmap analyze /path/to/c/repo
+
+# Or invoke explicitly:
+attackmap analyze /path/to/c/repo --module c
+```
+
+## Detection
+
+`detect()` returns true when any `.c` or `.h` file is present in the tree, ignoring `build/`, `.git/`, `_deps/`, `third_party/`, `vendor/`, `external/`, `.cache/`, `out/`, and `node_modules/`. A `CMakeLists.txt` alongside `.cpp` files (and no `.c` files) is **not** claimed by this analyzer — that's the C++ analyzer's territory.
+
+## Coverage notes
+
+- **Marked experimental**: regex-based extraction in C has more false positives than language-with-strict-imports analyzers. Keep the confidence-tier model in mind when consuming output (0.6 keyword sweeps vs. 0.85+ canonical function-name hits).
+- **Routes**: civetweb / mongoose / libonion all expose path strings explicitly in their routing API; libmicrohttpd does not (single-callback dispatch on `url`). For libmicrohttpd, only the entrypoint is captured — per-route URLs would need to be regexed out of `if (strcmp(url, "/x") == 0)` patterns inside the answer-callback.
+- **HTTP method on routes**: the C web frameworks covered here don't statically declare HTTP methods at registration time (handlers branch on method internally), so all routes are emitted with method `ANY`.
+- **OpenSSL EVP / RAND** signals are confidence 0.8 — they're broad indicators of crypto usage but not strong defensive signals on their own.
+- **Authorization / Bearer / api_key keyword matches** are tier-0.6 (low confidence). They're useful as supporting evidence for an auth posture, not as load-bearing.
+- **Hardcoded `#define JWT_SECRET "abc..."` macros** are not extracted — too noisy. `getenv("JWT_SECRET")` is the canonical pattern we rely on.
+
+## License
+
+MIT

attackmap_analyzer_c-0.1.0/README.md

@@ -0,0 +1,49 @@
+# attackmap-analyzer-c
+
+C ecosystem analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+C is more fragmented than language-specific ecosystems — there's no dominant web framework, and routing patterns vary widely. This analyzer captures what regex can reach reliably from common third-party libraries.
+
+- **Web frameworks** — civetweb (`mg_set_request_handler` extracts routes), libmicrohttpd (`MHD_start_daemon` entrypoint), mongoose (`mg_http_listen` entrypoint + `mg_http_match_uri` pseudo-routes), libonion (`onion_url_add` routes)
+- **HTTP clients (external calls)** — libcurl (`curl_easy_setopt(handle, CURLOPT_URL, "...")` URL string literals)
+- **Databases** — sqlite3 (`sqlite3_open*`), libpq (`PQconnectdb*`, `PQsetdbLogin`), MySQL/MariaDB C client (`mysql_real_connect`, `mariadb_real_connect`), hiredis (`redisConnect*`), MongoDB C driver (`mongoc_client_new`)
+- **Auth/crypto** — OpenSSL (TLS context, EVP cipher, RAND), mbedTLS (SSL/X.509), libsodium (`crypto_pwhash`, `crypto_secretbox`, `crypto_aead_*`), Argon2 reference impl (`argon2id_hash_*`), bcrypt-c, scrypt, JWT C libraries (`jwt_encode`, `jwt_decode`)
+- **Secrets** — `getenv`, `secure_getenv`, `getenv_s` with secret-shaped names (`*SECRET*`, `*TOKEN*`, `*KEY*`, `*PASSWORD*`, `*PASS*`, `*PWD*`)
+- **Service hints** — project name from `CMakeLists.txt` (`project(NAME ...)`)
+
+All emissions populate AttackMap's Signal v2 fields (line numbers + evidence snippets + confidence) so downstream insights can cite `path/to/file.c:NN`.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-c.git
+```
+
+The analyzer is auto-discovered by AttackMap via the `attackmap.analyzers` entry-point group.
+
+## Usage with AttackMap
+
+```bash
+# Auto-discovered when installed:
+attackmap analyze /path/to/c/repo
+
+# Or invoke explicitly:
+attackmap analyze /path/to/c/repo --module c
+```
+
+## Detection
+
+`detect()` returns true when any `.c` or `.h` file is present in the tree, ignoring `build/`, `.git/`, `_deps/`, `third_party/`, `vendor/`, `external/`, `.cache/`, `out/`, and `node_modules/`. A `CMakeLists.txt` alongside `.cpp` files (and no `.c` files) is **not** claimed by this analyzer — that's the C++ analyzer's territory.
+
+## Coverage notes
+
+- **Marked experimental**: regex-based extraction in C has more false positives than language-with-strict-imports analyzers. Keep the confidence-tier model in mind when consuming output (0.6 keyword sweeps vs. 0.85+ canonical function-name hits).
+- **Routes**: civetweb / mongoose / libonion all expose path strings explicitly in their routing API; libmicrohttpd does not (single-callback dispatch on `url`). For libmicrohttpd, only the entrypoint is captured — per-route URLs would need to be regexed out of `if (strcmp(url, "/x") == 0)` patterns inside the answer-callback.
+- **HTTP method on routes**: the C web frameworks covered here don't statically declare HTTP methods at registration time (handlers branch on method internally), so all routes are emitted with method `ANY`.
+- **OpenSSL EVP / RAND** signals are confidence 0.8 — they're broad indicators of crypto usage but not strong defensive signals on their own.
+- **Authorization / Bearer / api_key keyword matches** are tier-0.6 (low confidence). They're useful as supporting evidence for an auth posture, not as load-bearing.
+- **Hardcoded `#define JWT_SECRET "abc..."` macros** are not extracted — too noisy. `getenv("JWT_SECRET")` is the canonical pattern we rely on.
+
+## License
+
+MIT

attackmap_analyzer_c-0.1.0/pyproject.toml

@@ -0,0 +1,74 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "attackmap-analyzer-c"
+version = "0.1.0"
+description = "C ecosystem analyzer plugin for AttackMap (libmicrohttpd, civetweb, mongoose; libcurl; OpenSSL/mbedTLS/libsodium; sqlite3/libpq/mysql/hiredis/mongoc)."
+readme = "README.md"
+requires-python = ">=3.11"
+license = {text = "MIT"}
+authors = [
+  {name = "Matthew Davis", email = "matthewd@matthewd.xyz"},
+  {name = "AttackMap Contributors"},
+]
+maintainers = [
+  {name = "Matthew Davis", email = "matthewd@matthewd.xyz"},
+]
+keywords = [
+  "security",
+  "static-analysis",
+  "appsec",
+  "defensive-security",
+  "attackmap",
+  "attackmap-plugin",
+]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "Intended Audience :: Information Technology",
+  "Intended Audience :: System Administrators",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Security",
+  "Topic :: Software Development :: Quality Assurance",
+  "Typing :: Typed",
+]
+dependencies = [
+  "pydantic>=2.7.0",
+]
+
+[project.optional-dependencies]
+core = [
+  "attackmap>=0.1.0",
+]
+dev = [
+  "pytest>=8.0.0",
+  "build>=1.2.0",
+  "attackmap>=0.1.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/mlaify/attackmap-analyzer-c"
+Repository = "https://github.com/mlaify/attackmap-analyzer-c"
+Issues = "https://github.com/mlaify/attackmap-analyzer-c/issues"
+Changelog = "https://github.com/mlaify/attackmap-analyzer-c/blob/main/CHANGELOG.md"
+"AttackMap core" = "https://github.com/mlaify/AttackMap"
+
+[project.entry-points."attackmap.analyzers"]
+c = "attackmap_analyzer_c:CAnalyzer"
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

attackmap_analyzer_c-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

attackmap_analyzer_c-0.1.0/src/attackmap_analyzer_c/__init__.py

@@ -0,0 +1,3 @@
+from .analyzer import CAnalyzer
+
+__all__ = ["CAnalyzer"]

attackmap_analyzer_c-0.1.0/src/attackmap_analyzer_c/analyzer.py

@@ -0,0 +1,386 @@
+"""C ecosystem analyzer for AttackMap.
+
+Coverage (v0.1):
+- Web frameworks: civetweb (mg_set_request_handler routes), libmicrohttpd
+  (MHD_start_daemon entrypoint), mongoose (mg_http_listen entrypoint +
+  mg_http_match_uri pseudo-routes), libonion (onion_url_add routes)
+- HTTP clients (external calls): libcurl (CURLOPT_URL string literals)
+- Databases: sqlite3 (sqlite3_open*), libpq (PQconnectdb*), MySQL/MariaDB C
+  client (mysql_real_connect), hiredis (redisConnect*), MongoDB C driver
+  (mongoc_client_new)
+- Auth/crypto: OpenSSL (broad framework hint via EVP_/SSL_/RSA_), mbedTLS,
+  libsodium (crypto_pwhash, crypto_secretbox), Argon2 reference impl,
+  bcrypt-c, scrypt
+- Secrets: getenv / secure_getenv / getenv_s with secret-shaped names
+- Service hints: project name from CMakeLists.txt
+
+C is more fragmented than other ecosystems — there's no single dominant
+HTTP framework, and routing patterns vary widely. We capture what regex
+can reach reliably and conservatively confidence-tag pattern hits.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from .contracts import (
+    AnalyzerMetadata,
+    AuthHint,
+    DatabaseHint,
+    EntrypointHint,
+    ExternalCall,
+    FrameworkHint,
+    Route,
+    ScanResult,
+    SecretHint,
+    ServiceHint,
+)
+
+CODE_SUFFIXES = {".c", ".h"}
+SKIP_DIRS = {
+    "build",
+    ".git",
+    "_deps",
+    "third_party",
+    "vendor",
+    "external",
+    ".cache",
+    "out",
+    "node_modules",
+}
+_SNIPPET_MAX_CHARS = 160
+
+
+# ---------- Patterns ----------
+
+# civetweb: mg_set_request_handler(ctx, "/path", handler, NULL)
+CIVETWEB_ROUTE_PATTERN = re.compile(
+    r'\bmg_set_request_handler\s*\(\s*\w+\s*,\s*"([^"]+)"',
+)
+
+# mongoose: mg_http_match_uri(hm, "/path") inside an event handler — pseudo-routes
+MONGOOSE_MATCH_URI_PATTERN = re.compile(
+    r'\bmg_http_match_uri\s*\(\s*\w+\s*,\s*"([^"]+)"',
+)
+
+# libonion: onion_url_add(url, "^/path/?$", handler, ...)
+ONION_ROUTE_PATTERN = re.compile(
+    r'\bonion_url_add(?:_static|_with_data)?\s*\(\s*\w+\s*,\s*"([^"]+)"',
+)
+
+# libcurl: curl_easy_setopt(handle, CURLOPT_URL, "https://...")
+LIBCURL_URL_PATTERN = re.compile(
+    r'\bcurl_easy_setopt\s*\(\s*\w+\s*,\s*CURLOPT_URL\s*,\s*"(https?://[^"]+)"',
+)
+
+# DBs
+DB_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    (re.compile(r'\bsqlite3_open(?:_v2)?\s*\('), "sqlite"),
+    (re.compile(r'\bPQconnectdb(?:Params)?\s*\(|\bPQsetdbLogin\s*\('), "postgresql"),
+    (re.compile(r'\bmysql_real_connect\s*\(|\bmariadb_real_connect\s*\('), "mysql"),
+    (re.compile(r'\bredisConnect(?:WithTimeout)?\s*\('), "redis"),
+    (re.compile(r'\bmongoc_client_new\s*\(|\bmongoc_uri_new\s*\('), "mongodb"),
+]
+
+# Auth / crypto
+AUTH_PATTERNS: list[tuple[re.Pattern[str], str, float]] = [
+    (re.compile(r'\bcrypto_pwhash(?:_argon2(?:i|id))?\s*\(|\bcrypto_pwhash_str\s*\('), "argon2", 0.9),
+    (re.compile(r'\bargon2(?:i|d|id)?_hash\w*\s*\('), "argon2", 0.9),
+    (re.compile(r'\bbcrypt(?:_hashpw|_checkpw|_gensalt)?\s*\('), "bcrypt", 0.9),
+    (re.compile(r'\bscrypt(?:_kdf)?\s*\('), "scrypt", 0.9),
+    (re.compile(r'\bcrypto_secretbox\w*\s*\(|\bcrypto_aead_(?:chacha20poly1305|aes256gcm)\w*\s*\('), "libsodium_aead", 0.85),
+    (re.compile(r'\bSSL_CTX_new\s*\(|\bSSL_new\s*\(|\bTLS_method\s*\(|\bTLS_(?:client|server)_method\s*\('), "openssl_tls", 0.85),
+    (re.compile(r'\bEVP_PKEY_new\s*\(|\bEVP_(?:Encrypt|Decrypt)Init\w*\s*\('), "openssl_evp", 0.8),
+    (re.compile(r'\bRAND_bytes\s*\(|\bRAND_priv_bytes\s*\('), "openssl_rand", 0.8),
+    (re.compile(r'\bmbedtls_(?:ssl|x509)_\w+\s*\('), "mbedtls", 0.85),
+    (re.compile(r'\bjwt_(?:encode|decode|new|verify)\s*\('), "jwt", 0.85),
+    (re.compile(r'\bAuthorization\b'), "authorization_header", 0.6),
+    (re.compile(r'\bBearer\b'), "bearer_token", 0.6),
+    (re.compile(r'\bapi[_-]?key\b', re.IGNORECASE), "api_key", 0.6),
+]
+
+FRAMEWORK_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    (re.compile(r'\bMHD_start_daemon\s*\(|\bMHD_create_response\w*\s*\(|#\s*include\s+["<]microhttpd\.h'), "libmicrohttpd"),
+    (re.compile(r'\bmg_start\s*\(|\bmg_set_request_handler\s*\(|#\s*include\s+["<]civetweb\.h'), "civetweb"),
+    (re.compile(r'\bmg_mgr_init\s*\(|\bmg_http_listen\s*\(|#\s*include\s+["<]mongoose\.h'), "mongoose"),
+    (re.compile(r'\bonion_new\s*\(|\bonion_listen\s*\(|#\s*include\s+["<]onion/onion\.h'), "libonion"),
+    (re.compile(r'#\s*include\s+["<]openssl/'), "openssl"),
+    (re.compile(r'#\s*include\s+["<]mbedtls/'), "mbedtls"),
+    (re.compile(r'#\s*include\s+["<]sodium\.h'), "libsodium"),
+    (re.compile(r'#\s*include\s+["<]curl/curl\.h'), "libcurl"),
+    (re.compile(r'#\s*include\s+["<]sqlite3\.h'), "sqlite3"),
+    (re.compile(r'#\s*include\s+["<]libpq-fe\.h'), "libpq"),
+    (re.compile(r'#\s*include\s+["<]hiredis/hiredis\.h'), "hiredis"),
+    (re.compile(r'#\s*include\s+["<]mongoc/mongoc\.h|#\s*include\s+["<]mongoc\.h'), "mongoc"),
+]
+
+ENTRYPOINT_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    (re.compile(r'\bMHD_start_daemon\s*\('), "mhd_start_daemon"),
+    (re.compile(r'\bmg_start\s*\('), "civetweb_start"),
+    (re.compile(r'\bmg_http_listen\s*\('), "mongoose_http_listen"),
+    (re.compile(r'\bonion_listen\s*\('), "onion_listen"),
+    (re.compile(r'\baccept\s*\(\s*\w+\s*,\s*\(struct\s+sockaddr\s*\*\)'), "raw_socket_accept"),
+]
+
+# Secrets via getenv / secure_getenv / getenv_s
+SECRET_PATTERNS: list[re.Pattern[str]] = [
+    re.compile(
+        r'\b(?:secure_)?getenv\s*\(\s*"([A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|PASS|PWD)[A-Z0-9_]*)"',
+    ),
+    re.compile(
+        r'\bgetenv_s\s*\([^,]*,\s*[^,]*,\s*"([A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|PASS|PWD)[A-Z0-9_]*)"',
+    ),
+]
+
+
+def _line_of(content: str, offset: int) -> int:
+    if offset <= 0:
+        return 1
+    return content.count("\n", 0, offset) + 1
+
+
+def _line_snippet(content: str, offset: int, *, max_chars: int = _SNIPPET_MAX_CHARS) -> str:
+    line_start = content.rfind("\n", 0, offset) + 1
+    line_end = content.find("\n", offset)
+    if line_end == -1:
+        line_end = len(content)
+    line = content[line_start:line_end].strip()
+    if len(line) > max_chars:
+        line = line[: max_chars - 1] + "…"
+    return line
+
+
+def _project_name_from_cmake(cmake_path: Path) -> str | None:
+    if not cmake_path.exists():
+        return None
+    try:
+        text = cmake_path.read_text(encoding="utf-8")
+    except UnicodeDecodeError:
+        return None
+    match = re.search(r"\bproject\s*\(\s*([A-Za-z0-9_\-]+)", text)
+    if match:
+        return match.group(1)
+    return None
+
+
+class CAnalyzer:
+    metadata = AnalyzerMetadata(
+        name="c",
+        display_name="C Analyzer",
+        version="0.1.0",
+        description="C ecosystem analyzer covering libmicrohttpd, civetweb, mongoose, libonion, libcurl, OpenSSL, libsodium, sqlite3, libpq, mysql, hiredis, mongoc.",
+        scope="C source trees and CMake/Make projects. Detects HTTP server entrypoints, libcurl outbound calls, common DB and crypto libraries.",
+        targets=["c", "civetweb", "libmicrohttpd", "mongoose"],
+        languages=["c"],
+        priority=20,
+        experimental=True,  # C ecosystem coverage is heuristic and partial; mark experimental.
+        enabled_by_default=True,
+    )
+
+    @property
+    def name(self) -> str:
+        return self.metadata.name
+
+    # ---------- Public entry points ----------
+
+    def detect(self, repo_path: str | Path) -> bool:
+        root = Path(repo_path).resolve()
+        if not root.exists() or not root.is_dir():
+            return False
+        for path in root.rglob("*"):
+            if any(part in SKIP_DIRS for part in path.parts):
+                continue
+            if not path.is_file():
+                continue
+            if path.suffix in CODE_SUFFIXES:
+                return True
+            if path.name in {"CMakeLists.txt", "Makefile"}:
+                # Disambiguate: a CMake project may be C++ rather than C. Only return True
+                # when there's at least one .c file alongside it; otherwise let the C++
+                # analyzer claim the repo.
+                for sibling in path.parent.rglob("*.c"):
+                    if any(part in SKIP_DIRS for part in sibling.parts):
+                        continue
+                    return True
+        return False
+
+    def analyze(self, repo_path: str | Path) -> ScanResult:
+        root = Path(repo_path).resolve()
+        result = ScanResult(root=str(root))
+        if not root.exists() or not root.is_dir():
+            return result
+
+        for cmake in root.rglob("CMakeLists.txt"):
+            if any(part in SKIP_DIRS for part in cmake.parts):
+                continue
+            project = _project_name_from_cmake(cmake)
+            if project:
+                self._append_unique_service(result, f"project:{project}", str(cmake.relative_to(root)))
+
+        for file_path in root.rglob("*"):
+            if not file_path.is_file():
+                continue
+            if any(part in SKIP_DIRS for part in file_path.parts):
+                continue
+            if file_path.suffix not in CODE_SUFFIXES:
+                continue
+
+            result.files_scanned += 1
+            if "c" not in result.languages:
+                result.languages.append("c")
+
+            try:
+                content = file_path.read_text(encoding="utf-8")
+            except UnicodeDecodeError:
+                continue
+
+            relative = str(file_path.relative_to(root))
+            self._extract_routes(content, relative, result)
+            self._extract_databases(content, relative, result)
+            self._extract_auth(content, relative, result)
+            self._extract_secrets(content, relative, result)
+            self._extract_external_calls(content, relative, result)
+            self._extract_frameworks(content, relative, result)
+            self._extract_entrypoints(content, relative, result)
+
+        result.languages.sort()
+        return result
+
+    # ---------- Extractors ----------
+
+    def _extract_routes(self, content: str, relative: str, result: ScanResult) -> None:
+        for match in CIVETWEB_ROUTE_PATTERN.finditer(content):
+            path = match.group(1)
+            self._append_unique_route(result, path, "ANY", relative, _line_of(content, match.start()))
+        for match in MONGOOSE_MATCH_URI_PATTERN.finditer(content):
+            path = match.group(1)
+            self._append_unique_route(result, path, "ANY", relative, _line_of(content, match.start()))
+        for match in ONION_ROUTE_PATTERN.finditer(content):
+            path = match.group(1)
+            self._append_unique_route(result, path, "ANY", relative, _line_of(content, match.start()))
+
+    def _extract_databases(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, kind in DB_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_database(
+                result, kind, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+            )
+
+    def _extract_auth(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, hint, confidence in AUTH_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_auth(
+                result, hint, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+                confidence,
+            )
+
+    def _extract_secrets(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern in SECRET_PATTERNS:
+            for match in pattern.finditer(content):
+                name = match.group(1)
+                self._append_unique_secret(
+                    result, name, relative,
+                    _line_of(content, match.start()),
+                    _line_snippet(content, match.start()),
+                )
+
+    def _extract_external_calls(self, content: str, relative: str, result: ScanResult) -> None:
+        for match in LIBCURL_URL_PATTERN.finditer(content):
+            target = match.group(1)
+            self._append_unique_external(
+                result, target, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+            )
+
+    def _extract_frameworks(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, name in FRAMEWORK_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_framework(
+                result, name, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+            )
+
+    def _extract_entrypoints(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, hint in ENTRYPOINT_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_entrypoint(
+                result, hint, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+            )
+
+    # ---------- Append helpers ----------
+
+    @staticmethod
+    def _append_unique_route(result: ScanResult, path: str, method: str, file: str, line: int | None) -> None:
+        key = (path, method, file)
+        if any((item.path, item.method, item.file) == key for item in result.routes):
+            return
+        result.routes.append(Route(path=path, method=method, file=file, line=line))
+
+    @staticmethod
+    def _append_unique_database(result: ScanResult, kind: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (kind, file)
+        if any((item.kind, item.file) == key for item in result.databases):
+            return
+        result.databases.append(DatabaseHint(kind=kind, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_auth(result: ScanResult, hint: str, file: str, line: int | None, evidence: str | None, confidence: float) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.auth_hints):
+            return
+        result.auth_hints.append(AuthHint(hint=hint, file=file, line=line, evidence_text=evidence, confidence=confidence))
+
+    @staticmethod
+    def _append_unique_secret(result: ScanResult, name: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (name, file)
+        if any((item.name, item.file) == key for item in result.secret_hints):
+            return
+        result.secret_hints.append(SecretHint(name=name, file=file, line=line, evidence_text=evidence, confidence=0.85))
+
+    @staticmethod
+    def _append_unique_external(result: ScanResult, target: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (target, file)
+        if any((item.target, item.file) == key for item in result.external_calls):
+            return
+        result.external_calls.append(ExternalCall(target=target, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_framework(result: ScanResult, hint: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.framework_hints):
+            return
+        result.framework_hints.append(FrameworkHint(hint=hint, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_entrypoint(result: ScanResult, hint: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.entrypoint_hints):
+            return
+        result.entrypoint_hints.append(EntrypointHint(hint=hint, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_service(result: ScanResult, hint: str, file: str) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.service_hints):
+            return
+        result.service_hints.append(ServiceHint(hint=hint, file=file))
+
+
+__all__ = ["CAnalyzer"]

attackmap_analyzer_c-0.1.0/src/attackmap_analyzer_c/contracts.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+from attackmap.sdk.contracts import AnalyzerMetadata, AnalyzerProtocol
+from attackmap.sdk.models import (
+    AuthHint,
+    DatabaseHint,
+    EntrypointHint,
+    ExternalCall,
+    FrameworkHint,
+    Route,
+    ScanResult,
+    SecretHint,
+    ServiceHint,
+)
+
+AttackMapAnalyzerProtocol = AnalyzerProtocol
+
+__all__ = [
+    "AnalyzerMetadata",
+    "AttackMapAnalyzerProtocol",
+    "Route",
+    "ExternalCall",
+    "DatabaseHint",
+    "AuthHint",
+    "EntrypointHint",
+    "FrameworkHint",
+    "ServiceHint",
+    "SecretHint",
+    "ScanResult",
+]

attackmap_analyzer_c-0.1.0/src/attackmap_analyzer_c.egg-info/PKG-INFO

@@ -0,0 +1,89 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-c
+Version: 0.1.0
+Summary: C ecosystem analyzer plugin for AttackMap (libmicrohttpd, civetweb, mongoose; libcurl; OpenSSL/mbedTLS/libsodium; sqlite3/libpq/mysql/hiredis/mongoc).
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-c
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-c
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-c/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-c/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.1.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-c
+
+C ecosystem analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+C is more fragmented than language-specific ecosystems — there's no dominant web framework, and routing patterns vary widely. This analyzer captures what regex can reach reliably from common third-party libraries.
+
+- **Web frameworks** — civetweb (`mg_set_request_handler` extracts routes), libmicrohttpd (`MHD_start_daemon` entrypoint), mongoose (`mg_http_listen` entrypoint + `mg_http_match_uri` pseudo-routes), libonion (`onion_url_add` routes)
+- **HTTP clients (external calls)** — libcurl (`curl_easy_setopt(handle, CURLOPT_URL, "...")` URL string literals)
+- **Databases** — sqlite3 (`sqlite3_open*`), libpq (`PQconnectdb*`, `PQsetdbLogin`), MySQL/MariaDB C client (`mysql_real_connect`, `mariadb_real_connect`), hiredis (`redisConnect*`), MongoDB C driver (`mongoc_client_new`)
+- **Auth/crypto** — OpenSSL (TLS context, EVP cipher, RAND), mbedTLS (SSL/X.509), libsodium (`crypto_pwhash`, `crypto_secretbox`, `crypto_aead_*`), Argon2 reference impl (`argon2id_hash_*`), bcrypt-c, scrypt, JWT C libraries (`jwt_encode`, `jwt_decode`)
+- **Secrets** — `getenv`, `secure_getenv`, `getenv_s` with secret-shaped names (`*SECRET*`, `*TOKEN*`, `*KEY*`, `*PASSWORD*`, `*PASS*`, `*PWD*`)
+- **Service hints** — project name from `CMakeLists.txt` (`project(NAME ...)`)
+
+All emissions populate AttackMap's Signal v2 fields (line numbers + evidence snippets + confidence) so downstream insights can cite `path/to/file.c:NN`.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-c.git
+```
+
+The analyzer is auto-discovered by AttackMap via the `attackmap.analyzers` entry-point group.
+
+## Usage with AttackMap
+
+```bash
+# Auto-discovered when installed:
+attackmap analyze /path/to/c/repo
+
+# Or invoke explicitly:
+attackmap analyze /path/to/c/repo --module c
+```
+
+## Detection
+
+`detect()` returns true when any `.c` or `.h` file is present in the tree, ignoring `build/`, `.git/`, `_deps/`, `third_party/`, `vendor/`, `external/`, `.cache/`, `out/`, and `node_modules/`. A `CMakeLists.txt` alongside `.cpp` files (and no `.c` files) is **not** claimed by this analyzer — that's the C++ analyzer's territory.
+
+## Coverage notes
+
+- **Marked experimental**: regex-based extraction in C has more false positives than language-with-strict-imports analyzers. Keep the confidence-tier model in mind when consuming output (0.6 keyword sweeps vs. 0.85+ canonical function-name hits).
+- **Routes**: civetweb / mongoose / libonion all expose path strings explicitly in their routing API; libmicrohttpd does not (single-callback dispatch on `url`). For libmicrohttpd, only the entrypoint is captured — per-route URLs would need to be regexed out of `if (strcmp(url, "/x") == 0)` patterns inside the answer-callback.
+- **HTTP method on routes**: the C web frameworks covered here don't statically declare HTTP methods at registration time (handlers branch on method internally), so all routes are emitted with method `ANY`.
+- **OpenSSL EVP / RAND** signals are confidence 0.8 — they're broad indicators of crypto usage but not strong defensive signals on their own.
+- **Authorization / Bearer / api_key keyword matches** are tier-0.6 (low confidence). They're useful as supporting evidence for an auth posture, not as load-bearing.
+- **Hardcoded `#define JWT_SECRET "abc..."` macros** are not extracted — too noisy. `getenv("JWT_SECRET")` is the canonical pattern we rely on.
+
+## License
+
+MIT

attackmap_analyzer_c-0.1.0/src/attackmap_analyzer_c.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+src/attackmap_analyzer_c/__init__.py
+src/attackmap_analyzer_c/analyzer.py
+src/attackmap_analyzer_c/contracts.py
+src/attackmap_analyzer_c.egg-info/PKG-INFO
+src/attackmap_analyzer_c.egg-info/SOURCES.txt
+src/attackmap_analyzer_c.egg-info/dependency_links.txt
+src/attackmap_analyzer_c.egg-info/entry_points.txt
+src/attackmap_analyzer_c.egg-info/requires.txt
+src/attackmap_analyzer_c.egg-info/top_level.txt
+tests/test_c_analyzer.py

attackmap_analyzer_c-0.1.0/src/attackmap_analyzer_c.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

attackmap_analyzer_c-0.1.0/src/attackmap_analyzer_c.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[attackmap.analyzers]
+c = attackmap_analyzer_c:CAnalyzer

attackmap_analyzer_c-0.1.0/src/attackmap_analyzer_c.egg-info/requires.txt

@@ -0,0 +1,9 @@
+pydantic>=2.7.0
+
+[core]
+attackmap>=0.1.0
+
+[dev]
+pytest>=8.0.0
+build>=1.2.0
+attackmap>=0.1.0

attackmap_analyzer_c-0.1.0/src/attackmap_analyzer_c.egg-info/top_level.txt

@@ -0,0 +1 @@
+attackmap_analyzer_c

attackmap_analyzer_c-0.1.0/tests/test_c_analyzer.py

@@ -0,0 +1,389 @@
+"""Tests for the CAnalyzer plugin."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from attackmap_analyzer_c import CAnalyzer
+
+
+# ---------- detect() ----------
+
+
+def test_detect_picks_up_c_file(tmp_path: Path) -> None:
+    (tmp_path / "main.c").write_text("int main(void) { return 0; }\n", encoding="utf-8")
+    assert CAnalyzer().detect(tmp_path) is True
+
+
+def test_detect_picks_up_header_file(tmp_path: Path) -> None:
+    (tmp_path / "api.h").write_text("#pragma once\nint foo(void);\n", encoding="utf-8")
+    assert CAnalyzer().detect(tmp_path) is True
+
+
+def test_detect_skips_build_dir(tmp_path: Path) -> None:
+    (tmp_path / "build").mkdir()
+    (tmp_path / "build" / "stale.c").write_text("int main() { return 0; }\n", encoding="utf-8")
+    assert CAnalyzer().detect(tmp_path) is False
+
+
+def test_detect_returns_false_for_empty(tmp_path: Path) -> None:
+    assert CAnalyzer().detect(tmp_path) is False
+
+
+def test_detect_cmake_only_without_c_files_does_not_claim(tmp_path: Path) -> None:
+    """A CMakeLists.txt next to .cpp files belongs to the C++ analyzer, not C."""
+    (tmp_path / "CMakeLists.txt").write_text("project(demo)\n", encoding="utf-8")
+    (tmp_path / "main.cpp").write_text("int main() {}\n", encoding="utf-8")
+    assert CAnalyzer().detect(tmp_path) is False
+
+
+# ---------- Routes ----------
+
+
+def test_civetweb_set_request_handler(tmp_path: Path) -> None:
+    (tmp_path / "app.c").write_text(
+        '#include <civetweb.h>\n'
+        '\n'
+        'int main(void) {\n'
+        '    struct mg_context *ctx = mg_start(NULL, NULL, NULL);\n'
+        '    mg_set_request_handler(ctx, "/api/users", users_handler, NULL);\n'
+        '    mg_set_request_handler(ctx, "/health", health_handler, NULL);\n'
+        '    return 0;\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    paths = {r.path for r in result.routes}
+    assert "/api/users" in paths
+    assert "/health" in paths
+
+    users = next(r for r in result.routes if r.path == "/api/users")
+    assert users.line == 5
+
+
+def test_mongoose_match_uri_emits_pseudo_routes(tmp_path: Path) -> None:
+    (tmp_path / "handler.c").write_text(
+        '#include <mongoose.h>\n'
+        '\n'
+        'static void handler(struct mg_connection *c, int ev, void *ev_data) {\n'
+        '    if (ev == MG_EV_HTTP_MSG) {\n'
+        '        struct mg_http_message *hm = (struct mg_http_message *)ev_data;\n'
+        '        if (mg_http_match_uri(hm, "/api/login")) {\n'
+        '            login(c, hm);\n'
+        '        } else if (mg_http_match_uri(hm, "/admin/*")) {\n'
+        '            admin(c, hm);\n'
+        '        }\n'
+        '    }\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    paths = {r.path for r in result.routes}
+    assert "/api/login" in paths
+    assert "/admin/*" in paths
+
+
+def test_libonion_url_add(tmp_path: Path) -> None:
+    (tmp_path / "app.c").write_text(
+        '#include <onion/onion.h>\n'
+        '\n'
+        'void setup(onion_url *url) {\n'
+        '    onion_url_add(url, "^/users/?$", users_handler);\n'
+        '    onion_url_add_static(url, "^/static/", "./public", 0);\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    paths = {r.path for r in result.routes}
+    assert "^/users/?$" in paths
+    assert "^/static/" in paths
+
+
+# ---------- HTTP clients ----------
+
+
+def test_libcurl_url_extracted(tmp_path: Path) -> None:
+    (tmp_path / "client.c").write_text(
+        '#include <curl/curl.h>\n'
+        '\n'
+        'int fetch(void) {\n'
+        '    CURL *curl = curl_easy_init();\n'
+        '    curl_easy_setopt(curl, CURLOPT_URL, "https://api.stripe.com/v1/charges");\n'
+        '    return curl_easy_perform(curl);\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    targets = {e.target for e in result.external_calls}
+    assert "https://api.stripe.com/v1/charges" in targets
+
+
+def test_curlopt_url_with_non_url_string_skipped(tmp_path: Path) -> None:
+    (tmp_path / "client.c").write_text(
+        'curl_easy_setopt(curl, CURLOPT_URL, "/local/path");\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    assert result.external_calls == []
+
+
+# ---------- Databases ----------
+
+
+def test_sqlite_open(tmp_path: Path) -> None:
+    (tmp_path / "db.c").write_text(
+        '#include <sqlite3.h>\n'
+        '\n'
+        'sqlite3 *open_db(void) {\n'
+        '    sqlite3 *db;\n'
+        '    sqlite3_open("data.db", &db);\n'
+        '    return db;\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    assert any(d.kind == "sqlite" for d in result.databases)
+
+
+def test_libpq_connect(tmp_path: Path) -> None:
+    (tmp_path / "pg.c").write_text(
+        '#include <libpq-fe.h>\n'
+        'PGconn *connect_db(void) {\n'
+        '    return PQconnectdb("host=localhost dbname=app");\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    assert any(d.kind == "postgresql" for d in result.databases)
+
+
+def test_mysql_and_redis_distinct_kinds(tmp_path: Path) -> None:
+    (tmp_path / "mysql.c").write_text(
+        'MYSQL *m = mysql_init(NULL);\n'
+        'mysql_real_connect(m, "host", "user", "pass", "db", 3306, NULL, 0);\n',
+        encoding="utf-8",
+    )
+    (tmp_path / "redis.c").write_text(
+        '#include <hiredis/hiredis.h>\n'
+        'redisContext *c = redisConnect("127.0.0.1", 6379);\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    kinds = {d.kind for d in result.databases}
+    assert "mysql" in kinds
+    assert "redis" in kinds
+
+
+def test_mongoc_emits_mongodb(tmp_path: Path) -> None:
+    (tmp_path / "mongo.c").write_text(
+        '#include <mongoc/mongoc.h>\n'
+        'int main(void) {\n'
+        '    mongoc_client_t *client = mongoc_client_new("mongodb://x");\n'
+        '    return 0;\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    assert any(d.kind == "mongodb" for d in result.databases)
+
+
+# ---------- Auth / crypto ----------
+
+
+def test_libsodium_pwhash_emits_argon2_hint(tmp_path: Path) -> None:
+    (tmp_path / "auth.c").write_text(
+        '#include <sodium.h>\n'
+        'int hash(const char *pw, char *out) {\n'
+        '    return crypto_pwhash_str(out, pw, strlen(pw),\n'
+        '        crypto_pwhash_OPSLIMIT_INTERACTIVE,\n'
+        '        crypto_pwhash_MEMLIMIT_INTERACTIVE);\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    by_hint = {h.hint: h for h in result.auth_hints}
+    assert "argon2" in by_hint
+    assert by_hint["argon2"].confidence == 0.9
+
+
+def test_argon2_reference_impl_emits_hint(tmp_path: Path) -> None:
+    (tmp_path / "auth.c").write_text(
+        '#include "argon2.h"\n'
+        'int verify(const char *pw, const char *encoded) {\n'
+        '    return argon2id_hash_encoded(2, 1<<16, 1, pw, strlen(pw), salt, 16, 32, encoded, sizeof(encoded));\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    assert any(h.hint == "argon2" for h in result.auth_hints)
+
+
+def test_openssl_tls_setup_emits_hint(tmp_path: Path) -> None:
+    (tmp_path / "tls.c").write_text(
+        '#include <openssl/ssl.h>\n'
+        'SSL_CTX *create(void) {\n'
+        '    return SSL_CTX_new(TLS_server_method());\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    assert any(h.hint == "openssl_tls" for h in result.auth_hints)
+
+
+# ---------- Secrets ----------
+
+
+def test_getenv_secrets(tmp_path: Path) -> None:
+    (tmp_path / "config.c").write_text(
+        '#include <stdlib.h>\n'
+        'int main(void) {\n'
+        '    const char *jwt = getenv("JWT_SECRET");\n'
+        '    const char *db = getenv("DATABASE_PASSWORD");\n'
+        '    const char *api = secure_getenv("STRIPE_API_KEY");\n'
+        '    return 0;\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    names = {s.name for s in result.secret_hints}
+    assert "JWT_SECRET" in names
+    assert "DATABASE_PASSWORD" in names
+    assert "STRIPE_API_KEY" in names
+
+    jwt = next(s for s in result.secret_hints if s.name == "JWT_SECRET")
+    assert jwt.line == 3
+
+
+def test_getenv_with_non_secret_name_skipped(tmp_path: Path) -> None:
+    (tmp_path / "config.c").write_text(
+        '#include <stdlib.h>\n'
+        'int main(void) {\n'
+        '    const char *home = getenv("HOME");\n'
+        '    const char *path = getenv("PATH");\n'
+        '    return 0;\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    assert result.secret_hints == []
+
+
+# ---------- Frameworks + entrypoints ----------
+
+
+def test_libmicrohttpd_framework_and_entrypoint(tmp_path: Path) -> None:
+    (tmp_path / "main.c").write_text(
+        '#include <microhttpd.h>\n'
+        '\n'
+        'int main(void) {\n'
+        '    struct MHD_Daemon *d = MHD_start_daemon(\n'
+        '        MHD_USE_THREAD_PER_CONNECTION, 8888, NULL, NULL, &handler, NULL,\n'
+        '        MHD_OPTION_END);\n'
+        '    return d ? 0 : 1;\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    fw = {f.hint for f in result.framework_hints}
+    assert "libmicrohttpd" in fw
+    ep = {e.hint for e in result.entrypoint_hints}
+    assert "mhd_start_daemon" in ep
+
+
+def test_civetweb_framework_and_entrypoint(tmp_path: Path) -> None:
+    (tmp_path / "main.c").write_text(
+        '#include <civetweb.h>\n'
+        'int main(void) {\n'
+        '    struct mg_context *ctx = mg_start(NULL, NULL, NULL);\n'
+        '    return ctx ? 0 : 1;\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    fw = {f.hint for f in result.framework_hints}
+    assert "civetweb" in fw
+    ep = {e.hint for e in result.entrypoint_hints}
+    assert "civetweb_start" in ep
+
+
+def test_mongoose_framework_and_listen(tmp_path: Path) -> None:
+    (tmp_path / "main.c").write_text(
+        '#include <mongoose.h>\n'
+        'int main(void) {\n'
+        '    struct mg_mgr mgr;\n'
+        '    mg_mgr_init(&mgr);\n'
+        '    mg_http_listen(&mgr, "http://0.0.0.0:8080", handler, NULL);\n'
+        '    return 0;\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CAnalyzer().analyze(tmp_path)
+    fw = {f.hint for f in result.framework_hints}
+    assert "mongoose" in fw
+    ep = {e.hint for e in result.entrypoint_hints}
+    assert "mongoose_http_listen" in ep
+
+
+# ---------- CMake → service hint ----------
+
+
+def test_cmake_project_name_picked_up(tmp_path: Path) -> None:
+    (tmp_path / "CMakeLists.txt").write_text(
+        'cmake_minimum_required(VERSION 3.10)\n'
+        'project(billing-api LANGUAGES C)\n'
+        'add_executable(billing src/main.c)\n',
+        encoding="utf-8",
+    )
+    (tmp_path / "src").mkdir()
+    (tmp_path / "src" / "main.c").write_text("int main(void) { return 0; }\n", encoding="utf-8")
+    result = CAnalyzer().analyze(tmp_path)
+    assert any(h.hint == "project:billing-api" for h in result.service_hints)
+
+
+# ---------- End-to-end ----------
+
+
+def test_full_civetweb_service_signal_set(tmp_path: Path) -> None:
+    (tmp_path / "CMakeLists.txt").write_text(
+        'project(demo-svc LANGUAGES C)\nadd_executable(demo src/main.c)\n',
+        encoding="utf-8",
+    )
+    src = tmp_path / "src" / "main.c"
+    src.parent.mkdir()
+    src.write_text(
+        '#include <civetweb.h>\n'
+        '#include <curl/curl.h>\n'
+        '#include <sqlite3.h>\n'
+        '#include <openssl/ssl.h>\n'
+        '#include <stdlib.h>\n'
+        '\n'
+        'int main(void) {\n'
+        '    const char *jwt = getenv("JWT_SECRET");\n'
+        '    sqlite3 *db; sqlite3_open("data.db", &db);\n'
+        '    SSL_CTX *ctx = SSL_CTX_new(TLS_server_method());\n'
+        '    CURL *curl = curl_easy_init();\n'
+        '    curl_easy_setopt(curl, CURLOPT_URL, "https://api.example.com/data");\n'
+        '\n'
+        '    struct mg_context *srv = mg_start(NULL, NULL, NULL);\n'
+        '    mg_set_request_handler(srv, "/login", login_handler, NULL);\n'
+        '    mg_set_request_handler(srv, "/admin", admin_handler, NULL);\n'
+        '    return 0;\n'
+        '}\n',
+        encoding="utf-8",
+    )
+
+    result = CAnalyzer().analyze(tmp_path)
+
+    paths = {r.path for r in result.routes}
+    assert "/login" in paths
+    assert "/admin" in paths
+
+    assert any(d.kind == "sqlite" for d in result.databases)
+    assert any(h.hint == "openssl_tls" for h in result.auth_hints)
+    assert any(s.name == "JWT_SECRET" for s in result.secret_hints)
+    assert any(e.target == "https://api.example.com/data" for e in result.external_calls)
+    assert any(f.hint == "civetweb" for f in result.framework_hints)
+    assert any(e.hint == "civetweb_start" for e in result.entrypoint_hints)
+    assert any(h.hint == "project:demo-svc" for h in result.service_hints)