attackmap-analyzer-cpp 0.1.0__tar.gz

attackmap_analyzer_cpp-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_cpp-0.1.0/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-cpp
+Version: 0.1.0
+Summary: C++ ecosystem analyzer plugin for AttackMap (Crow, Pistache, Drogon, cpprestsdk; libcurl/cpr; OpenSSL/Botan/libsodium/Crypto++; libpqxx/mongocxx/redis-plus-plus).
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-cpp
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-cpp
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-cpp/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-cpp/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.1.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-cpp
+
+C++ ecosystem analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This analyzer extracts structured signals from C++ source trees (`.cpp`, `.cc`, `.cxx`, `.hpp`, `.hxx`, `.ipp`, `.tpp`):
+
+- **Web frameworks** — Crow (`CROW_ROUTE` macro with `.methods("POST"_method, ...)` chain), Pistache (`Routes::Get/Post/...`), Drogon (`registerHandler` with explicit method list AND `ADD_METHOD_TO` macro), cpprestsdk / Casablanca (`http_listener("https://...")` URL extraction)
+- **HTTP clients (external calls)** — libcurl (`CURLOPT_URL` literals), cpr (`cpr::Get(cpr::Url{"..."})`, `cpr::Post(...)`), cpprestsdk (`web::http::client::http_client(URL)`)
+- **Databases** — libpqxx (`pqxx::connection`, `pqxx::work`), MySQL X DevAPI (`mysqlx::Session`), mongocxx (`mongocxx::client` + `mongocxx::uri`), redis-plus-plus (`sw::redis::Redis`), SOCI (`soci::session`), sqlite_orm (`sqlite_orm::make_storage`)
+- **Auth/crypto** — OpenSSL (TLS / EVP / RAND), Botan (`TLS::Server`, `Cipher_Mode`, `PKCS5_PBKDF2`, `Scrypt`), libsodium (`crypto_pwhash` → argon2, `crypto_secretbox`, AEAD primitives), Crypto++ (`CryptoPP::AES`, `CryptoPP::SHA256`, `CryptoPP::Argon2`, `CryptoPP::HMAC`), JWT C++ libraries (`jwt::create`, `jwt::decode`, `jwt::verify`)
+- **Secrets** — `std::getenv`, `getenv` with secret-shaped names
+- **Service hints** — project name from `CMakeLists.txt` `project(NAME ...)` declaration
+
+All emissions populate AttackMap's Signal v2 fields (line numbers + evidence snippets + confidence) so downstream insights can cite `path/to/file.cpp:NN`.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-cpp.git
+```
+
+The analyzer is auto-discovered by AttackMap via the `attackmap.analyzers` entry-point group.
+
+## Usage with AttackMap
+
+```bash
+# Auto-discovered when installed:
+attackmap analyze /path/to/cpp/repo
+
+# Or invoke explicitly:
+attackmap analyze /path/to/cpp/repo --module cpp
+```
+
+## Detection
+
+`detect()` returns true when any `.cpp`, `.cc`, `.cxx`, `.hpp`, `.hxx`, `.ipp`, or `.tpp` file is present, ignoring `build/`, `.git/`, `_deps/`, `third_party/`, `vendor/`, `external/`, `.cache/`, `out/`, `Debug/`, `Release/`, and `node_modules/`.
+
+This analyzer **does not** claim `.h` files — those are handled by the C analyzer (`attackmap-analyzer-c`). A repo with only `.c` and `.h` files is not picked up here.
+
+## Coverage notes
+
+- **Marked experimental**: like the C analyzer, regex coverage of C++ has more false-positive risk than language-specific analyzers with strict imports. Confidence tiering is the primary defense (0.9 for hash-class auth primitives, 0.85 for canonical TLS / cipher / JWT API hits, 0.6 for keyword sweeps).
+- **Crow `.methods("X"_method)` chains**: when present, the route emits one Route per method in the chain. When absent, the route emits with method `ANY`.
+- **Drogon `registerHandler` and `ADD_METHOD_TO`**: both shapes are extracted, including the `{Drogon::Get, Drogon::Post}` initializer-list form which produces multiple Routes.
+- **cpprestsdk listener routes**: only the path component of the listener's URL is extracted as a Route. Per-method handlers (`listener.support(methods::GET, ...)`) are not separately emitted — that would require tracking the listener's lifetime.
+- **C++ shares vocabulary with C** (libcurl, OpenSSL, libsodium). Those patterns are duplicated here so a pure-C++ project without the C analyzer installed still gets full coverage. AttackMap's overlay deduplication handles double-firing.
+- **Pure-template / header-only ORM** (sqlite_orm, sqlpp11): only basic detection via headers and `make_storage`; column-level extraction is out of scope.
+
+## License
+
+MIT

attackmap_analyzer_cpp-0.1.0/README.md

@@ -0,0 +1,51 @@
+# attackmap-analyzer-cpp
+
+C++ ecosystem analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This analyzer extracts structured signals from C++ source trees (`.cpp`, `.cc`, `.cxx`, `.hpp`, `.hxx`, `.ipp`, `.tpp`):
+
+- **Web frameworks** — Crow (`CROW_ROUTE` macro with `.methods("POST"_method, ...)` chain), Pistache (`Routes::Get/Post/...`), Drogon (`registerHandler` with explicit method list AND `ADD_METHOD_TO` macro), cpprestsdk / Casablanca (`http_listener("https://...")` URL extraction)
+- **HTTP clients (external calls)** — libcurl (`CURLOPT_URL` literals), cpr (`cpr::Get(cpr::Url{"..."})`, `cpr::Post(...)`), cpprestsdk (`web::http::client::http_client(URL)`)
+- **Databases** — libpqxx (`pqxx::connection`, `pqxx::work`), MySQL X DevAPI (`mysqlx::Session`), mongocxx (`mongocxx::client` + `mongocxx::uri`), redis-plus-plus (`sw::redis::Redis`), SOCI (`soci::session`), sqlite_orm (`sqlite_orm::make_storage`)
+- **Auth/crypto** — OpenSSL (TLS / EVP / RAND), Botan (`TLS::Server`, `Cipher_Mode`, `PKCS5_PBKDF2`, `Scrypt`), libsodium (`crypto_pwhash` → argon2, `crypto_secretbox`, AEAD primitives), Crypto++ (`CryptoPP::AES`, `CryptoPP::SHA256`, `CryptoPP::Argon2`, `CryptoPP::HMAC`), JWT C++ libraries (`jwt::create`, `jwt::decode`, `jwt::verify`)
+- **Secrets** — `std::getenv`, `getenv` with secret-shaped names
+- **Service hints** — project name from `CMakeLists.txt` `project(NAME ...)` declaration
+
+All emissions populate AttackMap's Signal v2 fields (line numbers + evidence snippets + confidence) so downstream insights can cite `path/to/file.cpp:NN`.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-cpp.git
+```
+
+The analyzer is auto-discovered by AttackMap via the `attackmap.analyzers` entry-point group.
+
+## Usage with AttackMap
+
+```bash
+# Auto-discovered when installed:
+attackmap analyze /path/to/cpp/repo
+
+# Or invoke explicitly:
+attackmap analyze /path/to/cpp/repo --module cpp
+```
+
+## Detection
+
+`detect()` returns true when any `.cpp`, `.cc`, `.cxx`, `.hpp`, `.hxx`, `.ipp`, or `.tpp` file is present, ignoring `build/`, `.git/`, `_deps/`, `third_party/`, `vendor/`, `external/`, `.cache/`, `out/`, `Debug/`, `Release/`, and `node_modules/`.
+
+This analyzer **does not** claim `.h` files — those are handled by the C analyzer (`attackmap-analyzer-c`). A repo with only `.c` and `.h` files is not picked up here.
+
+## Coverage notes
+
+- **Marked experimental**: like the C analyzer, regex coverage of C++ has more false-positive risk than language-specific analyzers with strict imports. Confidence tiering is the primary defense (0.9 for hash-class auth primitives, 0.85 for canonical TLS / cipher / JWT API hits, 0.6 for keyword sweeps).
+- **Crow `.methods("X"_method)` chains**: when present, the route emits one Route per method in the chain. When absent, the route emits with method `ANY`.
+- **Drogon `registerHandler` and `ADD_METHOD_TO`**: both shapes are extracted, including the `{Drogon::Get, Drogon::Post}` initializer-list form which produces multiple Routes.
+- **cpprestsdk listener routes**: only the path component of the listener's URL is extracted as a Route. Per-method handlers (`listener.support(methods::GET, ...)`) are not separately emitted — that would require tracking the listener's lifetime.
+- **C++ shares vocabulary with C** (libcurl, OpenSSL, libsodium). Those patterns are duplicated here so a pure-C++ project without the C analyzer installed still gets full coverage. AttackMap's overlay deduplication handles double-firing.
+- **Pure-template / header-only ORM** (sqlite_orm, sqlpp11): only basic detection via headers and `make_storage`; column-level extraction is out of scope.
+
+## License
+
+MIT

attackmap_analyzer_cpp-0.1.0/pyproject.toml

@@ -0,0 +1,74 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "attackmap-analyzer-cpp"
+version = "0.1.0"
+description = "C++ ecosystem analyzer plugin for AttackMap (Crow, Pistache, Drogon, cpprestsdk; libcurl/cpr; OpenSSL/Botan/libsodium/Crypto++; libpqxx/mongocxx/redis-plus-plus)."
+readme = "README.md"
+requires-python = ">=3.11"
+license = {text = "MIT"}
+authors = [
+  {name = "Matthew Davis", email = "matthewd@matthewd.xyz"},
+  {name = "AttackMap Contributors"},
+]
+maintainers = [
+  {name = "Matthew Davis", email = "matthewd@matthewd.xyz"},
+]
+keywords = [
+  "security",
+  "static-analysis",
+  "appsec",
+  "defensive-security",
+  "attackmap",
+  "attackmap-plugin",
+]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "Intended Audience :: Information Technology",
+  "Intended Audience :: System Administrators",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Security",
+  "Topic :: Software Development :: Quality Assurance",
+  "Typing :: Typed",
+]
+dependencies = [
+  "pydantic>=2.7.0",
+]
+
+[project.optional-dependencies]
+core = [
+  "attackmap>=0.1.0",
+]
+dev = [
+  "pytest>=8.0.0",
+  "build>=1.2.0",
+  "attackmap>=0.1.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/mlaify/attackmap-analyzer-cpp"
+Repository = "https://github.com/mlaify/attackmap-analyzer-cpp"
+Issues = "https://github.com/mlaify/attackmap-analyzer-cpp/issues"
+Changelog = "https://github.com/mlaify/attackmap-analyzer-cpp/blob/main/CHANGELOG.md"
+"AttackMap core" = "https://github.com/mlaify/AttackMap"
+
+[project.entry-points."attackmap.analyzers"]
+cpp = "attackmap_analyzer_cpp:CppAnalyzer"
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

attackmap_analyzer_cpp-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

attackmap_analyzer_cpp-0.1.0/src/attackmap_analyzer_cpp/__init__.py

@@ -0,0 +1,3 @@
+from .analyzer import CppAnalyzer
+
+__all__ = ["CppAnalyzer"]

attackmap_analyzer_cpp-0.1.0/src/attackmap_analyzer_cpp/analyzer.py

@@ -0,0 +1,449 @@
+"""C++ ecosystem analyzer for AttackMap.
+
+Coverage (v0.1):
+- Web frameworks: Crow (CROW_ROUTE macro routes), Pistache (Routes::Get/Post/...),
+  Drogon (registerHandler + ADD_METHOD_TO macro), cpprestsdk (http_listener URL +
+  listener.support method handlers)
+- HTTP clients (external calls): libcurl (CURLOPT_URL), cpprestsdk
+  http_client(URL), cpr (cpr::Get/Post/Put/Delete with cpr::Url{...})
+- Databases: libpqxx (pqxx::connection), MySQL X DevAPI (mysqlx::Session),
+  mongocxx (mongocxx::client + mongocxx::uri), redis-plus-plus
+  (sw::redis::Redis), SOCI (soci::session), sqlite_orm (header-only sqlite)
+- Auth/crypto: OpenSSL (TLS / EVP / RAND), Botan (TLS / KDF / cipher),
+  libsodium (crypto_pwhash, crypto_secretbox, AEAD), Crypto++
+  (CryptoPP::AES/SHA256/Argon2), JWT C++ libraries (jwt::create, jwt::decode,
+  jwt::verify)
+- Secrets: getenv / std::getenv with secret-shaped names
+- Service hints: project name from CMakeLists.txt project() declaration
+
+C++ shares much of its data-plane vocabulary with C (libcurl, OpenSSL,
+libsodium) — those patterns are duplicated here so a pure-C++ project
+without the C analyzer installed still gets full coverage. AttackMap's
+overlay deduplication handles cases where both analyzers fire on the
+same evidence.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from .contracts import (
+    AnalyzerMetadata,
+    AuthHint,
+    DatabaseHint,
+    EntrypointHint,
+    ExternalCall,
+    FrameworkHint,
+    Route,
+    ScanResult,
+    SecretHint,
+    ServiceHint,
+)
+
+CODE_SUFFIXES = {".cpp", ".cc", ".cxx", ".hpp", ".hxx", ".ipp", ".tpp"}
+SKIP_DIRS = {
+    "build",
+    ".git",
+    "_deps",
+    "third_party",
+    "vendor",
+    "external",
+    ".cache",
+    "out",
+    "node_modules",
+    "Debug",
+    "Release",
+}
+_SNIPPET_MAX_CHARS = 160
+
+
+# ---------- Patterns ----------
+
+# Crow: CROW_ROUTE(app, "/path") or CROW_ROUTE(app, "/path").methods("POST"_method)
+CROW_ROUTE_PATTERN = re.compile(
+    r'\bCROW_ROUTE\s*\(\s*\w+\s*,\s*"([^"]+)"\s*\)(?P<chain>(?:\s*\.\s*\w+\([^)]*\))*)',
+)
+# Crow .methods("POST"_method, "PUT"_method)
+CROW_METHODS_PATTERN = re.compile(
+    r'\.methods\s*\(\s*((?:"[A-Z]+"_method(?:\s*,\s*)?)+)\s*\)',
+)
+
+# Pistache: Routes::Get(router, "/path", handler), Routes::Post(...)
+PISTACHE_ROUTE_PATTERN = re.compile(
+    r'\b(?:Pistache::)?(?:Rest::)?Routes::(Get|Post|Put|Delete|Patch|Head|Options)\s*\(\s*\w+\s*,\s*"([^"]+)"',
+)
+
+# Drogon: app().registerHandler("/path", handler, {Drogon::Get, Drogon::Post})
+# Handler arg may be a lambda containing commas, so match non-greedy across the
+# middle and anchor on the trailing `{ Drogon::* }` brace.
+DROGON_REGISTER_PATTERN = re.compile(
+    r'\bregisterHandler\s*\(\s*"([^"]+)"\s*,.+?,\s*\{([^}]*)\}\s*\)',
+    re.DOTALL,
+)
+
+# Drogon annotation-style: METHOD_LIST_BEGIN ADD_METHOD_TO(controller::handler, "/path", Get) METHOD_LIST_END
+DROGON_ADD_METHOD_PATTERN = re.compile(
+    r'\bADD_METHOD_TO\s*\(\s*[^,]+,\s*"([^"]+)"\s*,\s*([A-Za-z]+)',
+)
+
+# cpprestsdk: web::http::experimental::listener::http_listener listener("https://example.com/api");
+CPPRESTSDK_LISTENER_PATTERN = re.compile(
+    r'\bhttp_listener\s+\w+\s*\(\s*(?:U\s*\(\s*)?"(https?://[^")]+)"',
+)
+
+# External HTTP calls
+OUTBOUND_PATTERNS: list[re.Pattern[str]] = [
+    re.compile(r'\bcurl_easy_setopt\s*\(\s*\w+\s*,\s*CURLOPT_URL\s*,\s*"(https?://[^"]+)"'),
+    re.compile(r'\bcpr::(?:Get|Post|Put|Delete|Patch|Head)\s*\(\s*cpr::Url\s*\{\s*"(https?://[^"]+)"'),
+    # Permissive http_client(URL) — namespace prefix may be `using`-elided.
+    re.compile(r'\bhttp_client\s+\w+\s*\(\s*(?:U\s*\(\s*)?"(https?://[^")]+)"'),
+    re.compile(r'\bRequest\s+\w+\s*\(\s*"(https?://[^"]+)"'),
+]
+
+# DBs
+DB_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    (re.compile(r'\bpqxx::connection\b|\bpqxx::work\b|#\s*include\s+["<]pqxx/'), "postgresql"),
+    (re.compile(r'\bmysqlx::Session\b|\bmysqlx::SessionSettings\b|#\s*include\s+["<]mysqlx/'), "mysql"),
+    (re.compile(r'\bmongocxx::client\b|\bmongocxx::uri\b|#\s*include\s+["<]mongocxx/'), "mongodb"),
+    (re.compile(r'\bsw::redis::Redis\b|\bsw::redis::RedisCluster\b|#\s*include\s+["<]sw/redis\+\+'), "redis"),
+    (re.compile(r'\bsoci::session\b|\bsoci::statement\b'), "sql"),
+    (re.compile(r'\bsqlite_orm::make_storage\b|\bsqlite3_open(?:_v2)?\s*\('), "sqlite"),
+    (re.compile(r'\bsql::mysql::MySQL_Driver\b|\bMySQL_Connection\b'), "mysql"),
+]
+
+# Auth / crypto
+AUTH_PATTERNS: list[tuple[re.Pattern[str], str, float]] = [
+    (re.compile(r'\bcrypto_pwhash(?:_argon2(?:i|id))?\s*\(|\bcrypto_pwhash_str\s*\('), "argon2", 0.9),
+    (re.compile(r'\bargon2(?:i|d|id)?_hash\w*\s*\(|\bCryptoPP::Argon2\b'), "argon2", 0.9),
+    (re.compile(r'\bbcrypt(?:_hashpw|_checkpw|_gensalt)?\s*\(|\bCryptoPP::BCrypt\b'), "bcrypt", 0.9),
+    (re.compile(r'\bscrypt(?:_kdf)?\s*\(|\bBotan::Scrypt\b|\bCryptoPP::Scrypt\b'), "scrypt", 0.9),
+    (re.compile(r'\bcrypto_secretbox\w*\s*\(|\bcrypto_aead_(?:chacha20poly1305|aes256gcm)\w*\s*\('), "libsodium_aead", 0.85),
+    (re.compile(r'\bSSL_CTX_new\s*\(|\bSSL_new\s*\(|\bTLS_method\s*\(|\bTLS_(?:client|server)_method\s*\('), "openssl_tls", 0.85),
+    (re.compile(r'\bEVP_PKEY_new\s*\(|\bEVP_(?:Encrypt|Decrypt)Init\w*\s*\('), "openssl_evp", 0.8),
+    (re.compile(r'\bBotan::TLS::(?:Server|Client)\b|\bBotan::Cipher_Mode\b|\bBotan::PKCS5_PBKDF2\b'), "botan", 0.85),
+    (re.compile(r'\bjwt::create\s*\(|\bjwt::decode\s*\(|\bjwt::verify\s*\(|#\s*include\s+["<]jwt-cpp/'), "jwt", 0.85),
+    (re.compile(r'\bCryptoPP::AES\b|\bCryptoPP::SHA(?:256|384|512|3)\b|\bCryptoPP::HMAC\b'), "cryptopp", 0.85),
+    (re.compile(r'\bAuthorization\b'), "authorization_header", 0.6),
+    (re.compile(r'\bBearer\b'), "bearer_token", 0.6),
+    (re.compile(r'\bapi[_-]?key\b', re.IGNORECASE), "api_key", 0.6),
+]
+
+FRAMEWORK_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    (re.compile(r'\bcrow::SimpleApp\b|#\s*include\s+["<]crow\.h|\bCROW_ROUTE\s*\('), "crow"),
+    (re.compile(r'\bPistache::(?:Http|Rest)\b|#\s*include\s+["<]pistache/'), "pistache"),
+    (re.compile(r'\bdrogon::HttpAppFramework\b|\bapp\(\)\.registerHandler\b|#\s*include\s+["<]drogon/'), "drogon"),
+    (re.compile(r'\bweb::http::experimental::listener\b|#\s*include\s+["<]cpprest/'), "cpprestsdk"),
+    (re.compile(r'\bboost::beast\b|#\s*include\s+["<]boost/beast'), "boost-beast"),
+    (re.compile(r'\bPoco::Net::HTTPServer\b|#\s*include\s+["<]Poco/Net/'), "poco-net"),
+    (re.compile(r'\boatpp::web::server\b|#\s*include\s+["<]oatpp/'), "oatpp"),
+    (re.compile(r'#\s*include\s+["<]openssl/'), "openssl"),
+    (re.compile(r'#\s*include\s+["<]botan/'), "botan"),
+    (re.compile(r'#\s*include\s+["<]sodium\.h'), "libsodium"),
+    (re.compile(r'#\s*include\s+["<]cryptopp/'), "cryptopp"),
+    (re.compile(r'#\s*include\s+["<]curl/curl\.h|#\s*include\s+["<]cpr/'), "libcurl"),
+    (re.compile(r'#\s*include\s+["<]pqxx/'), "libpqxx"),
+    (re.compile(r'#\s*include\s+["<]mongocxx/'), "mongocxx"),
+    (re.compile(r'#\s*include\s+["<]sw/redis\+\+'), "redis-plus-plus"),
+]
+
+ENTRYPOINT_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    (re.compile(r'\bapp\.(?:port|bindaddr|run|multithreaded)\(.*?\)\.run\s*\(\s*\)', re.DOTALL), "crow_app_run"),
+    (re.compile(r'\bcrow::SimpleApp\b'), "crow_app"),
+    (re.compile(r'\b\w+\.serve\s*\(\s*\)', re.IGNORECASE), "pistache_serve"),
+    (re.compile(r'\bapp\(\)\.run\s*\(\s*\)|\bdrogon::app\(\)\.run\b'), "drogon_run"),
+    (re.compile(r'\blistener\.open\s*\(\s*\)\.wait\s*\(\s*\)|\blistener\.open\s*\(\s*\)\.then\b'), "cpprestsdk_listener_open"),
+    (re.compile(r'\bPoco::Net::HTTPServer\s+\w+'), "poco_http_server"),
+]
+
+# Secrets via getenv / std::getenv
+SECRET_PATTERNS: list[re.Pattern[str]] = [
+    re.compile(
+        r'\b(?:std::)?(?:secure_)?getenv\s*\(\s*"([A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|PASS|PWD)[A-Z0-9_]*)"',
+    ),
+]
+
+
+def _line_of(content: str, offset: int) -> int:
+    if offset <= 0:
+        return 1
+    return content.count("\n", 0, offset) + 1
+
+
+def _line_snippet(content: str, offset: int, *, max_chars: int = _SNIPPET_MAX_CHARS) -> str:
+    line_start = content.rfind("\n", 0, offset) + 1
+    line_end = content.find("\n", offset)
+    if line_end == -1:
+        line_end = len(content)
+    line = content[line_start:line_end].strip()
+    if len(line) > max_chars:
+        line = line[: max_chars - 1] + "…"
+    return line
+
+
+def _project_name_from_cmake(cmake_path: Path) -> str | None:
+    if not cmake_path.exists():
+        return None
+    try:
+        text = cmake_path.read_text(encoding="utf-8")
+    except UnicodeDecodeError:
+        return None
+    match = re.search(r"\bproject\s*\(\s*([A-Za-z0-9_\-]+)", text)
+    if match:
+        return match.group(1)
+    return None
+
+
+class CppAnalyzer:
+    metadata = AnalyzerMetadata(
+        name="cpp",
+        display_name="C++ Analyzer",
+        version="0.1.0",
+        description="C++ analyzer covering Crow, Pistache, Drogon, cpprestsdk, libcurl/cpr, OpenSSL/Botan/libsodium/Crypto++, libpqxx/mongocxx/redis-plus-plus.",
+        scope="C++ source trees and CMake projects. Detects modern HTTP frameworks and common DB / crypto libraries.",
+        targets=["cpp", "c++", "crow", "pistache", "drogon", "cpprestsdk"],
+        languages=["cpp"],
+        priority=20,
+        experimental=True,  # Like the C analyzer; regex coverage of C++ is more leaky than of stricter ecosystems.
+        enabled_by_default=True,
+    )
+
+    @property
+    def name(self) -> str:
+        return self.metadata.name
+
+    # ---------- Public entry points ----------
+
+    def detect(self, repo_path: str | Path) -> bool:
+        root = Path(repo_path).resolve()
+        if not root.exists() or not root.is_dir():
+            return False
+        for path in root.rglob("*"):
+            if any(part in SKIP_DIRS for part in path.parts):
+                continue
+            if not path.is_file():
+                continue
+            if path.suffix in CODE_SUFFIXES:
+                return True
+        return False
+
+    def analyze(self, repo_path: str | Path) -> ScanResult:
+        root = Path(repo_path).resolve()
+        result = ScanResult(root=str(root))
+        if not root.exists() or not root.is_dir():
+            return result
+
+        for cmake in root.rglob("CMakeLists.txt"):
+            if any(part in SKIP_DIRS for part in cmake.parts):
+                continue
+            project = _project_name_from_cmake(cmake)
+            if project:
+                self._append_unique_service(result, f"project:{project}", str(cmake.relative_to(root)))
+
+        for file_path in root.rglob("*"):
+            if not file_path.is_file():
+                continue
+            if any(part in SKIP_DIRS for part in file_path.parts):
+                continue
+            if file_path.suffix not in CODE_SUFFIXES:
+                continue
+
+            result.files_scanned += 1
+            if "cpp" not in result.languages:
+                result.languages.append("cpp")
+
+            try:
+                content = file_path.read_text(encoding="utf-8")
+            except UnicodeDecodeError:
+                continue
+
+            relative = str(file_path.relative_to(root))
+            self._extract_routes(content, relative, result)
+            self._extract_databases(content, relative, result)
+            self._extract_auth(content, relative, result)
+            self._extract_secrets(content, relative, result)
+            self._extract_external_calls(content, relative, result)
+            self._extract_frameworks(content, relative, result)
+            self._extract_entrypoints(content, relative, result)
+
+        result.languages.sort()
+        return result
+
+    # ---------- Extractors ----------
+
+    def _extract_routes(self, content: str, relative: str, result: ScanResult) -> None:
+        # Crow: CROW_ROUTE(app, "/x").methods("POST"_method, "PUT"_method)
+        for match in CROW_ROUTE_PATTERN.finditer(content):
+            path = match.group(1)
+            chain = match.group("chain") or ""
+            line = _line_of(content, match.start())
+            methods: set[str] = set()
+            methods_match = CROW_METHODS_PATTERN.search(chain)
+            if methods_match:
+                methods = {m.upper() for m in re.findall(r'"([A-Z]+)"_method', methods_match.group(1))}
+            if not methods:
+                methods = {"ANY"}
+            for method in sorted(methods):
+                self._append_unique_route(result, path, method, relative, line)
+
+        # Pistache: Routes::Get(router, "/x", handler)
+        for match in PISTACHE_ROUTE_PATTERN.finditer(content):
+            method, path = match.group(1).upper(), match.group(2)
+            self._append_unique_route(result, path, method, relative, _line_of(content, match.start()))
+
+        # Drogon registerHandler with explicit method list: {Drogon::Get, Drogon::Post}
+        for match in DROGON_REGISTER_PATTERN.finditer(content):
+            path = match.group(1)
+            methods_blob = match.group(2)
+            methods = {
+                m.upper()
+                for m in re.findall(r'\b(?:Drogon::)?(Get|Post|Put|Delete|Patch|Head|Options)\b', methods_blob)
+            }
+            line = _line_of(content, match.start())
+            if not methods:
+                methods = {"ANY"}
+            for method in sorted(methods):
+                self._append_unique_route(result, path, method, relative, line)
+
+        # Drogon ADD_METHOD_TO macro: ADD_METHOD_TO(ctrl::handler, "/path", Get)
+        for match in DROGON_ADD_METHOD_PATTERN.finditer(content):
+            path, method = match.group(1), match.group(2).upper()
+            self._append_unique_route(result, path, method, relative, _line_of(content, match.start()))
+
+        # cpprestsdk listener URL — the listener is constructed with the full URL
+        # which we treat as both an entrypoint and a route (path part).
+        for match in CPPRESTSDK_LISTENER_PATTERN.finditer(content):
+            url = match.group(1)
+            # Best-effort: extract the path component of the URL.
+            path_match = re.search(r"https?://[^/]+(/[^?]*)", url)
+            if path_match:
+                path = path_match.group(1) or "/"
+                self._append_unique_route(result, path, "ANY", relative, _line_of(content, match.start()))
+
+    def _extract_databases(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, kind in DB_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_database(
+                result, kind, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+            )
+
+    def _extract_auth(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, hint, confidence in AUTH_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_auth(
+                result, hint, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+                confidence,
+            )
+
+    def _extract_secrets(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern in SECRET_PATTERNS:
+            for match in pattern.finditer(content):
+                name = match.group(1)
+                self._append_unique_secret(
+                    result, name, relative,
+                    _line_of(content, match.start()),
+                    _line_snippet(content, match.start()),
+                )
+
+    def _extract_external_calls(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern in OUTBOUND_PATTERNS:
+            for match in pattern.finditer(content):
+                target = match.group(1)
+                if not (target.startswith("http://") or target.startswith("https://")):
+                    continue
+                self._append_unique_external(
+                    result, target, relative,
+                    _line_of(content, match.start()),
+                    _line_snippet(content, match.start()),
+                )
+
+    def _extract_frameworks(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, name in FRAMEWORK_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_framework(
+                result, name, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+            )
+
+    def _extract_entrypoints(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, hint in ENTRYPOINT_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_entrypoint(
+                result, hint, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+            )
+
+    # ---------- Append helpers ----------
+
+    @staticmethod
+    def _append_unique_route(result: ScanResult, path: str, method: str, file: str, line: int | None) -> None:
+        key = (path, method, file)
+        if any((item.path, item.method, item.file) == key for item in result.routes):
+            return
+        result.routes.append(Route(path=path, method=method, file=file, line=line))
+
+    @staticmethod
+    def _append_unique_database(result: ScanResult, kind: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (kind, file)
+        if any((item.kind, item.file) == key for item in result.databases):
+            return
+        result.databases.append(DatabaseHint(kind=kind, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_auth(result: ScanResult, hint: str, file: str, line: int | None, evidence: str | None, confidence: float) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.auth_hints):
+            return
+        result.auth_hints.append(AuthHint(hint=hint, file=file, line=line, evidence_text=evidence, confidence=confidence))
+
+    @staticmethod
+    def _append_unique_secret(result: ScanResult, name: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (name, file)
+        if any((item.name, item.file) == key for item in result.secret_hints):
+            return
+        result.secret_hints.append(SecretHint(name=name, file=file, line=line, evidence_text=evidence, confidence=0.85))
+
+    @staticmethod
+    def _append_unique_external(result: ScanResult, target: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (target, file)
+        if any((item.target, item.file) == key for item in result.external_calls):
+            return
+        result.external_calls.append(ExternalCall(target=target, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_framework(result: ScanResult, hint: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.framework_hints):
+            return
+        result.framework_hints.append(FrameworkHint(hint=hint, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_entrypoint(result: ScanResult, hint: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.entrypoint_hints):
+            return
+        result.entrypoint_hints.append(EntrypointHint(hint=hint, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_service(result: ScanResult, hint: str, file: str) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.service_hints):
+            return
+        result.service_hints.append(ServiceHint(hint=hint, file=file))
+
+
+__all__ = ["CppAnalyzer"]

attackmap_analyzer_cpp-0.1.0/src/attackmap_analyzer_cpp/contracts.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+from attackmap.sdk.contracts import AnalyzerMetadata, AnalyzerProtocol
+from attackmap.sdk.models import (
+    AuthHint,
+    DatabaseHint,
+    EntrypointHint,
+    ExternalCall,
+    FrameworkHint,
+    Route,
+    ScanResult,
+    SecretHint,
+    ServiceHint,
+)
+
+AttackMapAnalyzerProtocol = AnalyzerProtocol
+
+__all__ = [
+    "AnalyzerMetadata",
+    "AttackMapAnalyzerProtocol",
+    "Route",
+    "ExternalCall",
+    "DatabaseHint",
+    "AuthHint",
+    "EntrypointHint",
+    "FrameworkHint",
+    "ServiceHint",
+    "SecretHint",
+    "ScanResult",
+]

attackmap_analyzer_cpp-0.1.0/src/attackmap_analyzer_cpp.egg-info/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-cpp
+Version: 0.1.0
+Summary: C++ ecosystem analyzer plugin for AttackMap (Crow, Pistache, Drogon, cpprestsdk; libcurl/cpr; OpenSSL/Botan/libsodium/Crypto++; libpqxx/mongocxx/redis-plus-plus).
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-cpp
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-cpp
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-cpp/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-cpp/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.1.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-cpp
+
+C++ ecosystem analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This analyzer extracts structured signals from C++ source trees (`.cpp`, `.cc`, `.cxx`, `.hpp`, `.hxx`, `.ipp`, `.tpp`):
+
+- **Web frameworks** — Crow (`CROW_ROUTE` macro with `.methods("POST"_method, ...)` chain), Pistache (`Routes::Get/Post/...`), Drogon (`registerHandler` with explicit method list AND `ADD_METHOD_TO` macro), cpprestsdk / Casablanca (`http_listener("https://...")` URL extraction)
+- **HTTP clients (external calls)** — libcurl (`CURLOPT_URL` literals), cpr (`cpr::Get(cpr::Url{"..."})`, `cpr::Post(...)`), cpprestsdk (`web::http::client::http_client(URL)`)
+- **Databases** — libpqxx (`pqxx::connection`, `pqxx::work`), MySQL X DevAPI (`mysqlx::Session`), mongocxx (`mongocxx::client` + `mongocxx::uri`), redis-plus-plus (`sw::redis::Redis`), SOCI (`soci::session`), sqlite_orm (`sqlite_orm::make_storage`)
+- **Auth/crypto** — OpenSSL (TLS / EVP / RAND), Botan (`TLS::Server`, `Cipher_Mode`, `PKCS5_PBKDF2`, `Scrypt`), libsodium (`crypto_pwhash` → argon2, `crypto_secretbox`, AEAD primitives), Crypto++ (`CryptoPP::AES`, `CryptoPP::SHA256`, `CryptoPP::Argon2`, `CryptoPP::HMAC`), JWT C++ libraries (`jwt::create`, `jwt::decode`, `jwt::verify`)
+- **Secrets** — `std::getenv`, `getenv` with secret-shaped names
+- **Service hints** — project name from `CMakeLists.txt` `project(NAME ...)` declaration
+
+All emissions populate AttackMap's Signal v2 fields (line numbers + evidence snippets + confidence) so downstream insights can cite `path/to/file.cpp:NN`.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-cpp.git
+```
+
+The analyzer is auto-discovered by AttackMap via the `attackmap.analyzers` entry-point group.
+
+## Usage with AttackMap
+
+```bash
+# Auto-discovered when installed:
+attackmap analyze /path/to/cpp/repo
+
+# Or invoke explicitly:
+attackmap analyze /path/to/cpp/repo --module cpp
+```
+
+## Detection
+
+`detect()` returns true when any `.cpp`, `.cc`, `.cxx`, `.hpp`, `.hxx`, `.ipp`, or `.tpp` file is present, ignoring `build/`, `.git/`, `_deps/`, `third_party/`, `vendor/`, `external/`, `.cache/`, `out/`, `Debug/`, `Release/`, and `node_modules/`.
+
+This analyzer **does not** claim `.h` files — those are handled by the C analyzer (`attackmap-analyzer-c`). A repo with only `.c` and `.h` files is not picked up here.
+
+## Coverage notes
+
+- **Marked experimental**: like the C analyzer, regex coverage of C++ has more false-positive risk than language-specific analyzers with strict imports. Confidence tiering is the primary defense (0.9 for hash-class auth primitives, 0.85 for canonical TLS / cipher / JWT API hits, 0.6 for keyword sweeps).
+- **Crow `.methods("X"_method)` chains**: when present, the route emits one Route per method in the chain. When absent, the route emits with method `ANY`.
+- **Drogon `registerHandler` and `ADD_METHOD_TO`**: both shapes are extracted, including the `{Drogon::Get, Drogon::Post}` initializer-list form which produces multiple Routes.
+- **cpprestsdk listener routes**: only the path component of the listener's URL is extracted as a Route. Per-method handlers (`listener.support(methods::GET, ...)`) are not separately emitted — that would require tracking the listener's lifetime.
+- **C++ shares vocabulary with C** (libcurl, OpenSSL, libsodium). Those patterns are duplicated here so a pure-C++ project without the C analyzer installed still gets full coverage. AttackMap's overlay deduplication handles double-firing.
+- **Pure-template / header-only ORM** (sqlite_orm, sqlpp11): only basic detection via headers and `make_storage`; column-level extraction is out of scope.
+
+## License
+
+MIT

attackmap_analyzer_cpp-0.1.0/src/attackmap_analyzer_cpp.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+src/attackmap_analyzer_cpp/__init__.py
+src/attackmap_analyzer_cpp/analyzer.py
+src/attackmap_analyzer_cpp/contracts.py
+src/attackmap_analyzer_cpp.egg-info/PKG-INFO
+src/attackmap_analyzer_cpp.egg-info/SOURCES.txt
+src/attackmap_analyzer_cpp.egg-info/dependency_links.txt
+src/attackmap_analyzer_cpp.egg-info/entry_points.txt
+src/attackmap_analyzer_cpp.egg-info/requires.txt
+src/attackmap_analyzer_cpp.egg-info/top_level.txt
+tests/test_cpp_analyzer.py

attackmap_analyzer_cpp-0.1.0/src/attackmap_analyzer_cpp.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

attackmap_analyzer_cpp-0.1.0/src/attackmap_analyzer_cpp.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[attackmap.analyzers]
+cpp = attackmap_analyzer_cpp:CppAnalyzer

attackmap_analyzer_cpp-0.1.0/src/attackmap_analyzer_cpp.egg-info/requires.txt

@@ -0,0 +1,9 @@
+pydantic>=2.7.0
+
+[core]
+attackmap>=0.1.0
+
+[dev]
+pytest>=8.0.0
+build>=1.2.0
+attackmap>=0.1.0

attackmap_analyzer_cpp-0.1.0/src/attackmap_analyzer_cpp.egg-info/top_level.txt

@@ -0,0 +1 @@
+attackmap_analyzer_cpp

attackmap_analyzer_cpp-0.1.0/tests/test_cpp_analyzer.py

@@ -0,0 +1,447 @@
+"""Tests for the CppAnalyzer plugin."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from attackmap_analyzer_cpp import CppAnalyzer
+
+
+# ---------- detect() ----------
+
+
+def test_detect_picks_up_cpp(tmp_path: Path) -> None:
+    (tmp_path / "main.cpp").write_text("int main() { return 0; }\n", encoding="utf-8")
+    assert CppAnalyzer().detect(tmp_path) is True
+
+
+def test_detect_picks_up_hpp(tmp_path: Path) -> None:
+    (tmp_path / "api.hpp").write_text("#pragma once\nclass Foo {};\n", encoding="utf-8")
+    assert CppAnalyzer().detect(tmp_path) is True
+
+
+def test_detect_skips_build_dir(tmp_path: Path) -> None:
+    (tmp_path / "build").mkdir()
+    (tmp_path / "build" / "stale.cpp").write_text("int main() { return 0; }\n", encoding="utf-8")
+    assert CppAnalyzer().detect(tmp_path) is False
+
+
+def test_detect_does_not_claim_pure_c_repo(tmp_path: Path) -> None:
+    """A repo with only `.c` and `.h` files belongs to the C analyzer."""
+    (tmp_path / "main.c").write_text("int main(void) { return 0; }\n", encoding="utf-8")
+    assert CppAnalyzer().detect(tmp_path) is False
+
+
+# ---------- Crow ----------
+
+
+def test_crow_route_default_method(tmp_path: Path) -> None:
+    (tmp_path / "main.cpp").write_text(
+        '#include <crow.h>\n'
+        '\n'
+        'int main() {\n'
+        '    crow::SimpleApp app;\n'
+        '    CROW_ROUTE(app, "/health")([](){ return "ok"; });\n'
+        '    app.port(8080).run();\n'
+        '    return 0;\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    pairs = {(r.path, r.method) for r in result.routes}
+    assert ("/health", "ANY") in pairs
+
+
+def test_crow_route_with_methods_chain(tmp_path: Path) -> None:
+    (tmp_path / "main.cpp").write_text(
+        '#include <crow.h>\n'
+        'crow::SimpleApp app;\n'
+        'CROW_ROUTE(app, "/users").methods("GET"_method, "POST"_method)\n'
+        '    ([](const crow::request& r){ return "ok"; });\n'
+        'CROW_ROUTE(app, "/admin").methods("DELETE"_method)\n'
+        '    ([](){ return "deleted"; });\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    pairs = sorted({(r.path, r.method) for r in result.routes})
+    assert ("/users", "GET") in pairs
+    assert ("/users", "POST") in pairs
+    assert ("/admin", "DELETE") in pairs
+
+
+# ---------- Pistache ----------
+
+
+def test_pistache_routes(tmp_path: Path) -> None:
+    (tmp_path / "main.cpp").write_text(
+        '#include <pistache/router.h>\n'
+        '\n'
+        'using namespace Pistache;\n'
+        '\n'
+        'void setup(Rest::Router& router) {\n'
+        '    Rest::Routes::Get(router, "/api/users", Rest::Routes::bind(&handle_users));\n'
+        '    Rest::Routes::Post(router, "/api/login", Rest::Routes::bind(&handle_login));\n'
+        '    Rest::Routes::Delete(router, "/api/users/:id", Rest::Routes::bind(&handle_delete));\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    pairs = {(r.path, r.method) for r in result.routes}
+    assert ("/api/users", "GET") in pairs
+    assert ("/api/login", "POST") in pairs
+    assert ("/api/users/:id", "DELETE") in pairs
+
+
+# ---------- Drogon ----------
+
+
+def test_drogon_register_handler_with_methods(tmp_path: Path) -> None:
+    (tmp_path / "main.cpp").write_text(
+        '#include <drogon/drogon.h>\n'
+        '\n'
+        'int main() {\n'
+        '    drogon::app().registerHandler(\n'
+        '        "/api/orders",\n'
+        '        [](const drogon::HttpRequestPtr& req, std::function<void(...)>&& cb) {},\n'
+        '        {Drogon::Get, Drogon::Post});\n'
+        '    drogon::app().run();\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    pairs = {(r.path, r.method) for r in result.routes}
+    assert ("/api/orders", "GET") in pairs
+    assert ("/api/orders", "POST") in pairs
+
+
+def test_drogon_add_method_to_macro(tmp_path: Path) -> None:
+    (tmp_path / "controller.hpp").write_text(
+        '#pragma once\n'
+        '#include <drogon/HttpController.h>\n'
+        '\n'
+        'class Users : public drogon::HttpController<Users> {\n'
+        'public:\n'
+        '    METHOD_LIST_BEGIN\n'
+        '    ADD_METHOD_TO(Users::list, "/users", Get);\n'
+        '    ADD_METHOD_TO(Users::create, "/users", Post);\n'
+        '    METHOD_LIST_END\n'
+        '\n'
+        '    void list(...);\n'
+        '    void create(...);\n'
+        '};\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    pairs = {(r.path, r.method) for r in result.routes}
+    assert ("/users", "GET") in pairs
+    assert ("/users", "POST") in pairs
+
+
+# ---------- cpprestsdk ----------
+
+
+def test_cpprestsdk_listener_extracts_url_path(tmp_path: Path) -> None:
+    (tmp_path / "main.cpp").write_text(
+        '#include <cpprest/http_listener.h>\n'
+        '\n'
+        'using namespace web::http::experimental::listener;\n'
+        '\n'
+        'int main() {\n'
+        '    http_listener listener("https://0.0.0.0:443/api/v1");\n'
+        '    listener.support(web::http::methods::GET, [](auto req){});\n'
+        '    listener.open().wait();\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    paths = {r.path for r in result.routes}
+    assert "/api/v1" in paths
+
+
+# ---------- HTTP clients ----------
+
+
+def test_libcurl_url_extracted(tmp_path: Path) -> None:
+    (tmp_path / "client.cpp").write_text(
+        '#include <curl/curl.h>\n'
+        'void fetch() {\n'
+        '    CURL *curl = curl_easy_init();\n'
+        '    curl_easy_setopt(curl, CURLOPT_URL, "https://api.stripe.com/v1/charges");\n'
+        '    curl_easy_perform(curl);\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    targets = {e.target for e in result.external_calls}
+    assert "https://api.stripe.com/v1/charges" in targets
+
+
+def test_cpr_url_extracted(tmp_path: Path) -> None:
+    (tmp_path / "client.cpp").write_text(
+        '#include <cpr/cpr.h>\n'
+        'void fetch() {\n'
+        '    auto resp = cpr::Get(cpr::Url{"https://api.example.com/data"});\n'
+        '    auto post = cpr::Post(cpr::Url{"https://api.example.com/submit"}, cpr::Body{"x"});\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    targets = {e.target for e in result.external_calls}
+    assert "https://api.example.com/data" in targets
+    assert "https://api.example.com/submit" in targets
+
+
+def test_cpprestsdk_http_client_url(tmp_path: Path) -> None:
+    (tmp_path / "client.cpp").write_text(
+        '#include <cpprest/http_client.h>\n'
+        'using web::http::client::http_client;\n'
+        'void fetch() {\n'
+        '    http_client client(U("https://api.example.com/v2"));\n'
+        '    client.request(web::http::methods::GET);\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    targets = {e.target for e in result.external_calls}
+    assert "https://api.example.com/v2" in targets
+
+
+# ---------- Databases ----------
+
+
+def test_libpqxx_connection_emits_postgresql(tmp_path: Path) -> None:
+    (tmp_path / "db.cpp").write_text(
+        '#include <pqxx/pqxx>\n'
+        'void connect() {\n'
+        '    pqxx::connection c{"postgresql://localhost/app"};\n'
+        '    pqxx::work tx{c};\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    assert any(d.kind == "postgresql" for d in result.databases)
+
+
+def test_mongocxx_redispp_each_emit_distinct_kinds(tmp_path: Path) -> None:
+    (tmp_path / "mongo.cpp").write_text(
+        '#include <mongocxx/client.hpp>\n'
+        'void x() {\n'
+        '    mongocxx::client client{mongocxx::uri{"mongodb://x"}};\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    (tmp_path / "redis.cpp").write_text(
+        '#include <sw/redis++/redis++.h>\n'
+        'void x() {\n'
+        '    sw::redis::Redis redis("tcp://127.0.0.1:6379");\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    kinds = {d.kind for d in result.databases}
+    assert "mongodb" in kinds
+    assert "redis" in kinds
+
+
+def test_mysqlx_session_emits_mysql(tmp_path: Path) -> None:
+    (tmp_path / "db.cpp").write_text(
+        '#include <mysqlx/xdevapi.h>\n'
+        'void connect() {\n'
+        '    mysqlx::Session s{mysqlx::SessionSettings("mysqlx://localhost")};\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    assert any(d.kind == "mysql" for d in result.databases)
+
+
+# ---------- Auth ----------
+
+
+def test_jwt_cpp_emits_jwt_hint(tmp_path: Path) -> None:
+    (tmp_path / "auth.cpp").write_text(
+        '#include <jwt-cpp/jwt.h>\n'
+        'std::string sign(const std::string& secret) {\n'
+        '    return jwt::create()\n'
+        '        .set_issuer("svc")\n'
+        '        .sign(jwt::algorithm::hs256{secret});\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    assert any(h.hint == "jwt" for h in result.auth_hints)
+
+
+def test_libsodium_argon2_high_confidence(tmp_path: Path) -> None:
+    (tmp_path / "auth.cpp").write_text(
+        '#include <sodium.h>\n'
+        'int hash(const char *pw, char *out) {\n'
+        '    return crypto_pwhash_str(out, pw, strlen(pw),\n'
+        '        crypto_pwhash_OPSLIMIT_INTERACTIVE,\n'
+        '        crypto_pwhash_MEMLIMIT_INTERACTIVE);\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    by_hint = {h.hint: h for h in result.auth_hints}
+    assert "argon2" in by_hint
+    assert by_hint["argon2"].confidence == 0.9
+
+
+def test_botan_tls_server(tmp_path: Path) -> None:
+    (tmp_path / "tls.cpp").write_text(
+        '#include <botan/tls_server.h>\n'
+        'class MyServer : public Botan::TLS::Server {};\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    assert any(h.hint == "botan" for h in result.auth_hints)
+
+
+def test_cryptopp_aes_emits_hint(tmp_path: Path) -> None:
+    (tmp_path / "crypto.cpp").write_text(
+        '#include <cryptopp/aes.h>\n'
+        'CryptoPP::AES::Encryption enc;\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    assert any(h.hint == "cryptopp" for h in result.auth_hints)
+
+
+# ---------- Secrets ----------
+
+
+def test_std_getenv_secrets(tmp_path: Path) -> None:
+    (tmp_path / "config.cpp").write_text(
+        '#include <cstdlib>\n'
+        '#include <string>\n'
+        '\n'
+        'std::string load() {\n'
+        '    const char *jwt = std::getenv("JWT_SECRET");\n'
+        '    const char *db = std::getenv("DATABASE_PASSWORD");\n'
+        '    return jwt ? jwt : "";\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    names = {s.name for s in result.secret_hints}
+    assert "JWT_SECRET" in names
+    assert "DATABASE_PASSWORD" in names
+
+
+def test_getenv_with_non_secret_name_skipped(tmp_path: Path) -> None:
+    (tmp_path / "config.cpp").write_text(
+        'const char *home = std::getenv("HOME");\n'
+        'const char *path = getenv("PATH");\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    assert result.secret_hints == []
+
+
+# ---------- Frameworks + entrypoints ----------
+
+
+def test_crow_app_run_entrypoint(tmp_path: Path) -> None:
+    (tmp_path / "main.cpp").write_text(
+        '#include <crow.h>\n'
+        'int main() {\n'
+        '    crow::SimpleApp app;\n'
+        '    CROW_ROUTE(app, "/")([](){ return "hi"; });\n'
+        '    app.port(8080).multithreaded().run();\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    fw = {f.hint for f in result.framework_hints}
+    assert "crow" in fw
+    ep = {e.hint for e in result.entrypoint_hints}
+    assert "crow_app_run" in ep
+
+
+def test_drogon_app_run_entrypoint(tmp_path: Path) -> None:
+    (tmp_path / "main.cpp").write_text(
+        '#include <drogon/drogon.h>\n'
+        'int main() { drogon::app().run(); }\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    fw = {f.hint for f in result.framework_hints}
+    assert "drogon" in fw
+    ep = {e.hint for e in result.entrypoint_hints}
+    assert "drogon_run" in ep
+
+
+def test_cpprestsdk_listener_open_entrypoint(tmp_path: Path) -> None:
+    (tmp_path / "main.cpp").write_text(
+        '#include <cpprest/http_listener.h>\n'
+        'using namespace web::http::experimental::listener;\n'
+        'int main() {\n'
+        '    http_listener listener("http://0.0.0.0:80/api");\n'
+        '    listener.open().wait();\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = CppAnalyzer().analyze(tmp_path)
+    ep = {e.hint for e in result.entrypoint_hints}
+    assert "cpprestsdk_listener_open" in ep
+
+
+# ---------- CMake → service hint ----------
+
+
+def test_cmake_project_picked_up(tmp_path: Path) -> None:
+    (tmp_path / "CMakeLists.txt").write_text(
+        'project(billing-cpp LANGUAGES CXX)\n', encoding="utf-8"
+    )
+    (tmp_path / "main.cpp").write_text("int main() { return 0; }\n", encoding="utf-8")
+    result = CppAnalyzer().analyze(tmp_path)
+    assert any(h.hint == "project:billing-cpp" for h in result.service_hints)
+
+
+# ---------- End-to-end ----------
+
+
+def test_full_drogon_service_signal_set(tmp_path: Path) -> None:
+    (tmp_path / "CMakeLists.txt").write_text(
+        'project(orders-cpp LANGUAGES CXX)\nadd_executable(orders main.cpp)\n',
+        encoding="utf-8",
+    )
+    (tmp_path / "main.cpp").write_text(
+        '#include <drogon/drogon.h>\n'
+        '#include <pqxx/pqxx>\n'
+        '#include <jwt-cpp/jwt.h>\n'
+        '#include <openssl/ssl.h>\n'
+        '#include <cpr/cpr.h>\n'
+        '#include <cstdlib>\n'
+        '\n'
+        'int main() {\n'
+        '    const char *secret = std::getenv("JWT_SECRET");\n'
+        '    pqxx::connection conn{"postgresql://localhost/orders"};\n'
+        '    SSL_CTX *ctx = SSL_CTX_new(TLS_server_method());\n'
+        '    auto resp = cpr::Get(cpr::Url{"https://api.stripe.com/v1/charges"});\n'
+        '\n'
+        '    drogon::app().registerHandler("/api/orders", handler, {Drogon::Get, Drogon::Post});\n'
+        '    drogon::app().registerHandler("/admin/refund", refund, {Drogon::Post});\n'
+        '    drogon::app().run();\n'
+        '}\n',
+        encoding="utf-8",
+    )
+
+    result = CppAnalyzer().analyze(tmp_path)
+
+    pairs = {(r.path, r.method) for r in result.routes}
+    assert ("/api/orders", "GET") in pairs
+    assert ("/api/orders", "POST") in pairs
+    assert ("/admin/refund", "POST") in pairs
+
+    assert any(d.kind == "postgresql" for d in result.databases)
+    assert any(h.hint == "jwt" for h in result.auth_hints)
+    assert any(h.hint == "openssl_tls" for h in result.auth_hints)
+    assert any(s.name == "JWT_SECRET" for s in result.secret_hints)
+    assert any(e.target == "https://api.stripe.com/v1/charges" for e in result.external_calls)
+    assert any(f.hint == "drogon" for f in result.framework_hints)
+    assert any(e.hint == "drogon_run" for e in result.entrypoint_hints)
+    assert any(h.hint == "project:orders-cpp" for h in result.service_hints)