attackmap-analyzer-swift 0.1.0__tar.gz

attackmap_analyzer_swift-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_swift-0.1.0/PKG-INFO

@@ -0,0 +1,93 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-swift
+Version: 0.1.0
+Summary: Swift ecosystem analyzer plugin for AttackMap (SwiftPM projects, Package.resolved SBOM; server-side Vapor/Hummingbird and iOS/macOS app surface land in later slices).
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-swift
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-swift
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-swift/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-swift/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin,swift
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.4.29; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.4.29; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-swift
+
+Swift ecosystem analyzer plugin for [AttackMap](https://github.com/mlaify/AttackMap).
+Auto-discovered via the `attackmap.analyzers` entry point once installed.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+> **Status: early scaffold (v0.1.0).** SwiftPM project detection + a
+> `Package.resolved` dependency SBOM. Server-side route extraction and the
+> iOS/macOS app attack surface are on the roadmap (below).
+
+## Install
+
+```bash
+pip install attackmap-analyzer-swift    # alongside attackmap>=0.4.29
+```
+
+Then AttackMap picks it up automatically:
+
+```bash
+attackmap analyze /path/to/swift/project
+```
+
+## What it does today
+
+- **SwiftPM detection** — recognizes `Package.swift`, `.xcodeproj` / `.xcworkspace`,
+  and `.swift` sources; emits a `SwiftPM` framework hint.
+- **Dependency SBOM** — parses `Package.resolved` (formats **v1**, **v2**, and **v3**,
+  including the copy Xcode stashes under `*.xcworkspace/xcshareddata/swiftpm/`) into
+  the scan's dependency inventory, marking direct vs. transitive by cross-referencing
+  the `Package.swift` manifest. Swift packages are inventoried but not CVE-matched —
+  OSV.dev has no SwiftPM ecosystem yet.
+- **Framework hints** — flags server-side frameworks (Vapor, Hummingbird, Kitura,
+  Perfect) when declared in the manifest.
+- **Entrypoints** — `main.swift` and `@main`.
+
+## Roadmap
+
+- **Server-side routes** ([AttackMap#187](https://github.com/mlaify/AttackMap/issues/187)) — Vapor / Hummingbird route + auth-middleware extraction.
+- **iOS/macOS app attack surface** ([AttackMap#188](https://github.com/mlaify/AttackMap/issues/188)) — URL schemes, universal links, `WKWebView` JS eval, Keychain / `UserDefaults` secrets, App Transport Security exceptions, pasteboard, XPC.
+
+Part of the [Swift analyzer epic](https://github.com/mlaify/AttackMap/issues/204).
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest -q
+```
+
+## License
+
+[MIT](LICENSE). Copyright (c) 2026 Matthew Davis and AttackMap Contributors.

attackmap_analyzer_swift-0.1.0/README.md

@@ -0,0 +1,53 @@
+# attackmap-analyzer-swift
+
+Swift ecosystem analyzer plugin for [AttackMap](https://github.com/mlaify/AttackMap).
+Auto-discovered via the `attackmap.analyzers` entry point once installed.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+> **Status: early scaffold (v0.1.0).** SwiftPM project detection + a
+> `Package.resolved` dependency SBOM. Server-side route extraction and the
+> iOS/macOS app attack surface are on the roadmap (below).
+
+## Install
+
+```bash
+pip install attackmap-analyzer-swift    # alongside attackmap>=0.4.29
+```
+
+Then AttackMap picks it up automatically:
+
+```bash
+attackmap analyze /path/to/swift/project
+```
+
+## What it does today
+
+- **SwiftPM detection** — recognizes `Package.swift`, `.xcodeproj` / `.xcworkspace`,
+  and `.swift` sources; emits a `SwiftPM` framework hint.
+- **Dependency SBOM** — parses `Package.resolved` (formats **v1**, **v2**, and **v3**,
+  including the copy Xcode stashes under `*.xcworkspace/xcshareddata/swiftpm/`) into
+  the scan's dependency inventory, marking direct vs. transitive by cross-referencing
+  the `Package.swift` manifest. Swift packages are inventoried but not CVE-matched —
+  OSV.dev has no SwiftPM ecosystem yet.
+- **Framework hints** — flags server-side frameworks (Vapor, Hummingbird, Kitura,
+  Perfect) when declared in the manifest.
+- **Entrypoints** — `main.swift` and `@main`.
+
+## Roadmap
+
+- **Server-side routes** ([AttackMap#187](https://github.com/mlaify/AttackMap/issues/187)) — Vapor / Hummingbird route + auth-middleware extraction.
+- **iOS/macOS app attack surface** ([AttackMap#188](https://github.com/mlaify/AttackMap/issues/188)) — URL schemes, universal links, `WKWebView` JS eval, Keychain / `UserDefaults` secrets, App Transport Security exceptions, pasteboard, XPC.
+
+Part of the [Swift analyzer epic](https://github.com/mlaify/AttackMap/issues/204).
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest -q
+```
+
+## License
+
+[MIT](LICENSE). Copyright (c) 2026 Matthew Davis and AttackMap Contributors.

attackmap_analyzer_swift-0.1.0/pyproject.toml

@@ -0,0 +1,75 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "attackmap-analyzer-swift"
+version = "0.1.0"
+description = "Swift ecosystem analyzer plugin for AttackMap (SwiftPM projects, Package.resolved SBOM; server-side Vapor/Hummingbird and iOS/macOS app surface land in later slices)."
+readme = "README.md"
+requires-python = ">=3.11"
+license = {text = "MIT"}
+authors = [
+  {name = "Matthew Davis", email = "matthewd@matthewd.xyz"},
+  {name = "AttackMap Contributors"},
+]
+maintainers = [
+  {name = "Matthew Davis", email = "matthewd@matthewd.xyz"},
+]
+keywords = [
+  "security",
+  "static-analysis",
+  "appsec",
+  "defensive-security",
+  "attackmap",
+  "attackmap-plugin",
+  "swift",
+]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "Intended Audience :: Information Technology",
+  "Intended Audience :: System Administrators",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Security",
+  "Topic :: Software Development :: Quality Assurance",
+  "Typing :: Typed",
+]
+dependencies = [
+  "pydantic>=2.7.0",
+]
+
+[project.optional-dependencies]
+core = [
+  "attackmap>=0.4.29",
+]
+dev = [
+  "pytest>=8.0.0",
+  "build>=1.2.0",
+  "attackmap>=0.4.29",
+]
+
+[project.urls]
+Homepage = "https://github.com/mlaify/attackmap-analyzer-swift"
+Repository = "https://github.com/mlaify/attackmap-analyzer-swift"
+Issues = "https://github.com/mlaify/attackmap-analyzer-swift/issues"
+Changelog = "https://github.com/mlaify/attackmap-analyzer-swift/blob/main/CHANGELOG.md"
+"AttackMap core" = "https://github.com/mlaify/AttackMap"
+
+[project.entry-points."attackmap.analyzers"]
+swift = "attackmap_analyzer_swift:SwiftAnalyzer"
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

attackmap_analyzer_swift-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

attackmap_analyzer_swift-0.1.0/src/attackmap_analyzer_swift/__init__.py

@@ -0,0 +1,3 @@
+from .analyzer import SwiftAnalyzer
+
+__all__ = ["SwiftAnalyzer"]

attackmap_analyzer_swift-0.1.0/src/attackmap_analyzer_swift/analyzer.py

@@ -0,0 +1,210 @@
+"""Swift ecosystem analyzer for AttackMap.
+
+Slice #186 (scaffold): SwiftPM project detection and a dependency SBOM parsed
+from ``Package.resolved`` (formats v1/v2/v3), plus light framework and entrypoint
+recon. Server-side route extraction (Vapor/Hummingbird, #187) and the iOS/macOS
+app attack surface (#188) land in later slices.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+from .contracts import (
+    AnalyzerMetadata,
+    DependencyHint,
+    EntrypointHint,
+    FrameworkHint,
+    ScanResult,
+)
+
+SKIP_DIRS = {
+    ".git",
+    ".build",          # SwiftPM build products
+    "build",
+    "DerivedData",     # Xcode build products
+    "Pods",            # CocoaPods vendored sources
+    "Carthage",
+    "node_modules",
+    "__pycache__",
+}
+
+# Known server-side frameworks worth surfacing when seen in Package.swift deps.
+_FRAMEWORK_HINTS: dict[str, str] = {
+    "vapor": "Vapor (server-side Swift web framework)",
+    "hummingbird": "Hummingbird (server-side Swift web framework)",
+    "kitura": "Kitura (server-side Swift web framework)",
+    "perfect": "Perfect (server-side Swift web framework)",
+}
+
+# `.package(url: "https://github.com/vapor/vapor.git", ...)` and the newer
+# `.package(name: "X", url: "...")` / path-based forms.
+_PACKAGE_URL_RE = re.compile(r"\.package\s*\([^)]*?url\s*:\s*\"([^\"]+)\"", re.DOTALL)
+
+
+def _identity_from_url(url: str) -> str:
+    """SwiftPM identity = the last path component of the repo URL, lowercased,
+    without a trailing ``.git`` (matches how Package.resolved v2/v3 records it)."""
+    tail = url.rstrip("/").rsplit("/", 1)[-1]
+    if tail.endswith(".git"):
+        tail = tail[:-4]
+    return tail.lower()
+
+
+def _line_of(content: str, needle: str) -> int | None:
+    idx = content.find(needle)
+    if idx < 0:
+        return None
+    return content.count("\n", 0, idx) + 1
+
+
+class SwiftAnalyzer:
+    metadata = AnalyzerMetadata(
+        name="swift",
+        display_name="Swift Analyzer",
+        version="0.1.0",
+        description="Swift ecosystem analyzer: SwiftPM project detection and Package.resolved dependency SBOM. Server-side routes and app attack surface land in later slices.",
+        scope="Swift source trees and SwiftPM/Xcode projects. Detects the SwiftPM toolchain, server-side web frameworks in the manifest, and resolved package dependencies for CVE/SBOM.",
+        targets=["swift", "swiftpm", "vapor", "hummingbird"],
+        languages=["swift"],
+        priority=20,
+        experimental=True,  # Early scaffold — coverage is intentionally partial.
+        enabled_by_default=True,
+    )
+
+    @property
+    def name(self) -> str:
+        return self.metadata.name
+
+    # ---------- Public entry points ----------
+
+    def detect(self, repo_path: str | Path) -> bool:
+        root = Path(repo_path).resolve()
+        if not root.exists() or not root.is_dir():
+            return False
+        for path in root.rglob("*"):
+            if any(part in SKIP_DIRS for part in path.parts):
+                continue
+            name = path.name
+            if name in {"Package.swift", "Package.resolved"}:
+                return True
+            if path.is_dir() and path.suffix in {".xcodeproj", ".xcworkspace"}:
+                return True
+            if path.is_file() and path.suffix == ".swift":
+                return True
+        return False
+
+    def analyze(self, repo_path: str | Path) -> ScanResult:
+        root = Path(repo_path).resolve()
+        result = ScanResult(root=str(root))
+        if not root.exists() or not root.is_dir():
+            return result
+
+        direct = self._analyze_manifest(root, result)
+        self._analyze_resolved(root, result, direct)
+        self._analyze_entrypoints(root, result)
+        return result
+
+    # ---------- Package.swift (manifest) ----------
+
+    def _analyze_manifest(self, root: Path, result: ScanResult) -> set[str]:
+        """Record SwiftPM + framework hints; return the set of *direct* dependency
+        identities declared in the manifest (used to mark resolved pins direct)."""
+        direct: set[str] = set()
+        for manifest in root.rglob("Package.swift"):
+            if any(part in SKIP_DIRS for part in manifest.parts):
+                continue
+            try:
+                text = manifest.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            rel = self._rel(manifest, root)
+            result.framework_hints.append(FrameworkHint(
+                hint="SwiftPM", file=rel, line=1,
+                evidence_text="Package.swift present — Swift Package Manager project."))
+            for m in _PACKAGE_URL_RE.finditer(text):
+                url = m.group(1)
+                identity = _identity_from_url(url)
+                direct.add(identity)
+                for key, label in _FRAMEWORK_HINTS.items():
+                    if key in identity:
+                        result.framework_hints.append(FrameworkHint(
+                            hint=label, file=rel, line=_line_of(text, url) or 1,
+                            evidence_text=f"Declared dependency: {url}"))
+        return direct
+
+    # ---------- Package.resolved (SBOM) ----------
+
+    def _analyze_resolved(self, root: Path, result: ScanResult, direct: set[str]) -> None:
+        for resolved in root.rglob("Package.resolved"):
+            if any(part in SKIP_DIRS for part in resolved.parts):
+                continue
+            try:
+                data = json.loads(resolved.read_text(encoding="utf-8", errors="replace"))
+            except (OSError, json.JSONDecodeError):
+                continue  # a malformed pin file must not abort the scan
+            rel = self._rel(resolved, root)
+            for pin in _iter_pins(data):
+                identity = (pin.get("identity") or pin.get("package") or "").lower()
+                if not identity:
+                    continue
+                state = pin.get("state") or {}
+                version = state.get("version") or ""  # branch/revision pins have no version
+                location = pin.get("location") or pin.get("repositoryURL") or ""
+                result.dependencies.append(DependencyHint(
+                    name=identity,
+                    version=version,
+                    ecosystem="swiftpm",
+                    file=rel,
+                    resolved=True,
+                    direct=identity in direct,
+                    evidence_text=location or None,
+                    source_analyzer="swift",
+                ))
+
+    # ---------- Entrypoints ----------
+
+    def _analyze_entrypoints(self, root: Path, result: ScanResult) -> None:
+        for path in root.rglob("*.swift"):
+            if any(part in SKIP_DIRS for part in path.parts):
+                continue
+            try:
+                text = path.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            rel = self._rel(path, root)
+            if path.name == "main.swift":
+                result.entrypoint_hints.append(EntrypointHint(
+                    hint="main.swift (top-level executable entrypoint)",
+                    file=rel, line=1, evidence_text="Swift top-level main.swift"))
+            elif "@main" in text:
+                result.entrypoint_hints.append(EntrypointHint(
+                    hint="@main attribute (executable entrypoint)",
+                    file=rel, line=_line_of(text, "@main") or 1, evidence_text="@main"))
+
+    # ---------- helpers ----------
+
+    @staticmethod
+    def _rel(path: Path, root: Path) -> str:
+        try:
+            return str(path.resolve().relative_to(root)).replace("\\", "/")
+        except ValueError:
+            return path.name
+
+
+def _iter_pins(data: object):
+    """Yield pin dicts across Package.resolved formats: v1 nests them under
+    ``object.pins``; v2/v3 put ``pins`` at the top level."""
+    if not isinstance(data, dict):
+        return
+    pins = data.get("pins")
+    if pins is None:
+        obj = data.get("object")
+        if isinstance(obj, dict):
+            pins = obj.get("pins")
+    if isinstance(pins, list):
+        for pin in pins:
+            if isinstance(pin, dict):
+                yield pin

attackmap_analyzer_swift-0.1.0/src/attackmap_analyzer_swift/contracts.py

@@ -0,0 +1,39 @@
+"""Re-exports of the AttackMap analyzer SDK surface this plugin depends on.
+
+Everything here comes from the stable ``attackmap.sdk`` contract (requires
+attackmap >= 0.4.29, which exports ``DependencyHint``). Kept in one place so a
+future SDK move is a one-file change.
+"""
+
+from __future__ import annotations
+
+from attackmap.sdk.contracts import AnalyzerMetadata, AnalyzerProtocol
+from attackmap.sdk.models import (
+    AuthHint,
+    DatabaseHint,
+    DependencyHint,
+    EntrypointHint,
+    ExternalCall,
+    FrameworkHint,
+    Route,
+    ScanResult,
+    SecretHint,
+    ServiceHint,
+)
+
+AttackMapAnalyzerProtocol = AnalyzerProtocol
+
+__all__ = [
+    "AnalyzerMetadata",
+    "AttackMapAnalyzerProtocol",
+    "AuthHint",
+    "DatabaseHint",
+    "DependencyHint",
+    "EntrypointHint",
+    "ExternalCall",
+    "FrameworkHint",
+    "Route",
+    "ScanResult",
+    "SecretHint",
+    "ServiceHint",
+]

attackmap_analyzer_swift-0.1.0/src/attackmap_analyzer_swift.egg-info/PKG-INFO

@@ -0,0 +1,93 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-swift
+Version: 0.1.0
+Summary: Swift ecosystem analyzer plugin for AttackMap (SwiftPM projects, Package.resolved SBOM; server-side Vapor/Hummingbird and iOS/macOS app surface land in later slices).
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-swift
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-swift
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-swift/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-swift/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin,swift
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.4.29; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.4.29; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-swift
+
+Swift ecosystem analyzer plugin for [AttackMap](https://github.com/mlaify/AttackMap).
+Auto-discovered via the `attackmap.analyzers` entry point once installed.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+> **Status: early scaffold (v0.1.0).** SwiftPM project detection + a
+> `Package.resolved` dependency SBOM. Server-side route extraction and the
+> iOS/macOS app attack surface are on the roadmap (below).
+
+## Install
+
+```bash
+pip install attackmap-analyzer-swift    # alongside attackmap>=0.4.29
+```
+
+Then AttackMap picks it up automatically:
+
+```bash
+attackmap analyze /path/to/swift/project
+```
+
+## What it does today
+
+- **SwiftPM detection** — recognizes `Package.swift`, `.xcodeproj` / `.xcworkspace`,
+  and `.swift` sources; emits a `SwiftPM` framework hint.
+- **Dependency SBOM** — parses `Package.resolved` (formats **v1**, **v2**, and **v3**,
+  including the copy Xcode stashes under `*.xcworkspace/xcshareddata/swiftpm/`) into
+  the scan's dependency inventory, marking direct vs. transitive by cross-referencing
+  the `Package.swift` manifest. Swift packages are inventoried but not CVE-matched —
+  OSV.dev has no SwiftPM ecosystem yet.
+- **Framework hints** — flags server-side frameworks (Vapor, Hummingbird, Kitura,
+  Perfect) when declared in the manifest.
+- **Entrypoints** — `main.swift` and `@main`.
+
+## Roadmap
+
+- **Server-side routes** ([AttackMap#187](https://github.com/mlaify/AttackMap/issues/187)) — Vapor / Hummingbird route + auth-middleware extraction.
+- **iOS/macOS app attack surface** ([AttackMap#188](https://github.com/mlaify/AttackMap/issues/188)) — URL schemes, universal links, `WKWebView` JS eval, Keychain / `UserDefaults` secrets, App Transport Security exceptions, pasteboard, XPC.
+
+Part of the [Swift analyzer epic](https://github.com/mlaify/AttackMap/issues/204).
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest -q
+```
+
+## License
+
+[MIT](LICENSE). Copyright (c) 2026 Matthew Davis and AttackMap Contributors.

attackmap_analyzer_swift-0.1.0/src/attackmap_analyzer_swift.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+src/attackmap_analyzer_swift/__init__.py
+src/attackmap_analyzer_swift/analyzer.py
+src/attackmap_analyzer_swift/contracts.py
+src/attackmap_analyzer_swift.egg-info/PKG-INFO
+src/attackmap_analyzer_swift.egg-info/SOURCES.txt
+src/attackmap_analyzer_swift.egg-info/dependency_links.txt
+src/attackmap_analyzer_swift.egg-info/entry_points.txt
+src/attackmap_analyzer_swift.egg-info/requires.txt
+src/attackmap_analyzer_swift.egg-info/top_level.txt
+tests/test_swift_analyzer.py

attackmap_analyzer_swift-0.1.0/src/attackmap_analyzer_swift.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

attackmap_analyzer_swift-0.1.0/src/attackmap_analyzer_swift.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[attackmap.analyzers]
+swift = attackmap_analyzer_swift:SwiftAnalyzer

attackmap_analyzer_swift-0.1.0/src/attackmap_analyzer_swift.egg-info/requires.txt

@@ -0,0 +1,9 @@
+pydantic>=2.7.0
+
+[core]
+attackmap>=0.4.29
+
+[dev]
+pytest>=8.0.0
+build>=1.2.0
+attackmap>=0.4.29

attackmap_analyzer_swift-0.1.0/src/attackmap_analyzer_swift.egg-info/top_level.txt

@@ -0,0 +1 @@
+attackmap_analyzer_swift

attackmap_analyzer_swift-0.1.0/tests/test_swift_analyzer.py

@@ -0,0 +1,127 @@
+import json
+from pathlib import Path
+
+from attackmap_analyzer_swift import SwiftAnalyzer
+
+
+def _write(root: Path, rel: str, content: str) -> None:
+    p = root / rel
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_text(content, encoding="utf-8")
+
+
+PACKAGE_SWIFT = """// swift-tools-version:5.9
+import PackageDescription
+
+let package = Package(
+    name: "MyServer",
+    dependencies: [
+        .package(url: "https://github.com/vapor/vapor.git", from: "4.89.0"),
+        .package(url: "https://github.com/apple/swift-nio.git", from: "2.0.0"),
+    ],
+    targets: [.executableTarget(name: "MyServer", dependencies: ["Vapor"])]
+)
+"""
+
+# Package.resolved v2/v3 (Xcode 13.3+ / SwiftPM): top-level "pins".
+RESOLVED_V2 = json.dumps({
+    "pins": [
+        {"identity": "vapor", "kind": "remoteSourceControl",
+         "location": "https://github.com/vapor/vapor.git",
+         "state": {"version": "4.89.0", "revision": "abc"}},
+        {"identity": "swift-nio", "kind": "remoteSourceControl",
+         "location": "https://github.com/apple/swift-nio.git",
+         "state": {"version": "2.63.0", "revision": "def"}},
+    ],
+    "version": 2,
+})
+
+# Package.resolved v1 (Xcode 11–13): pins nested under "object".
+RESOLVED_V1 = json.dumps({
+    "object": {"pins": [
+        {"package": "Alamofire", "repositoryURL": "https://github.com/Alamofire/Alamofire.git",
+         "state": {"version": "5.8.1", "revision": "xyz"}},
+    ]},
+    "version": 1,
+})
+
+
+def test_detect_swiftpm_project(tmp_path: Path):
+    _write(tmp_path, "Package.swift", PACKAGE_SWIFT)
+    assert SwiftAnalyzer().detect(tmp_path) is True
+
+
+def test_detect_by_source_file(tmp_path: Path):
+    _write(tmp_path, "Sources/App/main.swift", 'print("hi")\n')
+    assert SwiftAnalyzer().detect(tmp_path) is True
+
+
+def test_detect_false_on_unrelated_repo(tmp_path: Path):
+    _write(tmp_path, "app.py", "print('hi')\n")
+    assert SwiftAnalyzer().detect(tmp_path) is False
+
+
+def test_detect_ignores_build_dir(tmp_path: Path):
+    _write(tmp_path, ".build/checkouts/vapor/Package.swift", PACKAGE_SWIFT)
+    assert SwiftAnalyzer().detect(tmp_path) is False
+
+
+def test_framework_and_swiftpm_hints(tmp_path: Path):
+    _write(tmp_path, "Package.swift", PACKAGE_SWIFT)
+    result = SwiftAnalyzer().analyze(tmp_path)
+    hints = [h.hint for h in result.framework_hints]
+    assert "SwiftPM" in hints
+    assert any("Vapor" in h for h in hints)
+
+
+def test_resolved_v2_sbom(tmp_path: Path):
+    _write(tmp_path, "Package.swift", PACKAGE_SWIFT)
+    _write(tmp_path, "Package.resolved", RESOLVED_V2)
+    result = SwiftAnalyzer().analyze(tmp_path)
+    deps = {d.name: d for d in result.dependencies}
+    assert deps["vapor"].version == "4.89.0"
+    assert deps["vapor"].ecosystem == "swiftpm"
+    assert deps["vapor"].resolved is True
+    assert deps["vapor"].direct is True                 # declared in Package.swift
+    assert deps["swift-nio"].version == "2.63.0"
+    assert deps["swift-nio"].direct is True             # apple/swift-nio is declared
+    assert deps["vapor"].source_analyzer == "swift"
+
+
+def test_resolved_v1_sbom(tmp_path: Path):
+    # No Package.swift → no direct set → everything transitive/false.
+    _write(tmp_path, "Package.resolved", RESOLVED_V1)
+    result = SwiftAnalyzer().analyze(tmp_path)
+    deps = {d.name: d for d in result.dependencies}
+    assert deps["alamofire"].version == "5.8.1"
+    assert deps["alamofire"].direct is False
+
+
+def test_resolved_in_xcode_workspace_path(tmp_path: Path):
+    # Xcode stashes Package.resolved under the workspace's xcshareddata.
+    _write(tmp_path, "App.xcworkspace/xcshareddata/swiftpm/Package.resolved", RESOLVED_V2)
+    result = SwiftAnalyzer().analyze(tmp_path)
+    assert {d.name for d in result.dependencies} == {"vapor", "swift-nio"}
+
+
+def test_malformed_resolved_does_not_crash(tmp_path: Path):
+    _write(tmp_path, "Package.swift", PACKAGE_SWIFT)
+    _write(tmp_path, "Package.resolved", "{ this is : not json ]")
+    result = SwiftAnalyzer().analyze(tmp_path)   # must not raise
+    assert result.dependencies == []
+
+
+def test_entrypoints(tmp_path: Path):
+    _write(tmp_path, "Sources/App/main.swift", 'import Foundation\nprint("run")\n')
+    _write(tmp_path, "Sources/App/App.swift", "@main\nstruct App {}\n")
+    result = SwiftAnalyzer().analyze(tmp_path)
+    hints = " ".join(h.hint for h in result.entrypoint_hints)
+    assert "main.swift" in hints
+    assert "@main" in hints
+
+
+def test_metadata_contract():
+    m = SwiftAnalyzer().metadata
+    assert m.name == "swift"
+    assert "swift" in m.languages
+    assert SwiftAnalyzer().name == "swift"