attackmap 0.4.15__tar.gz → 0.4.25__tar.gz

{attackmap-0.4.15/src/attackmap.egg-info → attackmap-0.4.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.15
+Version: 0.4.25
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -77,7 +77,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.4.15).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.4.18).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -128,6 +128,31 @@ model ID verbatim.
 Read `reports/defensive-review.md` (heuristic) and `reports/defensive-review-llm.md`
 (LLM-narrated) side by side.
 
+**Multi-repo (fleet) scan.** Pass two or more repositories to scan a whole fleet
+in one run:
+
+```bash
+attackmap analyze ./service-a ./service-b ./gateway --output reports
+```
+
+Each repo is scanned independently into its own `reports/<repo>/` directory, and
+a `reports/fleet-summary.md` (+ `.json`) indexes the run with per-repo severity
+counts and top findings. AttackMap then **links the seams**: it matches one
+repo's outbound HTTP calls to another repo's routes (by normalized path template
++ method — `base + "/api/orders/" + id` in a caller aligns with `/api/orders/{id}`
+served elsewhere), lists each client→server link (citing both sides) in the fleet
+summary, and renders the repo-to-repo graph to `reports/fleet-graph.md`.
+
+Over those links it then flags **cross-boundary trust** (confused-deputy) risks:
+a value one repo forwards across a link that the callee trusts into a dangerous
+sink or an unguarded object access — each repo looks locally fine; the bug is in
+the seam. These are marked **speculative** (leads to adjudicate, citing both the
+caller and callee sites) and listed in the fleet summary. It also flags
+**trust-assumption gaps** (a state-changing call crossing a link to a route the
+callee serves with no auth — if each side assumes the other enforces, nobody
+does) and **cross-repo anomalies** (the one service that omits an auth control
+its siblings enforce on the same route). Single-repo behavior is unchanged.
+
 ---
 
 ## Install
@@ -384,6 +409,27 @@ excluded from all the heuristic passes above by default, since dangerous
 patterns in test scaffolding are rarely real exposure. Set
 `ATTACKMAP_INCLUDE_TESTS=1` to scan them too (e.g. for test-quality reviews).
 
+**Recall mode (`--recall`).** Aggressiveness is only useful *behind* a verifier —
+so `--recall` widens taint discovery and marks the extra reach **speculative**
+instead of asserting it. It:
+
+- raises the max import-hop depth (2 → 4) and per-route visit budget;
+- surfaces reaches the default pass conservatively hides, like a
+  static-literal-looking `eval`/`exec`/deserialize argument;
+- **enumerates capability-reach**: every reach to a powerful capability —
+  network (`requests`/`httpx`/`axios`/`fetch`/`urlopen`), template
+  (`render_template_string`/`Template`), filesystem (`open`), redirect
+  (`redirect`/`res.redirect`) — even with **no known-bad pattern**, i.e. the
+  bare call without a request-derived argument (a genuine request-derived sink
+  still fires once, as a confirmed finding, not a duplicate).
+
+Speculative chains carry downgraded confidence, get their own LOW-severity
+finding (`SPECULATIVE (recall mode)…`), are excluded from every asserted
+downstream pass (exploitability, BOLA, attack paths), and are kept **out of
+`--fail-on-new-high`** — they are leads for `--hunt --verify` / `--triage` to
+adjudicate, not detections. Default behavior is unchanged; pair `--recall` with
+`--hunt --verify` to widen the net and then adjudicate what it catches.
+
 ### Web hardening gaps
 
 Route- and config-level checks for common web misconfigurations, each an
@@ -516,6 +562,20 @@ within each cohort the odd-one-out is reported:
 | `auth_outlier` | siblings carry an auth/authorization signal near the handler; this route doesn't | HIGH |
 | `validation_outlier` | among a cohort's state-changing handlers, peers validate input and this one shows no validation marker | LOW |
 | `method_outlier` | a lone state-changing method in an otherwise read-only cohort | MEDIUM |
+| `invariant_violation` | a mined-invariant outlier: among handlers that reach the same dangerous sink kind, the majority guard the request *before* the sink and this one doesn't — evidence cites the mined rule | HIGH |
+
+The `invariant_violation` kind is the **mined-invariant** pass (#149a): its
+cohort is not a route-path prefix but the set of handlers that reach the same
+dangerous sink (from the taint pass). When a strong majority guard the request
+before the sink, that pattern is mined as an implicit invariant and the handler
+that reaches the same sink kind with no preceding guard is flagged, citing the
+mined rule (e.g. "9 of 10 handlers that reach a database (SQL execute) sink
+apply an auth/validation guard before it"). It reasons only about **same-file**
+flows, where guard-before-sink ordering is actually verifiable (a cross-file
+sink could be called before an `authorize(...)` that textually follows it), and
+counts one handler per declaration regardless of how many verbs it exposes.
+Sanitized chains are excluded so only genuinely undefended flows form the cohort
+— it measures the code against its own norm and needs no signature.
 
 Everything is peer-relative and **confidence scales with how consistent the
 cohort is** — a lone deviation among many agreeing siblings is likelier a mistake
@@ -664,6 +724,24 @@ to confirm, not detections.** The same grounding contract as the review applies
 assignment, no exploit code, confidence-tiered, and each lead lists exactly what
 a human must verify. Uses the same auth/backend resolution as `--llm`.
 
+With `--verify`, each hypothesis is adjudicated against the actual source at its
+cited locations. **`--verify-votes N`** (default 3) turns that into a jury: **N
+independent skeptics** each adjudicate the same fixed hypothesis list. A lead is
+**CONFIRMED only on a strict majority** (NEEDS_REVIEW only when a majority flags
+the evidence as insufficient); ties and uncertainty are **REFUTED** — so a lead
+only one skeptic would confirm is dropped. **`--hunt-lenses N`** additionally
+fans generation out into N independent passes, each specialised in one failure
+mode (auth-bypass, TOCTOU/race, IDOR, deserialization, SSRF-to-internal,
+secret-misuse), and dedupes the leads across passes before verifying — more
+unique novel leads than a single generalist pass. **`--hunt-rounds N`** loops
+generation for up to N rounds, accumulating new (deduped) leads while a
+completeness critic seeds each next round with untried angles, and stops early
+once a round finds nothing new; **`--hunt-budget T`** caps the multi-round output
+tokens.
+This is the verifier the unknown-bug initiative
+([`docs/unknown-bug-epic.md`](docs/unknown-bug-epic.md)) is built on;
+`--verify-votes 1` is the classic single pass.
+
 Layered on top: **MITRE ATT&CK technique mappings** on every insight and
 **detection opportunities** (Sigma/KQL/Splunk-style hints) for each weakness.
 
@@ -722,6 +800,9 @@ attackmap analyze <path> --llm --llm-provider openai     # use OpenAI/Codex (OPE
 attackmap analyze <path> --llm --llm-provider openai --llm-model gpt-5.5   # any OpenAI model ID, passed through
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
 attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
+attackmap analyze <path> --hunt --verify --verify-votes 3   # majority vote of N independent skeptics (default 3; 1 = single pass)
+attackmap analyze <path> --hunt --verify --hunt-lenses 4     # N lens-specialised generation passes, deduped, then verified
+attackmap analyze <path> --hunt --verify --hunt-rounds 4     # loop-until-dry generation (completeness critic seeds each round)
 attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)
 attackmap analyze <path> --triage        # cluster/dedupe/rank existing findings (triage.md; deterministic fallback)
 attackmap analyze <path> --pr-comment pr.md   # Markdown PR summary comment for CI
@@ -768,7 +849,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.4.15) — published and validated on real codebases, but
+AttackMap is **beta** (v0.4.18) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**

{attackmap-0.4.15 → attackmap-0.4.25}/README.md

@@ -16,7 +16,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.4.15).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.4.18).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -67,6 +67,31 @@ model ID verbatim.
 Read `reports/defensive-review.md` (heuristic) and `reports/defensive-review-llm.md`
 (LLM-narrated) side by side.
 
+**Multi-repo (fleet) scan.** Pass two or more repositories to scan a whole fleet
+in one run:
+
+```bash
+attackmap analyze ./service-a ./service-b ./gateway --output reports
+```
+
+Each repo is scanned independently into its own `reports/<repo>/` directory, and
+a `reports/fleet-summary.md` (+ `.json`) indexes the run with per-repo severity
+counts and top findings. AttackMap then **links the seams**: it matches one
+repo's outbound HTTP calls to another repo's routes (by normalized path template
++ method — `base + "/api/orders/" + id` in a caller aligns with `/api/orders/{id}`
+served elsewhere), lists each client→server link (citing both sides) in the fleet
+summary, and renders the repo-to-repo graph to `reports/fleet-graph.md`.
+
+Over those links it then flags **cross-boundary trust** (confused-deputy) risks:
+a value one repo forwards across a link that the callee trusts into a dangerous
+sink or an unguarded object access — each repo looks locally fine; the bug is in
+the seam. These are marked **speculative** (leads to adjudicate, citing both the
+caller and callee sites) and listed in the fleet summary. It also flags
+**trust-assumption gaps** (a state-changing call crossing a link to a route the
+callee serves with no auth — if each side assumes the other enforces, nobody
+does) and **cross-repo anomalies** (the one service that omits an auth control
+its siblings enforce on the same route). Single-repo behavior is unchanged.
+
 ---
 
 ## Install
@@ -323,6 +348,27 @@ excluded from all the heuristic passes above by default, since dangerous
 patterns in test scaffolding are rarely real exposure. Set
 `ATTACKMAP_INCLUDE_TESTS=1` to scan them too (e.g. for test-quality reviews).
 
+**Recall mode (`--recall`).** Aggressiveness is only useful *behind* a verifier —
+so `--recall` widens taint discovery and marks the extra reach **speculative**
+instead of asserting it. It:
+
+- raises the max import-hop depth (2 → 4) and per-route visit budget;
+- surfaces reaches the default pass conservatively hides, like a
+  static-literal-looking `eval`/`exec`/deserialize argument;
+- **enumerates capability-reach**: every reach to a powerful capability —
+  network (`requests`/`httpx`/`axios`/`fetch`/`urlopen`), template
+  (`render_template_string`/`Template`), filesystem (`open`), redirect
+  (`redirect`/`res.redirect`) — even with **no known-bad pattern**, i.e. the
+  bare call without a request-derived argument (a genuine request-derived sink
+  still fires once, as a confirmed finding, not a duplicate).
+
+Speculative chains carry downgraded confidence, get their own LOW-severity
+finding (`SPECULATIVE (recall mode)…`), are excluded from every asserted
+downstream pass (exploitability, BOLA, attack paths), and are kept **out of
+`--fail-on-new-high`** — they are leads for `--hunt --verify` / `--triage` to
+adjudicate, not detections. Default behavior is unchanged; pair `--recall` with
+`--hunt --verify` to widen the net and then adjudicate what it catches.
+
 ### Web hardening gaps
 
 Route- and config-level checks for common web misconfigurations, each an
@@ -455,6 +501,20 @@ within each cohort the odd-one-out is reported:
 | `auth_outlier` | siblings carry an auth/authorization signal near the handler; this route doesn't | HIGH |
 | `validation_outlier` | among a cohort's state-changing handlers, peers validate input and this one shows no validation marker | LOW |
 | `method_outlier` | a lone state-changing method in an otherwise read-only cohort | MEDIUM |
+| `invariant_violation` | a mined-invariant outlier: among handlers that reach the same dangerous sink kind, the majority guard the request *before* the sink and this one doesn't — evidence cites the mined rule | HIGH |
+
+The `invariant_violation` kind is the **mined-invariant** pass (#149a): its
+cohort is not a route-path prefix but the set of handlers that reach the same
+dangerous sink (from the taint pass). When a strong majority guard the request
+before the sink, that pattern is mined as an implicit invariant and the handler
+that reaches the same sink kind with no preceding guard is flagged, citing the
+mined rule (e.g. "9 of 10 handlers that reach a database (SQL execute) sink
+apply an auth/validation guard before it"). It reasons only about **same-file**
+flows, where guard-before-sink ordering is actually verifiable (a cross-file
+sink could be called before an `authorize(...)` that textually follows it), and
+counts one handler per declaration regardless of how many verbs it exposes.
+Sanitized chains are excluded so only genuinely undefended flows form the cohort
+— it measures the code against its own norm and needs no signature.
 
 Everything is peer-relative and **confidence scales with how consistent the
 cohort is** — a lone deviation among many agreeing siblings is likelier a mistake
@@ -603,6 +663,24 @@ to confirm, not detections.** The same grounding contract as the review applies
 assignment, no exploit code, confidence-tiered, and each lead lists exactly what
 a human must verify. Uses the same auth/backend resolution as `--llm`.
 
+With `--verify`, each hypothesis is adjudicated against the actual source at its
+cited locations. **`--verify-votes N`** (default 3) turns that into a jury: **N
+independent skeptics** each adjudicate the same fixed hypothesis list. A lead is
+**CONFIRMED only on a strict majority** (NEEDS_REVIEW only when a majority flags
+the evidence as insufficient); ties and uncertainty are **REFUTED** — so a lead
+only one skeptic would confirm is dropped. **`--hunt-lenses N`** additionally
+fans generation out into N independent passes, each specialised in one failure
+mode (auth-bypass, TOCTOU/race, IDOR, deserialization, SSRF-to-internal,
+secret-misuse), and dedupes the leads across passes before verifying — more
+unique novel leads than a single generalist pass. **`--hunt-rounds N`** loops
+generation for up to N rounds, accumulating new (deduped) leads while a
+completeness critic seeds each next round with untried angles, and stops early
+once a round finds nothing new; **`--hunt-budget T`** caps the multi-round output
+tokens.
+This is the verifier the unknown-bug initiative
+([`docs/unknown-bug-epic.md`](docs/unknown-bug-epic.md)) is built on;
+`--verify-votes 1` is the classic single pass.
+
 Layered on top: **MITRE ATT&CK technique mappings** on every insight and
 **detection opportunities** (Sigma/KQL/Splunk-style hints) for each weakness.
 
@@ -661,6 +739,9 @@ attackmap analyze <path> --llm --llm-provider openai     # use OpenAI/Codex (OPE
 attackmap analyze <path> --llm --llm-provider openai --llm-model gpt-5.5   # any OpenAI model ID, passed through
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
 attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
+attackmap analyze <path> --hunt --verify --verify-votes 3   # majority vote of N independent skeptics (default 3; 1 = single pass)
+attackmap analyze <path> --hunt --verify --hunt-lenses 4     # N lens-specialised generation passes, deduped, then verified
+attackmap analyze <path> --hunt --verify --hunt-rounds 4     # loop-until-dry generation (completeness critic seeds each round)
 attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)
 attackmap analyze <path> --triage        # cluster/dedupe/rank existing findings (triage.md; deterministic fallback)
 attackmap analyze <path> --pr-comment pr.md   # Markdown PR summary comment for CI
@@ -707,7 +788,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.4.15) — published and validated on real codebases, but
+AttackMap is **beta** (v0.4.18) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**

{attackmap-0.4.15 → attackmap-0.4.25}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.4.15"
+version = "0.4.25"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.4.15 → attackmap-0.4.25}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.4.15"
+__version__ = "0.4.25"

{attackmap-0.4.15 → attackmap-0.4.25}/src/attackmap/analyzers.py

@@ -47,6 +47,7 @@ from .scanner import (
     DB_KEYWORDS,
     DB_PATTERNS,
     EXTERNAL_CALL_PATTERNS,
+    _external_call_fields,
     SECRET_PATTERNS,
     extract_routes,
     scan_repo,
@@ -104,7 +105,10 @@ class ExternalCallAnalyzer:
         calls: list[ExternalCall] = []
         for pattern in EXTERNAL_CALL_PATTERNS:
             for match in pattern.finditer(context.content):
-                calls.append(ExternalCall(target=match.groups()[-1], file=context.relative_path))
+                target, method = _external_call_fields(match)
+                calls.append(
+                    ExternalCall(target=target, method=method, file=context.relative_path)
+                )
         return AnalyzerSignals(external_calls=calls)
 
 
@@ -225,9 +229,14 @@ class DefaultAnalyzer:
     def name(self) -> str:
         return self.metadata.name
 
-    def analyze(self, root: str | Path, progress: "ScanProgress | None" = None) -> AnalyzerResult:
+    def analyze(
+        self, root: str | Path, progress: "ScanProgress | None" = None, recall: bool = False
+    ) -> AnalyzerResult:
         return scan_repo(
-            root, suffixes=set(CODE_EXTENSIONS) - self._CLAIMED_SUFFIXES, progress=progress
+            root,
+            suffixes=set(CODE_EXTENSIONS) - self._CLAIMED_SUFFIXES,
+            progress=progress,
+            recall=recall,
         )
 
 
@@ -249,8 +258,10 @@ class BuiltinPythonWebAnalyzer:
     def name(self) -> str:
         return self.metadata.name
 
-    def analyze(self, root: str | Path, progress: "ScanProgress | None" = None) -> AnalyzerResult:
-        return scan_repo(root, suffixes={".py"}, progress=progress)
+    def analyze(
+        self, root: str | Path, progress: "ScanProgress | None" = None, recall: bool = False
+    ) -> AnalyzerResult:
+        return scan_repo(root, suffixes={".py"}, progress=progress, recall=recall)
 
 
 class BuiltinJavaScriptWebAnalyzer:
@@ -323,8 +334,10 @@ class BuiltinJavaScriptWebAnalyzer:
             return False
         return False
 
-    def analyze(self, root: str | Path, progress: "ScanProgress | None" = None) -> AnalyzerResult:
-        return scan_repo(root, suffixes=self._JS_SUFFIXES, progress=progress)
+    def analyze(
+        self, root: str | Path, progress: "ScanProgress | None" = None, recall: bool = False
+    ) -> AnalyzerResult:
+        return scan_repo(root, suffixes=self._JS_SUFFIXES, progress=progress, recall=recall)
 
 
 class BuiltinConfigAnalyzer:
@@ -604,12 +617,13 @@ def analyze_repository(
     root: str | Path,
     analyzers: Iterable[Analyzer] | None = None,
     progress: "ScanProgress | None" = None,
+    recall: bool = False,
 ) -> AnalyzerResult:
     repo_root = Path(root).resolve()
     active_analyzers = resolve_run_analyzers(repo_root, analyzers=analyzers)
     results: list[AnalyzerResult] = []
     for analyzer in active_analyzers:
-        result = _call_analyze(analyzer, repo_root, progress)
+        result = _call_analyze(analyzer, repo_root, progress, recall)
         _stamp_provenance(result, analyzer.name)
         results.append(result)
     if not results:
@@ -617,17 +631,26 @@ def analyze_repository(
     return merge_analyzer_results(results, root=repo_root)
 
 
-def _call_analyze(analyzer: Analyzer, root: Path, progress: "ScanProgress | None") -> AnalyzerResult:
-    """Invoke ``analyzer.analyze``, forwarding ``progress`` only to analyzers
-    that accept it. Keeps the plugin ``analyze(root)`` contract intact — old
-    plugins that don't know about progress are called unchanged."""
-    if progress is not None:
-        try:
-            if "progress" in inspect.signature(analyzer.analyze).parameters:
-                return analyzer.analyze(root, progress=progress)  # type: ignore[call-arg]
-        except (TypeError, ValueError):
-            pass
-    return analyzer.analyze(root)
+def _call_analyze(
+    analyzer: Analyzer,
+    root: Path,
+    progress: "ScanProgress | None",
+    recall: bool = False,
+) -> AnalyzerResult:
+    """Invoke ``analyzer.analyze``, forwarding ``progress``/``recall`` only to
+    analyzers that accept them. Keeps the plugin ``analyze(root)`` contract
+    intact — old plugins that don't know about these kwargs are called
+    unchanged, and ``recall`` is only ever passed when it's on."""
+    kwargs: dict[str, object] = {}
+    try:
+        params = inspect.signature(analyzer.analyze).parameters
+        if progress is not None and "progress" in params:
+            kwargs["progress"] = progress
+        if recall and "recall" in params:
+            kwargs["recall"] = recall
+    except (TypeError, ValueError):
+        pass
+    return analyzer.analyze(root, **kwargs)  # type: ignore[call-arg]
 
 
 def _stamp_provenance(result: AnalyzerResult, analyzer_name: str) -> None: