attackmap 0.4.2__tar.gz → 0.4.4__tar.gz

{attackmap-0.4.2/src/attackmap.egg-info → attackmap-0.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.2
+Version: 0.4.4
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -36,6 +36,7 @@ Requires-Dist: pydantic>=2.7.0
 Requires-Dist: networkx>=3.3
 Provides-Extra: llm
 Requires-Dist: anthropic>=0.40.0; extra == "llm"
+Requires-Dist: openai>=1.60.0; extra == "llm"
 Provides-Extra: all
 Requires-Dist: attackmap[llm]; extra == "all"
 Requires-Dist: attackmap-analyzer-python>=0.1.0; extra == "all"
@@ -105,6 +106,12 @@ to use your existing Pro/Max subscription:
 attackmap analyze /path/to/repo --output reports --llm
 ```
 
+Prefer OpenAI? Add `--llm-provider openai` to run the same review/hunt/remediate
+phases on OpenAI. Set `OPENAI_API_KEY` for the Responses API, or log in once with
+the [`codex` CLI](https://developers.openai.com/codex) to use your subscription
+(`--llm-backend cli`). Default model is `gpt-5-codex`; `--llm-model` accepts any
+model ID verbatim.
+
 Read `reports/defensive-review.md` (heuristic) and `reports/defensive-review-llm.md`
 (LLM-narrated) side by side.
 
@@ -482,7 +489,9 @@ trust-boundary violations, and more.
 
 **4. LLM narrative review.** With `--llm`, Claude Opus generates a final review
 from the structured evidence pack. The model is forced to cite real
-surface/asset/control IDs, so it can't invent findings.
+surface/asset/control IDs, so it can't invent findings. Add `--llm-provider
+openai` to run the same phase on OpenAI/Codex instead (`gpt-5-codex` by default,
+via `OPENAI_API_KEY` or the `codex` CLI) — the grounding contract is identical.
 
 **5. Vulnerability-hypothesis hunting (`--hunt`).** The honest core of the
 "find the unknown" ask. `attackmap analyze . --hunt` has Claude reason over the
@@ -542,6 +551,8 @@ attackmap analyze <path> --module python --module rust   # only these analyzers
 attackmap analyze <path> --cve           # cross-reference SBOM against OSV.dev
 attackmap analyze <path> --llm           # add LLM narrative (auto-resolve auth)
 attackmap analyze <path> --llm --llm-backend cli         # force Claude CLI
+attackmap analyze <path> --llm --llm-provider openai     # use OpenAI/Codex (OPENAI_API_KEY or `codex` CLI)
+attackmap analyze <path> --llm --llm-provider openai --llm-model gpt-5.5   # any OpenAI model ID, passed through
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
 attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
 attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)

{attackmap-0.4.2 → attackmap-0.4.4}/README.md

@@ -46,6 +46,12 @@ to use your existing Pro/Max subscription:
 attackmap analyze /path/to/repo --output reports --llm
 ```
 
+Prefer OpenAI? Add `--llm-provider openai` to run the same review/hunt/remediate
+phases on OpenAI. Set `OPENAI_API_KEY` for the Responses API, or log in once with
+the [`codex` CLI](https://developers.openai.com/codex) to use your subscription
+(`--llm-backend cli`). Default model is `gpt-5-codex`; `--llm-model` accepts any
+model ID verbatim.
+
 Read `reports/defensive-review.md` (heuristic) and `reports/defensive-review-llm.md`
 (LLM-narrated) side by side.
 
@@ -423,7 +429,9 @@ trust-boundary violations, and more.
 
 **4. LLM narrative review.** With `--llm`, Claude Opus generates a final review
 from the structured evidence pack. The model is forced to cite real
-surface/asset/control IDs, so it can't invent findings.
+surface/asset/control IDs, so it can't invent findings. Add `--llm-provider
+openai` to run the same phase on OpenAI/Codex instead (`gpt-5-codex` by default,
+via `OPENAI_API_KEY` or the `codex` CLI) — the grounding contract is identical.
 
 **5. Vulnerability-hypothesis hunting (`--hunt`).** The honest core of the
 "find the unknown" ask. `attackmap analyze . --hunt` has Claude reason over the
@@ -483,6 +491,8 @@ attackmap analyze <path> --module python --module rust   # only these analyzers
 attackmap analyze <path> --cve           # cross-reference SBOM against OSV.dev
 attackmap analyze <path> --llm           # add LLM narrative (auto-resolve auth)
 attackmap analyze <path> --llm --llm-backend cli         # force Claude CLI
+attackmap analyze <path> --llm --llm-provider openai     # use OpenAI/Codex (OPENAI_API_KEY or `codex` CLI)
+attackmap analyze <path> --llm --llm-provider openai --llm-model gpt-5.5   # any OpenAI model ID, passed through
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
 attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
 attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)

{attackmap-0.4.2 → attackmap-0.4.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.4.2"
+version = "0.4.4"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -56,6 +56,7 @@ dependencies = [
 [project.optional-dependencies]
 llm = [
   "anthropic>=0.40.0",
+  "openai>=1.60.0",
 ]
 all = [
   "attackmap[llm]",

{attackmap-0.4.2 → attackmap-0.4.4}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.4.2"
+__version__ = "0.4.4"

{attackmap-0.4.2 → attackmap-0.4.4}/src/attackmap/cli.py

@@ -69,20 +69,30 @@ def analyze(
         "--llm",
         help="Generate a narrative defensive review by calling Claude with the evidence pack. Auth resolves automatically: ANTHROPIC_API_KEY → ANTHROPIC_AUTH_TOKEN → `claude` CLI (subscription auth). Force a backend with --llm-backend.",
     ),
+    llm_provider: str = typer.Option(
+        "claude",
+        "--llm-provider",
+        help="LLM provider for --llm/--hunt/--remediate: 'claude' (default, Anthropic) or 'openai' (OpenAI/Codex).",
+    ),
     llm_model: str | None = typer.Option(
         None,
         "--llm-model",
-        help="Claude model ID for --llm (defaults to claude-opus-4-7).",
+        help="Model ID for --llm. Claude provider: e.g. claude-opus-4-8 (default), claude-fable-5, claude-sonnet-5, claude-opus-4-7. OpenAI provider: e.g. gpt-5-codex (default), gpt-5.5, gpt-5.4, gpt-5.4-mini — any model ID is passed through verbatim.",
     ),
     llm_effort: str | None = typer.Option(
         None,
         "--llm-effort",
-        help="Effort for --llm: low|medium|high|xhigh|max. Defaults to high.",
+        help="Effort for --llm: low|medium|high|xhigh|max. Defaults to high. For OpenAI, xhigh/max clamp to high (Responses API reasoning effort tops out at high).",
     ),
     llm_backend: str = typer.Option(
         "auto",
         "--llm-backend",
-        help="Which backend --llm uses: 'auto' (default) tries ANTHROPIC_API_KEY → ANTHROPIC_AUTH_TOKEN → `claude` CLI; 'api' forces the SDK; 'cli' forces the `claude` CLI (uses your `claude login` auth, e.g. Pro/Max subscription).",
+        help="Which backend --llm uses. Claude: 'auto' tries ANTHROPIC_API_KEY → ANTHROPIC_AUTH_TOKEN → `claude` CLI; 'api' forces the SDK; 'cli' forces the `claude` CLI. OpenAI: 'auto' tries OPENAI_API_KEY then the `codex` CLI; 'api' forces the OpenAI SDK; 'cli' forces `codex exec` (your `codex login` subscription).",
+    ),
+    llm_speed: str = typer.Option(
+        "standard",
+        "--llm-speed",
+        help="LLM output speed: 'standard' (default) or 'fast'. Fast mode (~2.5x output speed, premium price) applies only to Opus 4.8/4.7 via the API backend; other models/backends fall back to standard.",
     ),
     hunt: bool = typer.Option(
         False,
@@ -155,6 +165,17 @@ def analyze(
 
     if progress_format not in {"auto", "tty", "json", "none"}:
         raise typer.BadParameter("--progress-format must be one of: auto, json, none.")
+    if llm_speed not in {"standard", "fast"}:
+        raise typer.BadParameter("--llm-speed must be one of: standard, fast.")
+    if llm_provider not in {"claude", "openai"}:
+        raise typer.BadParameter("--llm-provider must be one of: claude, openai.")
+    # Provider-aware label for the "via X" progress/echo strings.
+    llm_display = "Codex" if llm_provider == "openai" else "Claude"
+    if llm_provider == "openai" and llm_speed == "fast" and (llm or hunt or remediate):
+        typer.echo(
+            "Note: --llm-speed fast is Claude-only; ignoring it for the OpenAI provider.",
+            err=True,
+        )
     active_analyzers = resolve_run_analyzers(repo_path, analyzers=selected_analyzers)
     scan_progress = create_progress(progress_format, no_progress=no_progress)
     scan = analyze_repository(repo_path, analyzers=active_analyzers, progress=scan_progress)
@@ -259,9 +280,11 @@ def analyze(
 
             typer.echo("")
             typer.echo(
-                f"Generating narrative review via Claude (backend={llm_backend}, may take a minute)..."
+                f"Generating narrative review via {llm_display} (backend={llm_backend}, may take a minute)..."
+            )
+            scan_progress.stage(
+                f"{llm_display} is writing the defensive review (backend={llm_backend})"
             )
-            scan_progress.stage(f"Claude is writing the defensive review (backend={llm_backend})")
             try:
                 result = generate_llm_review(
                     scan,
@@ -271,6 +294,8 @@ def analyze(
                     model=llm_model,
                     effort=effort_value,  # type: ignore[arg-type]
                     backend=llm_backend,  # type: ignore[arg-type]
+                    speed=llm_speed,  # type: ignore[arg-type]
+                    provider=llm_provider,  # type: ignore[arg-type]
                 )
             finally:
                 scan_progress.done()
@@ -312,11 +337,11 @@ def analyze(
             typer.echo("")
             hunt_mode = "hunt_verify" if verify else "hunt"
             typer.echo(
-                f"Hunting for vulnerability hypotheses via Claude "
+                f"Hunting for vulnerability hypotheses via {llm_display} "
                 f"({'adjudicated against source, ' if verify else ''}backend={llm_backend}, may take a minute)..."
             )
             scan_progress.stage(
-                f"Claude is hunting exploit-chain hypotheses"
+                f"{llm_display} is hunting exploit-chain hypotheses"
                 f"{' + verifying against source' if verify else ''} (backend={llm_backend})"
             )
             try:
@@ -329,6 +354,8 @@ def analyze(
                     effort=hunt_effort_value,  # type: ignore[arg-type]
                     backend=llm_backend,  # type: ignore[arg-type]
                     mode=hunt_mode,  # type: ignore[arg-type]
+                    speed=llm_speed,  # type: ignore[arg-type]
+                    provider=llm_provider,  # type: ignore[arg-type]
                 )
             finally:
                 scan_progress.done()
@@ -372,9 +399,11 @@ def analyze(
                 )
             typer.echo("")
             typer.echo(
-                f"Generating remediation suggestions via Claude (backend={llm_backend}, may take a minute)..."
+                f"Generating remediation suggestions via {llm_display} (backend={llm_backend}, may take a minute)..."
+            )
+            scan_progress.stage(
+                f"{llm_display} is drafting remediation suggestions (backend={llm_backend})"
             )
-            scan_progress.stage(f"Claude is drafting remediation suggestions (backend={llm_backend})")
             try:
                 rem_result = generate_llm_review(
                     scan,
@@ -385,6 +414,8 @@ def analyze(
                     effort=rem_effort_value,  # type: ignore[arg-type]
                     backend=llm_backend,  # type: ignore[arg-type]
                     mode="remediate",
+                    speed=llm_speed,  # type: ignore[arg-type]
+                    provider=llm_provider,  # type: ignore[arg-type]
                 )
             finally:
                 scan_progress.done()
@@ -418,8 +449,32 @@ def analyze(
 
 
 @app.command("modules")
-def modules() -> None:
+def modules(
+    json_output: bool = typer.Option(
+        False,
+        "--json",
+        help="Emit the installed analyzer modules as a JSON array "
+        "(name/display_name/description/scope/ecosystems/enabled_by_default). "
+        "Network-free — the remote module-repository section is omitted. "
+        "Intended for tool / GUI front-ends that offer analyzer selection.",
+    ),
+) -> None:
     available_modules = get_available_modules()
+    if json_output:
+        payload = [
+            {
+                "name": meta.name,
+                "display_name": meta.display_name or meta.name,
+                "description": meta.description,
+                "scope": meta.scope,
+                "ecosystems": list(meta.ecosystems),
+                "enabled_by_default": meta.enabled_by_default,
+            }
+            for meta in available_modules
+        ]
+        typer.echo(json.dumps(payload, indent=2))
+        return
+
     if not available_modules:
         typer.echo("No analyzer modules are currently available.")
     else:

{attackmap-0.4.2 → attackmap-0.4.4}/src/attackmap/llm_review.py

@@ -37,11 +37,34 @@ from .review_prompts import (
     render_review_prompts,
 )
 
-DEFAULT_MODEL = "claude-opus-4-7"
+DEFAULT_MODEL = "claude-opus-4-8"
 DEFAULT_EFFORT: Literal["low", "medium", "high", "xhigh", "max"] = "high"
 DEFAULT_MAX_TOKENS = 32000
+
+# Fast mode (2.5x output speed, premium price) is a research-preview beta and
+# only runs on the Opus 4.8 / 4.7 tiers via the API backend — the `claude` CLI
+# backend and other models silently fall back to standard speed.
+FAST_MODE_BETA = "fast-mode-2026-02-01"
+FAST_CAPABLE_MODELS = frozenset({"claude-opus-4-8", "claude-opus-4-7"})
 CLAUDE_CLI_TIMEOUT_SECONDS = 600
 
+# OpenAI / Codex provider. `gpt-5-codex` is the code-optimized GPT-5 (Responses
+# API only) and the safe default; any other model ID is passed through verbatim
+# so we never have to chase OpenAI's point-release churn. Reasoning effort maps
+# onto the Responses API's `reasoning.effort` — OpenAI exposes low/medium/high,
+# so our extended tiers (xhigh/max) clamp down to "high".
+OPENAI_DEFAULT_MODEL = "gpt-5-codex"
+OPENAI_API_TIMEOUT_SECONDS = 900
+CODEX_CLI_TIMEOUT_SECONDS = 900
+OPENAI_EFFORT_MAP = {
+    "low": "low",
+    "medium": "medium",
+    "high": "high",
+    "xhigh": "high",
+    "max": "high",
+}
+
+LlmProvider = Literal["claude", "openai"]
 LlmBackend = Literal["auto", "api", "cli"]
 
 
@@ -121,6 +144,7 @@ def _run_via_sdk(
     max_tokens: int,
     api_key: str | None,
     client: Any | None,
+    speed: str = "standard",
 ) -> LlmReviewResult:
     sdk_client, _ = _resolve_sdk_client(api_key, client)
 
@@ -135,8 +159,17 @@ def _run_via_sdk(
         "output_config": {"effort": effort},
     }
 
+    # Fast mode needs the beta endpoint + flag + top-level speed, and only on
+    # the Opus 4.8/4.7 tiers. Anything else runs at standard speed.
+    fast = speed == "fast" and model in FAST_CAPABLE_MODELS
+    messages_api = sdk_client.messages
+    if fast:
+        request_kwargs["speed"] = "fast"
+        request_kwargs["betas"] = [FAST_MODE_BETA]
+        messages_api = sdk_client.beta.messages
+
     try:
-        with sdk_client.messages.stream(**request_kwargs) as stream:
+        with messages_api.stream(**request_kwargs) as stream:
             final_message = stream.get_final_message()
     except LlmReviewError:
         raise
@@ -285,9 +318,212 @@ def _run_via_claude_cli(
     )
 
 
+# ---------- OpenAI SDK backend (Responses API) ----------
+
+
+def _resolve_openai_client(api_key: str | None, client: Any | None) -> Any:
+    if client is not None:
+        return client
+    try:
+        import openai
+    except ImportError as exc:
+        raise LlmReviewError(
+            "The openai SDK is not installed. Install with `pip install attackmap[llm]` "
+            "to use the OpenAI API backend, or install the `codex` CLI for the CLI backend."
+        ) from exc
+
+    resolved_key = api_key or os.environ.get("OPENAI_API_KEY")
+    if not resolved_key:
+        raise LlmReviewError(
+            "No OpenAI API credentials found. Set OPENAI_API_KEY, or install the `codex` "
+            "CLI and run `codex login` to use --llm-backend cli."
+        )
+    return openai.OpenAI(api_key=resolved_key, timeout=OPENAI_API_TIMEOUT_SECONDS)
+
+
+def _openai_output_text(response: Any) -> str:
+    text = getattr(response, "output_text", None)
+    if isinstance(text, str) and text.strip():
+        return text.strip()
+    # Fallback: walk output items → content blocks → text, for SDK/response
+    # shapes where the `output_text` convenience isn't populated.
+    parts: list[str] = []
+    for item in getattr(response, "output", None) or []:
+        for block in getattr(item, "content", None) or []:
+            value = getattr(block, "text", None)
+            if isinstance(value, str) and value:
+                parts.append(value)
+    return "\n".join(parts).strip()
+
+
+def _openai_usage(usage: Any) -> dict[str, int]:
+    out: dict[str, int] = {}
+    for field in ("input_tokens", "output_tokens"):
+        value = getattr(usage, field, None)
+        if isinstance(value, int):
+            out[field] = value
+    return out
+
+
+def _run_via_openai_sdk(
+    rendered_system: str,
+    rendered_user: str,
+    *,
+    model: str,
+    effort: str,
+    max_tokens: int,
+    api_key: str | None,
+    client: Any | None,
+) -> LlmReviewResult:
+    oi = _resolve_openai_client(api_key, client)
+    reasoning_effort = OPENAI_EFFORT_MAP.get(effort, "high")
+
+    try:
+        response = oi.responses.create(
+            model=model,
+            instructions=rendered_system,
+            input=rendered_user,
+            reasoning={"effort": reasoning_effort},
+            max_output_tokens=max_tokens,
+        )
+    except LlmReviewError:
+        raise
+    except Exception as exc:  # pragma: no cover - surface SDK errors verbatim
+        raise LlmReviewError(f"OpenAI API call failed: {exc}") from exc
+
+    markdown = _openai_output_text(response)
+    if not markdown:
+        raise LlmReviewError("OpenAI returned no text content for the review.")
+
+    status = getattr(response, "status", None)
+    return LlmReviewResult(
+        markdown=markdown,
+        model=str(getattr(response, "model", None) or model),
+        stop_reason=status if isinstance(status, str) else None,
+        usage=_openai_usage(getattr(response, "usage", None)),
+        backend="api",
+    )
+
+
+# ---------- Codex CLI backend ----------
+
+
+def _codex_cli_available() -> bool:
+    return shutil.which("codex") is not None
+
+
+def _run_via_codex_cli(
+    rendered_system: str,
+    rendered_user: str,
+    *,
+    model: str,
+    effort: str,
+    runner: Any | None = None,
+) -> LlmReviewResult:
+    """Invoke `codex exec` non-interactively and return the final message.
+
+    `codex exec` treats the positional prompt as the instruction and piped
+    stdin as additional context, so we pass the rendered system prompt as the
+    argument and stream the (large) evidence pack in on stdin. It prints only
+    the final agent message to stdout. Runs read-only so it can never mutate the
+    working tree, and `--skip-git-repo-check` lets it run outside a git repo.
+
+    The `runner` argument is only used by tests to inject a fake subprocess
+    runner; in production we go straight to subprocess.run.
+    """
+    if runner is None and not _codex_cli_available():
+        raise LlmReviewError(
+            "`codex` CLI was not found on PATH. Install it (npm install -g @openai/codex) "
+            "and run `codex login`, or set OPENAI_API_KEY to use --llm-backend api."
+        )
+
+    reasoning_effort = OPENAI_EFFORT_MAP.get(effort, "high")
+    cmd = [
+        "codex",
+        "exec",
+        "--model",
+        model,
+        "-c",
+        f'model_reasoning_effort="{reasoning_effort}"',
+        "--sandbox",
+        "read-only",
+        "--skip-git-repo-check",
+        rendered_system,
+    ]
+
+    try:
+        if runner is None:
+            completed = subprocess.run(
+                cmd,
+                input=rendered_user,
+                text=True,
+                capture_output=True,
+                check=False,
+                timeout=CODEX_CLI_TIMEOUT_SECONDS,
+            )
+        else:
+            completed = runner(cmd, rendered_user)
+    except FileNotFoundError as exc:
+        raise LlmReviewError("`codex` CLI was not found on PATH.") from exc
+    except subprocess.TimeoutExpired as exc:
+        raise LlmReviewError(
+            f"`codex` CLI did not respond within {CODEX_CLI_TIMEOUT_SECONDS}s."
+        ) from exc
+
+    stdout = (completed.stdout or "").strip()
+    stderr = (completed.stderr or "").strip()
+    if completed.returncode != 0:
+        hint = ""
+        low = stderr.lower()
+        if "not logged in" in low or "login" in low or "auth" in low:
+            hint = (
+                " Run `codex login`, or use --llm-backend api with OPENAI_API_KEY set."
+            )
+        raise LlmReviewError(
+            f"`codex` CLI exited with status {completed.returncode}: "
+            f"{stderr or '<no stderr>'}.{hint}"
+        )
+    if not stdout:
+        raise LlmReviewError("`codex` CLI produced no output.")
+
+    return LlmReviewResult(
+        markdown=stdout,
+        model=model,
+        stop_reason=None,
+        usage={},
+        backend="cli",
+    )
+
+
 # ---------- Public entry point ----------
 
 
+def _resolve_openai_backend(
+    backend: LlmBackend,
+    *,
+    api_key: str | None,
+    client: Any | None,
+    codex_runner: Any | None,
+) -> Literal["api", "cli"]:
+    if backend == "api":
+        return "api"
+    if backend == "cli":
+        if codex_runner is None and not _codex_cli_available():
+            raise LlmReviewError(
+                "`--llm-backend cli` was requested but the `codex` CLI is not on PATH."
+            )
+        return "cli"
+    # auto
+    if client is not None or api_key or os.environ.get("OPENAI_API_KEY"):
+        return "api"
+    if _codex_cli_available():
+        return "cli"
+    raise LlmReviewError(
+        "No OpenAI backend available. Set OPENAI_API_KEY, or install the `codex` "
+        "CLI and run `codex login`."
+    )
+
+
 def _resolve_backend(
     backend: LlmBackend,
     *,
@@ -329,17 +565,23 @@ def generate_llm_review(
     backend: LlmBackend = "auto",
     cli_runner: Any | None = None,
     mode: Literal["review", "hunt", "hunt_verify", "remediate"] = "review",
+    speed: Literal["standard", "fast"] = "standard",
+    provider: LlmProvider = "claude",
+    openai_client: Any | None = None,
+    codex_runner: Any | None = None,
 ) -> LlmReviewResult:
     """Produce a narrative defensive review — or, with ``mode="hunt"``, ranked
-    vulnerability hypotheses (#80) — by calling Claude.
-
-    Resolves which backend to use (API SDK or `claude` CLI) based on available
-    auth, then runs the appropriate prompt pack through it. Streams the SDK path
-    so we never hit HTTP timeouts on long reviews. The CLI path runs synchronously
-    via `claude -p --output-format=json`. Both modes share the same evidence
-    grounding contract (every claim cites evidence IDs).
+    vulnerability hypotheses (#80) — by calling an LLM.
+
+    ``provider`` selects Claude (default) or OpenAI/Codex. For each provider,
+    the backend resolves to an API SDK or a subscription CLI based on available
+    auth, then runs the appropriate prompt pack through it. The Claude SDK path
+    streams so we never hit HTTP timeouts on long reviews; the `claude` CLI path
+    runs `claude -p --output-format=json`. The OpenAI path uses the Responses
+    API; the `codex` CLI path runs `codex exec`. All modes share the same
+    evidence grounding contract (every claim cites evidence IDs). ``speed`` (Fast
+    mode) is Claude/API-only and ignored for OpenAI.
     """
-    resolved_model = model or os.environ.get("ATTACKMAP_LLM_MODEL") or DEFAULT_MODEL
     resolved_effort = effort or DEFAULT_EFFORT
 
     render = {
@@ -348,6 +590,36 @@ def generate_llm_review(
         "remediate": render_remediation_prompts,
     }.get(mode, render_review_prompts)
     rendered = render(scan, attack_surfaces, findings, attack_paths)
+
+    if provider == "openai":
+        resolved_model = (
+            model or os.environ.get("ATTACKMAP_OPENAI_MODEL") or OPENAI_DEFAULT_MODEL
+        )
+        if backend == "cli" and codex_runner is not None:
+            chosen: Literal["api", "cli"] = "cli"
+        else:
+            chosen = _resolve_openai_backend(
+                backend, api_key=api_key, client=openai_client, codex_runner=codex_runner
+            )
+        if chosen == "api":
+            return _run_via_openai_sdk(
+                rendered.system,
+                rendered.user,
+                model=resolved_model,
+                effort=resolved_effort,
+                max_tokens=max_tokens,
+                api_key=api_key,
+                client=openai_client,
+            )
+        return _run_via_codex_cli(
+            rendered.system,
+            rendered.user,
+            model=resolved_model,
+            effort=resolved_effort,
+            runner=codex_runner,
+        )
+
+    resolved_model = model or os.environ.get("ATTACKMAP_LLM_MODEL") or DEFAULT_MODEL
     if backend == "cli" and cli_runner is not None:
         chosen_backend: Literal["api", "cli"] = "cli"
     else:
@@ -362,6 +634,7 @@ def generate_llm_review(
             max_tokens=max_tokens,
             api_key=api_key,
             client=client,
+            speed=speed,
         )
     return _run_via_claude_cli(
         rendered.system,
@@ -376,7 +649,9 @@ __all__ = [
     "LlmReviewError",
     "LlmReviewResult",
     "LlmBackend",
+    "LlmProvider",
     "DEFAULT_MODEL",
+    "OPENAI_DEFAULT_MODEL",
     "DEFAULT_EFFORT",
     "DEFAULT_MAX_TOKENS",
 ]

{attackmap-0.4.2 → attackmap-0.4.4/src/attackmap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.2
+Version: 0.4.4
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -36,6 +36,7 @@ Requires-Dist: pydantic>=2.7.0
 Requires-Dist: networkx>=3.3
 Provides-Extra: llm
 Requires-Dist: anthropic>=0.40.0; extra == "llm"
+Requires-Dist: openai>=1.60.0; extra == "llm"
 Provides-Extra: all
 Requires-Dist: attackmap[llm]; extra == "all"
 Requires-Dist: attackmap-analyzer-python>=0.1.0; extra == "all"
@@ -105,6 +106,12 @@ to use your existing Pro/Max subscription:
 attackmap analyze /path/to/repo --output reports --llm
 ```
 
+Prefer OpenAI? Add `--llm-provider openai` to run the same review/hunt/remediate
+phases on OpenAI. Set `OPENAI_API_KEY` for the Responses API, or log in once with
+the [`codex` CLI](https://developers.openai.com/codex) to use your subscription
+(`--llm-backend cli`). Default model is `gpt-5-codex`; `--llm-model` accepts any
+model ID verbatim.
+
 Read `reports/defensive-review.md` (heuristic) and `reports/defensive-review-llm.md`
 (LLM-narrated) side by side.
 
@@ -482,7 +489,9 @@ trust-boundary violations, and more.
 
 **4. LLM narrative review.** With `--llm`, Claude Opus generates a final review
 from the structured evidence pack. The model is forced to cite real
-surface/asset/control IDs, so it can't invent findings.
+surface/asset/control IDs, so it can't invent findings. Add `--llm-provider
+openai` to run the same phase on OpenAI/Codex instead (`gpt-5-codex` by default,
+via `OPENAI_API_KEY` or the `codex` CLI) — the grounding contract is identical.
 
 **5. Vulnerability-hypothesis hunting (`--hunt`).** The honest core of the
 "find the unknown" ask. `attackmap analyze . --hunt` has Claude reason over the
@@ -542,6 +551,8 @@ attackmap analyze <path> --module python --module rust   # only these analyzers
 attackmap analyze <path> --cve           # cross-reference SBOM against OSV.dev
 attackmap analyze <path> --llm           # add LLM narrative (auto-resolve auth)
 attackmap analyze <path> --llm --llm-backend cli         # force Claude CLI
+attackmap analyze <path> --llm --llm-provider openai     # use OpenAI/Codex (OPENAI_API_KEY or `codex` CLI)
+attackmap analyze <path> --llm --llm-provider openai --llm-model gpt-5.5   # any OpenAI model ID, passed through
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
 attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
 attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)

{attackmap-0.4.2 → attackmap-0.4.4}/src/attackmap.egg-info/SOURCES.txt

@@ -71,6 +71,7 @@ tests/test_hunt.py
 tests/test_injection_sinks.py
 tests/test_llm_review.py
 tests/test_merge.py
+tests/test_modules_cli.py
 tests/test_pr_comment.py
 tests/test_progress.py
 tests/test_provenance.py