attackmap 0.6.4__tar.gz

attackmap-0.6.4/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap-0.6.4/PKG-INFO

@@ -0,0 +1,226 @@
+Metadata-Version: 2.4
+Name: attackmap
+Version: 0.6.4
+Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
+Author: AttackMap Contributors
+Author-email: Matthew Davis <mlaify@mlaify.io>
+Maintainer-email: Matthew Davis <mlaify@mlaify.io>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/AttackMap
+Project-URL: Documentation, https://github.com/mlaify/AttackMap/wiki
+Project-URL: Repository, https://github.com/mlaify/AttackMap
+Project-URL: Issues, https://github.com/mlaify/AttackMap/issues
+Project-URL: Changelog, https://github.com/mlaify/AttackMap/blob/main/CHANGELOG.md
+Keywords: security,static-analysis,appsec,defensive-security,threat-modeling,attack-surface,mitre-attack,detection-engineering,code-review,llm,claude
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Testing
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: typer>=0.12.3
+Requires-Dist: pydantic>=2.7.0
+Requires-Dist: networkx>=3.3
+Requires-Dist: PyYAML>=6.0
+Provides-Extra: llm
+Requires-Dist: anthropic>=0.40.0; extra == "llm"
+Requires-Dist: openai>=1.60.0; extra == "llm"
+Provides-Extra: all
+Requires-Dist: attackmap[llm]; extra == "all"
+Requires-Dist: attackmap-analyzer-python==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-rust==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-go==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-java-spring==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-dotnet==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-terraform==0.2.1; extra == "all"
+Requires-Dist: attackmap-analyzer-c==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-cpp==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-swift==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-node-service==0.3.0; extra == "all"
+Requires-Dist: attackmap-analyzer-atproto==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-php-web==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-php-laminas==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-omeka-s==0.2.0; extra == "all"
+Requires-Dist: attackmap-analyzer-iac==0.2.0; extra == "all"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: jsonschema>=4.0; extra == "dev"
+Requires-Dist: pysigma>=2.0; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+Dynamic: license-file
+
+# AttackMap
+
+> [!IMPORTANT]
+> **Active development, slow pace.** AttackMap is under active development, but
+> progress may be slow until more contributors or co-maintainers join. Help is
+> very welcome with the core engine, an analyzer, the macOS app, or the docs —
+> see [CONTRIBUTING.md](https://github.com/mlaify/AttackMap/blob/main/CONTRIBUTING.md) or open an issue on
+> [mlaify/AttackMap](https://github.com/mlaify/AttackMap/issues) to say hello.
+> Security reports are still welcome at [security@mlaify.io](mailto:security@mlaify.io).
+
+**Local-first, AI-assisted defensive security analysis for codebases.** AttackMap
+reads a repository (or a whole fleet of them), reconstructs the attack surface —
+routes, data stores, external calls, auth signals, trust boundaries — traces
+request-to-sink data flow, and produces an evidence-grounded, prioritized security
+review. It finds the cross-cutting weaknesses single-file scanners miss, and never
+sends your code anywhere.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/mlaify/AttackMap/blob/main/LICENSE)
+[![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
+
+> **Status: beta (v0.6.4).** Core engine + 15 analyzer plugins, published on
+> [PyPI](https://pypi.org/project/attackmap/) and validated on real codebases. AttackMap is heuristic by
+> design — findings are confidence-tiered evidence, not proof. Roadmap to 1.0:
+> [issue #209](https://github.com/mlaify/AttackMap/issues/209).
+
+Full documentation: **[docs.mlaify.io](https://docs.mlaify.io)** ·
+architecture & internals: **[wiki](https://github.com/mlaify/AttackMap/wiki)**.
+
+### The macOS app
+
+Prefer a GUI? A native macOS front-end drives this CLI and renders every result
+view. Install it with Homebrew (this also installs the CLI), or build it from
+source at [mlaify/AttackMap-mac](https://github.com/mlaify/AttackMap-mac):
+
+```bash
+brew install --cask mlaify/tap/attackmap-app
+```
+
+| Overview | Exploitability |
+|---|---|
+| [![AttackMap macOS app — overview](https://raw.githubusercontent.com/mlaify/AttackMap/main/docs/screenshots/04-overview.png)](https://docs.mlaify.io/gui/) | [![AttackMap macOS app — exploitability](https://raw.githubusercontent.com/mlaify/AttackMap/main/docs/screenshots/06-exploitability-ranked.png)](https://docs.mlaify.io/gui/) |
+
+*Scanning OWASP Juice Shop. Walkthrough in the [macOS app docs](https://docs.mlaify.io/gui/); source at [mlaify/AttackMap-mac](https://github.com/mlaify/AttackMap-mac).*
+
+## Quickstart
+
+```bash
+brew install mlaify/tap/attackmap         # Homebrew: CLI + all 15 analyzer plugins
+# or, from PyPI: uv tool install "attackmap[all]"   (or pipx install "attackmap[all]")
+attackmap analyze /path/to/repo           # heuristic review → reports/
+attackmap analyze /path/to/repo --llm     # + AI-narrated review (Claude or OpenAI)
+attackmap analyze ./svc-a ./svc-b ./gw    # cross-repo / fleet scan
+```
+
+Read `reports/defensive-review.md` for the heuristic review, and (with `--llm`)
+`reports/defensive-review-llm.md` for the AI narration. `--llm` resolves auth
+automatically (`ANTHROPIC_API_KEY`, or your Claude/`codex` CLI subscription); add
+`--llm-provider openai` for OpenAI/Codex.
+
+Other install paths: `pip install git+https://github.com/mlaify/AttackMap.git` (core
+only), or the `[llm]` extra for AI narration. Not sure
+which analyzer plugins a repo needs? `attackmap suggest ./repo`. Full install and
+CI setup: **[install guide](https://docs.mlaify.io/install/)**.
+
+## What it finds
+
+- **Attack-surface recon** — routes, data stores, external calls, auth signals,
+  secrets, frameworks, entrypoints; every signal carries a `file:line` citation,
+  evidence snippet, and confidence.
+- **Data-flow / injection taint** (Python, JS/TS, Go, PHP, Java, C#, Ruby) —
+  SQL, shell, eval/code and expression (SpEL/OGNL) injection, JNDI, SSRF, SSTI,
+  NoSQL, LDAP, XPath, path traversal and zip-slip, deserialization, open
+  redirect, header and regex injection — traced source → variable → sink
+  inside each handler, with flow-bound sanitizers, SARIF `codeFlows`, a
+  plugin-extensible sink registry (`taint_sinks.yaml`), and a deterministic
+  0–100 **exploitability score**.
+- **Novel vuln classes** — prototype pollution, mass assignment, JWT, XXE, ReDoS,
+  insecure upload, GraphQL exposure; **BOLA/IDOR** authorization; insecure-crypto
+  & web-hardening; anomaly/outlier + signature-free **invariant mining**.
+- **Dependency CVEs** (`--cve`) — SBOM + lockfile resolution against OSV.dev,
+  folded into the exploitability score.
+- **Unknown-bug discovery** — `--hunt --verify` (a multi-pass, majority-vote LLM
+  jury), verifier-gated `--recall`, and **cross-repo / fleet** analysis:
+  confused-deputy flows, trust-assumption gaps, and the sibling service that omits
+  a control its peers enforce.
+- **Workflow** — `--triage`, `--remediate`, finding suppression, baseline diff
+  gating, SARIF + Mermaid/Graphviz output, and a GitHub **Action + PR bot**.
+
+Each run writes Markdown, JSON (`attackmap-report.json`), **SARIF 2.1.0**, and
+diagram artifacts; fleet runs add `fleet-summary.{md,json}` + `fleet-graph.md`.
+See the [outputs reference](https://docs.mlaify.io/scanning/) for the full list.
+
+## Supported ecosystems
+
+Fourteen analyzer plugins (each installable on its own; `[all]` installs every one):
+**Python**, **JavaScript/TypeScript** (Node services), **Go**, **Java/Kotlin**
+(Spring), **C#** (ASP.NET Core), **Rust**, **PHP** (web / Laminas / Omeka-S),
+**C**, **C++**, **Terraform**, **IaC** (Docker / compose / GitHub Actions),
+**AT Protocol**. Specialty and experimental analyzers are opt-in: when one
+matches a repo, `analyze` says so, and `-m <name>` runs it (`attackmap modules`
+shows which). Details: [analyzers reference](https://docs.mlaify.io/analyzers/).
+Write your own against the documented [analyzer SDK](https://github.com/mlaify/AttackMap/blob/main/docs/external-analyzers.md).
+
+## CLI cheat-sheet
+
+```bash
+attackmap analyze <path>                  # review a repo (--output dir, --format all|json|markdown)
+attackmap analyze repoA repoB …           # multi-repo fleet scan
+attackmap analyze <path> --cve            # dependency CVEs (OSV.dev)
+attackmap analyze <path> --recall         # widen taint discovery (extra reach = SPECULATIVE)
+attackmap analyze <path> --llm            # AI narrative (--llm-provider claude|openai)
+attackmap analyze <path> --hunt --verify  # LLM exploit-hypothesis hunt, adjudicated vs. source
+attackmap analyze <path> --triage         # cluster/dedupe/rank existing findings
+attackmap analyze <path> --remediate      # review-first fix suggestions
+attackmap analyze <path> --baseline prev.json --fail-on-new-high   # PR gate
+attackmap suggest ./repo                  # recommend analyzer plugins    · attackmap modules  # list installed
+```
+
+Verify-jury knobs (`--verify-votes` / `--hunt-lenses` / `--hunt-rounds` /
+`--hunt-budget`) and suppression (`--no-suppress` / `--suppress-file`) are
+documented in the [CLI reference](https://docs.mlaify.io/cli/).
+
+## What AttackMap is *not*
+
+- **Not a runtime detector.** It's static; its detection hints are leads for your
+  SIEM team, not deployable rules.
+- **Not a replacement for dedicated SCA.** `--cve` folds CVE signal into an
+  architecture-aware narrative; Trivy/Grype/Dependabot go deeper on resolution.
+- **Not a sound taint engine.** Taint follows local assignments *within* one
+  function (intra-procedural def-use) and a call-graph-refined import walk
+  *across* files; it does not follow a value into a helper it is passed to, and
+  branches are not distinguished. Precision over recall; findings are evidence,
+  not proof. See the limits in `src/attackmap/taint_flow.py`.
+- **Not exhaustive.** Heuristic by design, with explicit confidence tiers and
+  guardrails for stale signals.
+
+## Documentation & links
+
+- **[docs.mlaify.io](https://docs.mlaify.io)** — user guide, install, CLI,
+  analyzers, SDK
+- **[Wiki](https://github.com/mlaify/AttackMap/wiki)** — architecture, roadmap,
+  contributor references
+- **[Roadmap / Bug Triage / Kanban](https://github.com/orgs/mlaify/projects)** —
+  project boards · [Road to 1.0](https://github.com/mlaify/AttackMap/issues/209)
+- [`CHANGELOG.md`](https://github.com/mlaify/AttackMap/blob/main/CHANGELOG.md) · [`CONTRIBUTING.md`](https://github.com/mlaify/AttackMap/blob/main/CONTRIBUTING.md) ·
+  [`SECURITY.md`](https://github.com/mlaify/AttackMap/blob/main/SECURITY.md) · [`VISION.md`](https://github.com/mlaify/AttackMap/blob/main/VISION.md)
+
+## Special thanks
+
+AttackMap is built by its contributors.
+
+<a href="https://github.com/mlaify/AttackMap/graphs/contributors"><img src="https://contrib.rocks/image?repo=mlaify/AttackMap" alt="AttackMap contributors" /></a>
+
+## Contributing
+
+Issues and PRs welcome — see [CONTRIBUTING.md](https://github.com/mlaify/AttackMap/blob/main/CONTRIBUTING.md). By contributing
+you agree your contributions will be MIT-licensed.
+
+## License
+
+[MIT](https://github.com/mlaify/AttackMap/blob/main/LICENSE). Copyright (c) 2026 Matthew Davis and AttackMap Contributors.

attackmap-0.6.4/README.md

@@ -0,0 +1,161 @@
+# AttackMap
+
+> [!IMPORTANT]
+> **Active development, slow pace.** AttackMap is under active development, but
+> progress may be slow until more contributors or co-maintainers join. Help is
+> very welcome with the core engine, an analyzer, the macOS app, or the docs —
+> see [CONTRIBUTING.md](https://github.com/mlaify/AttackMap/blob/main/CONTRIBUTING.md) or open an issue on
+> [mlaify/AttackMap](https://github.com/mlaify/AttackMap/issues) to say hello.
+> Security reports are still welcome at [security@mlaify.io](mailto:security@mlaify.io).
+
+**Local-first, AI-assisted defensive security analysis for codebases.** AttackMap
+reads a repository (or a whole fleet of them), reconstructs the attack surface —
+routes, data stores, external calls, auth signals, trust boundaries — traces
+request-to-sink data flow, and produces an evidence-grounded, prioritized security
+review. It finds the cross-cutting weaknesses single-file scanners miss, and never
+sends your code anywhere.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/mlaify/AttackMap/blob/main/LICENSE)
+[![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
+
+> **Status: beta (v0.6.4).** Core engine + 15 analyzer plugins, published on
+> [PyPI](https://pypi.org/project/attackmap/) and validated on real codebases. AttackMap is heuristic by
+> design — findings are confidence-tiered evidence, not proof. Roadmap to 1.0:
+> [issue #209](https://github.com/mlaify/AttackMap/issues/209).
+
+Full documentation: **[docs.mlaify.io](https://docs.mlaify.io)** ·
+architecture & internals: **[wiki](https://github.com/mlaify/AttackMap/wiki)**.
+
+### The macOS app
+
+Prefer a GUI? A native macOS front-end drives this CLI and renders every result
+view. Install it with Homebrew (this also installs the CLI), or build it from
+source at [mlaify/AttackMap-mac](https://github.com/mlaify/AttackMap-mac):
+
+```bash
+brew install --cask mlaify/tap/attackmap-app
+```
+
+| Overview | Exploitability |
+|---|---|
+| [![AttackMap macOS app — overview](https://raw.githubusercontent.com/mlaify/AttackMap/main/docs/screenshots/04-overview.png)](https://docs.mlaify.io/gui/) | [![AttackMap macOS app — exploitability](https://raw.githubusercontent.com/mlaify/AttackMap/main/docs/screenshots/06-exploitability-ranked.png)](https://docs.mlaify.io/gui/) |
+
+*Scanning OWASP Juice Shop. Walkthrough in the [macOS app docs](https://docs.mlaify.io/gui/); source at [mlaify/AttackMap-mac](https://github.com/mlaify/AttackMap-mac).*
+
+## Quickstart
+
+```bash
+brew install mlaify/tap/attackmap         # Homebrew: CLI + all 15 analyzer plugins
+# or, from PyPI: uv tool install "attackmap[all]"   (or pipx install "attackmap[all]")
+attackmap analyze /path/to/repo           # heuristic review → reports/
+attackmap analyze /path/to/repo --llm     # + AI-narrated review (Claude or OpenAI)
+attackmap analyze ./svc-a ./svc-b ./gw    # cross-repo / fleet scan
+```
+
+Read `reports/defensive-review.md` for the heuristic review, and (with `--llm`)
+`reports/defensive-review-llm.md` for the AI narration. `--llm` resolves auth
+automatically (`ANTHROPIC_API_KEY`, or your Claude/`codex` CLI subscription); add
+`--llm-provider openai` for OpenAI/Codex.
+
+Other install paths: `pip install git+https://github.com/mlaify/AttackMap.git` (core
+only), or the `[llm]` extra for AI narration. Not sure
+which analyzer plugins a repo needs? `attackmap suggest ./repo`. Full install and
+CI setup: **[install guide](https://docs.mlaify.io/install/)**.
+
+## What it finds
+
+- **Attack-surface recon** — routes, data stores, external calls, auth signals,
+  secrets, frameworks, entrypoints; every signal carries a `file:line` citation,
+  evidence snippet, and confidence.
+- **Data-flow / injection taint** (Python, JS/TS, Go, PHP, Java, C#, Ruby) —
+  SQL, shell, eval/code and expression (SpEL/OGNL) injection, JNDI, SSRF, SSTI,
+  NoSQL, LDAP, XPath, path traversal and zip-slip, deserialization, open
+  redirect, header and regex injection — traced source → variable → sink
+  inside each handler, with flow-bound sanitizers, SARIF `codeFlows`, a
+  plugin-extensible sink registry (`taint_sinks.yaml`), and a deterministic
+  0–100 **exploitability score**.
+- **Novel vuln classes** — prototype pollution, mass assignment, JWT, XXE, ReDoS,
+  insecure upload, GraphQL exposure; **BOLA/IDOR** authorization; insecure-crypto
+  & web-hardening; anomaly/outlier + signature-free **invariant mining**.
+- **Dependency CVEs** (`--cve`) — SBOM + lockfile resolution against OSV.dev,
+  folded into the exploitability score.
+- **Unknown-bug discovery** — `--hunt --verify` (a multi-pass, majority-vote LLM
+  jury), verifier-gated `--recall`, and **cross-repo / fleet** analysis:
+  confused-deputy flows, trust-assumption gaps, and the sibling service that omits
+  a control its peers enforce.
+- **Workflow** — `--triage`, `--remediate`, finding suppression, baseline diff
+  gating, SARIF + Mermaid/Graphviz output, and a GitHub **Action + PR bot**.
+
+Each run writes Markdown, JSON (`attackmap-report.json`), **SARIF 2.1.0**, and
+diagram artifacts; fleet runs add `fleet-summary.{md,json}` + `fleet-graph.md`.
+See the [outputs reference](https://docs.mlaify.io/scanning/) for the full list.
+
+## Supported ecosystems
+
+Fourteen analyzer plugins (each installable on its own; `[all]` installs every one):
+**Python**, **JavaScript/TypeScript** (Node services), **Go**, **Java/Kotlin**
+(Spring), **C#** (ASP.NET Core), **Rust**, **PHP** (web / Laminas / Omeka-S),
+**C**, **C++**, **Terraform**, **IaC** (Docker / compose / GitHub Actions),
+**AT Protocol**. Specialty and experimental analyzers are opt-in: when one
+matches a repo, `analyze` says so, and `-m <name>` runs it (`attackmap modules`
+shows which). Details: [analyzers reference](https://docs.mlaify.io/analyzers/).
+Write your own against the documented [analyzer SDK](https://github.com/mlaify/AttackMap/blob/main/docs/external-analyzers.md).
+
+## CLI cheat-sheet
+
+```bash
+attackmap analyze <path>                  # review a repo (--output dir, --format all|json|markdown)
+attackmap analyze repoA repoB …           # multi-repo fleet scan
+attackmap analyze <path> --cve            # dependency CVEs (OSV.dev)
+attackmap analyze <path> --recall         # widen taint discovery (extra reach = SPECULATIVE)
+attackmap analyze <path> --llm            # AI narrative (--llm-provider claude|openai)
+attackmap analyze <path> --hunt --verify  # LLM exploit-hypothesis hunt, adjudicated vs. source
+attackmap analyze <path> --triage         # cluster/dedupe/rank existing findings
+attackmap analyze <path> --remediate      # review-first fix suggestions
+attackmap analyze <path> --baseline prev.json --fail-on-new-high   # PR gate
+attackmap suggest ./repo                  # recommend analyzer plugins    · attackmap modules  # list installed
+```
+
+Verify-jury knobs (`--verify-votes` / `--hunt-lenses` / `--hunt-rounds` /
+`--hunt-budget`) and suppression (`--no-suppress` / `--suppress-file`) are
+documented in the [CLI reference](https://docs.mlaify.io/cli/).
+
+## What AttackMap is *not*
+
+- **Not a runtime detector.** It's static; its detection hints are leads for your
+  SIEM team, not deployable rules.
+- **Not a replacement for dedicated SCA.** `--cve` folds CVE signal into an
+  architecture-aware narrative; Trivy/Grype/Dependabot go deeper on resolution.
+- **Not a sound taint engine.** Taint follows local assignments *within* one
+  function (intra-procedural def-use) and a call-graph-refined import walk
+  *across* files; it does not follow a value into a helper it is passed to, and
+  branches are not distinguished. Precision over recall; findings are evidence,
+  not proof. See the limits in `src/attackmap/taint_flow.py`.
+- **Not exhaustive.** Heuristic by design, with explicit confidence tiers and
+  guardrails for stale signals.
+
+## Documentation & links
+
+- **[docs.mlaify.io](https://docs.mlaify.io)** — user guide, install, CLI,
+  analyzers, SDK
+- **[Wiki](https://github.com/mlaify/AttackMap/wiki)** — architecture, roadmap,
+  contributor references
+- **[Roadmap / Bug Triage / Kanban](https://github.com/orgs/mlaify/projects)** —
+  project boards · [Road to 1.0](https://github.com/mlaify/AttackMap/issues/209)
+- [`CHANGELOG.md`](https://github.com/mlaify/AttackMap/blob/main/CHANGELOG.md) · [`CONTRIBUTING.md`](https://github.com/mlaify/AttackMap/blob/main/CONTRIBUTING.md) ·
+  [`SECURITY.md`](https://github.com/mlaify/AttackMap/blob/main/SECURITY.md) · [`VISION.md`](https://github.com/mlaify/AttackMap/blob/main/VISION.md)
+
+## Special thanks
+
+AttackMap is built by its contributors.
+
+<a href="https://github.com/mlaify/AttackMap/graphs/contributors"><img src="https://contrib.rocks/image?repo=mlaify/AttackMap" alt="AttackMap contributors" /></a>
+
+## Contributing
+
+Issues and PRs welcome — see [CONTRIBUTING.md](https://github.com/mlaify/AttackMap/blob/main/CONTRIBUTING.md). By contributing
+you agree your contributions will be MIT-licensed.
+
+## License
+
+[MIT](https://github.com/mlaify/AttackMap/blob/main/LICENSE). Copyright (c) 2026 Matthew Davis and AttackMap Contributors.

attackmap-0.6.4/pyproject.toml

@@ -0,0 +1,122 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "attackmap"
+# Single-sourced from src/attackmap/__init__.py (see [tool.setuptools.dynamic]).
+dynamic = ["version"]
+description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
+readme = "README.md"
+requires-python = ">=3.11"
+license = {text = "MIT"}
+authors = [
+  {name = "Matthew Davis", email = "mlaify@mlaify.io"},
+  {name = "AttackMap Contributors"},
+]
+maintainers = [
+  {name = "Matthew Davis", email = "mlaify@mlaify.io"},
+]
+keywords = [
+  "security",
+  "static-analysis",
+  "appsec",
+  "defensive-security",
+  "threat-modeling",
+  "attack-surface",
+  "mitre-attack",
+  "detection-engineering",
+  "code-review",
+  "llm",
+  "claude",
+]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Intended Audience :: Developers",
+  "Intended Audience :: Information Technology",
+  "Intended Audience :: System Administrators",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Security",
+  "Topic :: Software Development :: Quality Assurance",
+  "Topic :: Software Development :: Testing",
+  "Typing :: Typed",
+]
+dependencies = [
+  "typer>=0.12.3",
+  "pydantic>=2.7.0",
+  "networkx>=3.3",
+  "PyYAML>=6.0",
+]
+
+[project.optional-dependencies]
+llm = [
+  "anthropic>=0.40.0",
+  "openai>=1.60.0",
+]
+all = [
+  "attackmap[llm]",
+  "attackmap-analyzer-python==0.2.0",
+  "attackmap-analyzer-rust==0.2.0",
+  "attackmap-analyzer-go==0.2.0",
+  "attackmap-analyzer-java-spring==0.2.0",
+  "attackmap-analyzer-dotnet==0.2.0",
+  "attackmap-analyzer-terraform==0.2.1",
+  "attackmap-analyzer-c==0.2.0",
+  "attackmap-analyzer-cpp==0.2.0",
+  "attackmap-analyzer-swift==0.2.0",
+  "attackmap-analyzer-node-service==0.3.0",
+  "attackmap-analyzer-atproto==0.2.0",
+  "attackmap-analyzer-php-web==0.2.0",
+  "attackmap-analyzer-php-laminas==0.2.0",
+  "attackmap-analyzer-omeka-s==0.2.0",
+  "attackmap-analyzer-iac==0.2.0",
+]
+dev = [
+  "pytest>=8.0.0",
+  "build>=1.2.0",
+  "jsonschema>=4.0",
+  # Validates the generated Sigma rules in tests (#251); not a runtime dependency.
+  "pysigma>=2.0",
+  "ruff>=0.6",
+]
+
+[project.urls]
+Homepage = "https://github.com/mlaify/AttackMap"
+Documentation = "https://github.com/mlaify/AttackMap/wiki"
+Repository = "https://github.com/mlaify/AttackMap"
+Issues = "https://github.com/mlaify/AttackMap/issues"
+Changelog = "https://github.com/mlaify/AttackMap/blob/main/CHANGELOG.md"
+
+[project.scripts]
+attackmap = "attackmap.cli:app"
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+# Declarative taint sink registry (#240).
+attackmap = ["taint_sinks.yaml"]
+# Sigma rule templates for detection opportunities (#251).
+"attackmap.detections" = ["*.yml"]
+
+[tool.setuptools.dynamic]
+version = {attr = "attackmap.__version__"}
+
+[tool.pytest.ini_options]
+pythonpath = ["src"]
+testpaths = ["tests"]
+
+[tool.ruff.lint]
+# Pyflakes only (#231): undefined names, unused imports/locals. Style rules
+# are out of scope; CI runs this on src/attackmap.
+select = ["F"]

attackmap-0.6.4/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

attackmap-0.6.4/src/attackmap/__init__.py

@@ -0,0 +1,2 @@
+__all__ = ["__version__"]
+__version__ = "0.6.4"