MCP Observatory
4m ago Tracked 59,463 Last 4m ago 24h 2,463
github Python analyzed e0b22d1

Brad-Edwards/aptl

github

SOC-in-a-Box for AI purple teaming

maintainer
Brad-Edwards
licence
MIT
first seen
2026-06-08
last seen
2026-09-17
releases · 30d
5
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution in Brad-Edwards/aptl
  2. HIGH code analysis flagged dynamic code execution in Brad-Edwards/aptl
  3. HIGH code analysis flagged dynamic code execution in Brad-Edwards/aptl
  4. HIGH code analysis flagged dynamic code execution in Brad-Edwards/aptl
  5. HIGH code analysis flagged dynamic code execution in Brad-Edwards/aptl
  6. HIGH code analysis flagged dynamic code execution in Brad-Edwards/aptl
  7. HIGH code analysis flagged dynamic code execution in Brad-Edwards/aptl
  8. HIGH code analysis flagged committed secret, dynamic code execution ×3 in Brad-Edwards/aptl
capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit e0b22d1 · analyzer v33 · 14h ago

skills & prompt files 8

danger signals7

code evidence vv5.5.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 942

filesystem 362

  • fs Brad-Edwards-aptl-e0b22d1/config/cortex/analyzers/APTLObservable/aptl_observable.py :7 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/config/wazuh_cluster/patch-rule-path.py :25 with open(RULE_PY) as f:
  • fs Brad-Edwards-aptl-e0b22d1/containers/appliance-egress-proxy/proxy.py :13 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/containers/kali-capture/broker.py :25 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/containers/kali-capture/writer.py :36 from pathlib import Path
  • fs (weak) Brad-Edwards-aptl-e0b22d1/docs/reviews/962-lilrae-readiness/evidence/boundary-probes.py :5 import pathlib
  • fs (weak) Brad-Edwards-aptl-e0b22d1/docs/reviews/962-lilrae-readiness/evidence/process-probes.py :5 import pathlib
  • fs Brad-Edwards-aptl-e0b22d1/hatch_build.py :27 import shutil
  • fs (weak) Brad-Edwards-aptl-e0b22d1/scripts/ci/assert_project_teardown.py :24 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/api/deps.py :6 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/api/main.py :3 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/api/routers/config.py :5 from pathlib import Path
show 28 more
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/api/routers/kill.py :4 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/api/routers/lab.py :4 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/api/routers/scenarios.py :11 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/api/routers/terminal.py :8 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/bootstrap.py :11 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/build.py :11 from pathlib import Path, PurePosixPath
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/launch.py :7 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/manifest.py :10 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/models.py :6 from pathlib import PurePosixPath
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/offline.py :11 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/release_validation.py :8 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/context.py :6 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/kiosk.py :5 import shutil
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/lifecycle.py :6 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/overlay_cleanup.py :5 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/paths.py :6 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/persistence.py :8 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/prereqs.py :6 import shutil
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/vm.py :9 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/backends/_raes_apply_reporting.py :7 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/backends/_raes_artifact_delivery_observation.py :6 from pathlib import Path, PurePosixPath
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/backends/_raes_content_spec.py :14 from pathlib import PurePosixPath
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/backends/_raes_docker_observation_values.py :5 from pathlib import PurePosixPath
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/backends/_raes_native_evidence_acquisition.py :6 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/backends/_raes_node_realization.py :7 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/backends/_raes_observation_index.py :6 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/backends/_raes_scenario_queries.py :19 from pathlib import Path
  • fs Brad-Edwards-aptl-e0b22d1/src/aptl/backends/_raes_scenario_resolution.py :12 from pathlib import Path

322 more not shown — this panel samples each group; the count above is the real total.

shell / exec 105

  • shell Brad-Edwards-aptl-e0b22d1/containers/kali-capture/broker.py :19 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/containers/kali-capture/writer.py :34 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/containers/network-boundary-helper/helper.py :11 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/containers/webapp/app/app.py :10 import subprocess
  • shell (weak) Brad-Edwards-aptl-e0b22d1/docs/reviews/962-lilrae-readiness/evidence/process-probes.py :23 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/hatch_build.py :28 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/build.py :9 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/exposure.py :5 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/kiosk.py :6 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/observation.py :6 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/prereqs.py :7 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/appliance/seat/vm.py :7 import subprocess
show 28 more
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/backends/raes_node_materialization.py :12 import subprocess
  • shell (weak) Brad-Edwards-aptl-e0b22d1/src/aptl/backends/raes_participant_fixture.py :5 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/backends/raes_participant_fixture_core.py :7 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/assets.py :31 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/certs.py :12 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/collectors.py :24 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/continuity.py :22 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_compose_base_substrate.py :21 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_compose_boundary.py :6 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_compose_lifecycle.py :5 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_compose_project_cleanup.py :5 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_compose_queries.py :12 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_compose_runtime_inventory.py :5 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_compose_seed_attribution.py :20 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_compose_stateful_realization.py :5 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_compose_stop.py :5 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_compose_volume_cleanup.py :5 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/backend_container_ops.py :15 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/docker_compose.py :7 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/hostenv.py :13 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/kill.py :11 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/lab.py :13 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/services.py :7 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/ssh.py :9 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/suricata_seed.py :16 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/core/sysreqs.py :7 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/utils/curl_safe.py :36 import subprocess
  • shell Brad-Edwards-aptl-e0b22d1/src/aptl/utils/shell.py :18 import subprocess

65 more not shown — this panel samples each group; the count above is the real total.

network 16

  • net Brad-Edwards-aptl-e0b22d1/containers/appliance-egress-proxy/proxy.py :11 import socket
  • net Brad-Edwards-aptl-e0b22d1/containers/kali-capture/broker.py :17 import socket
  • net Brad-Edwards-aptl-e0b22d1/containers/kali-capture/writer.py :32 import socket
  • net Brad-Edwards-aptl-e0b22d1/containers/kali-ssh-proxy/proxy.py :6 import socket
  • net Brad-Edwards-aptl-e0b22d1/src/aptl/api/routers/terminal.py :10 from urllib.parse import urlsplit
  • net Brad-Edwards-aptl-e0b22d1/src/aptl/core/deployment/_proc_net_listeners.py :18 import socket
  • net Brad-Edwards-aptl-e0b22d1/src/aptl/core/evidence/adapters/techvault_native.py :19 from urllib.parse import urlunsplit
  • net Brad-Edwards-aptl-e0b22d1/src/aptl/core/experiment/resolver.py :43 from urllib.parse import parse_qsl, urlsplit
  • net Brad-Edwards-aptl-e0b22d1/src/aptl/core/host_ports.py :29 import socket
  • net Brad-Edwards-aptl-e0b22d1/src/aptl/services/misp_suricata_sync/suricata_reloader.py :11 import socket
  • net Brad-Edwards-aptl-e0b22d1/src/aptl/services/misp_suricata_sync/translator.py :13 from urllib.parse import urlparse
  • net (weak) Brad-Edwards-aptl-e0b22d1/tests/test_compose_port_realization.py :10 import socket
show 4 more
  • net (weak) Brad-Edwards-aptl-e0b22d1/tests/test_host_ports.py :12 import socket
  • net (weak) Brad-Edwards-aptl-e0b22d1/tests/test_listener_observation_integration.py :49 'python -c "import socket,time; s=socket.socket(); '
  • net (weak) Brad-Edwards-aptl-e0b22d1/tests/test_misp_suricata_sync.py :12 import socket
  • net Brad-Edwards-aptl-e0b22d1/tools/sonar/assert_no_new_issues.py :12 import urllib.parse

secrets 9

  • secrets Brad-Edwards-aptl-e0b22d1/containers/webapp/app/app.py :38 "password": os.environ.get("DB_PASSWORD", "techvault_db_pass"),
  • secrets Brad-Edwards-aptl-e0b22d1/src/aptl/api/deps.py :53 raw = os.environ.get("APTL_API_TOKEN")
  • secrets Brad-Edwards-aptl-e0b22d1/src/aptl/cli/web.py :104 if not os.environ.get("APTL_API_TOKEN"):
  • secrets Brad-Edwards-aptl-e0b22d1/src/aptl/core/ssh.py :7 import getpass
  • secrets Brad-Edwards-aptl-e0b22d1/src/aptl/services/misp_suricata_sync/config.py :139 api_key = os.environ.get("MISP_API_KEY")
  • secrets (weak) Brad-Edwards-aptl-e0b22d1/tests/helpers.py :35 SSH_KEY = os.path.expanduser(os.getenv("APTL_SSH_KEY", "~/.ssh/aptl_lab_key"))
  • secrets (weak) Brad-Edwards-aptl-e0b22d1/tests/test_api_auth.py :221 os.environ["APTL_API_TOKEN"] = _TEST_TOKEN
  • secrets (weak) Brad-Edwards-aptl-e0b22d1/tests/test_mcp_protocol.py :108 "sys.stderr.write(os.environ['QUALIFICATION_SECRET']);"
  • secrets Brad-Edwards-aptl-e0b22d1/tools/sonar/assert_no_new_issues.py :138 token = os.environ.get("SONAR_TOKEN")

database 1

  • db Brad-Edwards-aptl-e0b22d1/containers/webapp/app/app.py :14 import psycopg2

declared dependencies 30

  • mcp@>=2,<3
  • typer@>=0.12.0
  • pydantic@>=2.0.0
  • rich@>=13.0.0
  • PyYAML@>=6.0
  • icontract@>=2.6.0,<3.0
  • opentelemetry-api@>=1.33.0
  • opentelemetry-sdk@>=1.33.0
  • opentelemetry-exporter-otlp-proto-http@>=1.33.0
  • opentelemetry-semantic-conventions@>=0.54b0
  • cryptography@>=50.0.0
  • raes@==5.0.0
show 18 more
  • raes-env-packs@==6.0.1
  • rfc8785@>=0.1.4,<0.2.0
  • blake3@>=1.0.8,<2
  • boto3@>=1.28.0
  • pyarrow@>=17.0.0
  • fastapi@>=0.115.0
  • uvicorn@>=0.34.0
  • sse-starlette@>=2.0.0
  • asyncssh@>=2.17.0
  • pytest@>=8.0.0
  • pytest-mock@>=3.12.0
  • pytest-xdist@>=3.6.0
  • coverage@>=7.0.0
  • httpx@>=0.27.0
  • hypothesis@>=6.0.0
  • ruff@>=0.15.0
  • mkdocs-material@>=9.5.0
  • mkdocs-git-revision-date-localized-plugin@>=1.2.0

cursor-plugin 2

  • opaque (low) Brad-Edwards-aptl-e0b22d1/.cursor/environment.json bundled .cursor/ plugin descriptor (Brad-Edwards-aptl-e0b22d1/.cursor/environment.json) — presence-detected; review the descriptor
  • opaque (low) Brad-Edwards-aptl-e0b22d1/.cursor/rules/no-jumping-ahead.mdc bundled .cursor/ plugin descriptor (Brad-Edwards-aptl-e0b22d1/.cursor/rules/no-jumping-ahead.mdc) — presence-detected; review the descriptor

transport_posture 2

  • binds all interfaces (0.0.0.0) Brad-Edwards-aptl-e0b22d1/containers/webapp/app/app.py :425 app.run(host="0.0.0.0", port=8080, debug=True)
  • network-listening, binds all interfaces, no auth detected Brad-Edwards-aptl-e0b22d1/tests/test_cli_web.py :50 host="0.0.0.0",