AttackMap for macOS

A native macOS GUI for AttackMap, the local-first defensive security analyzer. Point it at a repository, run a scan, watch live progress, and browse the findings — all driving the attackmap CLI you already have installed.

Status: v0.1.0-dev, feature-complete (M1–M5): spawn the CLI + decode its report, Overview + Findings master-detail, exploitability / attack-path / attack-surface / review views, Mermaid diagrams, Settings (CLI path + API key), recent scans, and watch mode (debounced auto re-scan with a new/resolved delta). The whole app type-checks against the SDK; run it in Xcode. See the implementation plan.

Diagrams render offline via a vendored copy of mermaid.js (MIT) in AttackMap/Resources/.

What it is

This is a dev tool: a thin launcher + viewer over the AttackMap engine. It does not reimplement any analysis — it spawns attackmap analyze … --format json --progress-format json, streams the NDJSON progress, and renders the attackmap-report.json artifacts. Because it shells out to the installed CLI, there's no bundled Python and no notarization required for local use.

Screenshots

A run against OWASP Juice Shop.

Configure & run — repo, LLM mode, CVE, analyzers, Watch	Live progress — per-file bar + ETA
Overview — counts, severity, most-exploitable path	Findings — master-detail with evidence & remediation
Exploitability — ranked route→sink paths	Attack surface — full route inventory
Diagrams — offline Mermaid attack paths	Defensive review — full Markdown report

Install

brew install --cask mlaify/tap/attackmap-app   # also pulls the attackmap CLI
brew upgrade --cask attackmap-app              # update later

The cask is published on each release (signed + notarized DMG) and updates through Homebrew alongside the CLI. To build from source instead, read on.

Requirements

• macOS 15 (Sequoia) or later
• Xcode 16+ to build
• XcodeGen to generate the project (brew install xcodegen)
• The attackmap CLI on your PATH (brew install mlaify/tap/attackmap)

Build & run

brew install xcodegen          # one-time
xcodegen generate              # creates AttackMap.xcodeproj from project.yml
open AttackMap.xcodeproj        # build & run in Xcode (⌘R)

The .xcodeproj is generated from project.yml and is git-ignored — project.yml is the source of truth. The app is not sandboxed (it must spawn the CLI and read arbitrary repo folders).

After pulling changes that add/rename Swift files, re-run xcodegen generate. The generated project pins a file list at generation time, so new source files won't be in the target (symptom: "Cannot find 'X' in scope") until you regenerate.

Distribution (signed + notarized DMG)

For a Developer ID–signed, notarized, stapled .dmg that opens without Gatekeeper warnings:

# Local (needs full Xcode + your Developer ID cert):
TEAM_ID=ABCDE12345 NOTARY_PROFILE=attackmap-notary scripts/package.sh 0.1.0

# CI: push a vX.Y.Z tag → .github/workflows/release.yml builds + notarizes and
# attaches the DMG to the GitHub Release.

Full one-time setup (certificate, App Store Connect API key, the exact CI secret names) is in docs/RELEASE.md. Notarization requires a paid Apple Developer membership + a Developer ID Application certificate.

Branding & app icon

The icon and wordmark live in branding/. The app icon is defined by branding/AppIcon-master.svg; regenerate the Assets.xcassets/AppIcon.appiconset PNGs after editing it:

brew install librsvg     # one-time (provides rsvg-convert)
scripts/make-icon.sh     # writes the 10 macOS icon sizes; commit them

The generated PNGs are committed so builds and CI don't need a rasterizer.

Architecture

SwiftUI app ──► ProcessRunner ──► attackmap analyze … --progress-format json
                     │  stderr (NDJSON)  ──► ScanViewModel (live progress)
                     │  exit 0 + reports/attackmap-report.json
                     ▼
               Report.load(…)  ──► Codable models ──► Table / detail views

Layer	Files	Notes
Models (Foundation-only, testable)	Models/Report.swift, Models/ProgressEvent.swift, Models/ScanConfig.swift	Tolerant Codable over the engine's JSON
Services (Foundation-only)	Services/CLILocator.swift, Services/ProcessRunner.swift	Find the CLI, spawn + stream + cancel
View model	ViewModels/ScanViewModel.swift	@Observable, folds progress into state
Views	AttackMapApp.swift, Views/ContentView.swift	SwiftUI skeleton

The Models + Services layer is deliberately UI-free so it stays unit-testable; AttackMapTests decodes a real report fixture and the NDJSON protocol.

Roadmap

M1 spawn+parse ✅ · M2 core UI · M3 rich views (exploitability / paths / surface / review) · M4 diagrams + settings + recents · M5 watch mode. Full plan lives in the engine repo: docs/macos-gui-plan.md.

License

MIT — see LICENSE.