Production deception-and-threat-intelligence platform and companion packages.
| Package | Install | Purpose |
|---|---|---|
| wraithwall | pip install . |
Flask platform — gateway, link intel, cowrie, BGP, canaries |
| ravenscan | pip install ravenscan |
Engineering intelligence CLI (raven) and library |
| canary-kit | pip install canary-kit |
Supply-chain canary token minting and detection |
| honeypot-mitre | pip install honeypot-mitre |
Cowrie logs → MITRE ATT&CK scoring |
| dml-spec | pip install packages/dml-spec |
Signed deception markup language validator |
Packages are independent — none imports another.
git clone https://github.com/niffyhunt/wraithwall.git
cd wraithwall
./install.sh
cp .env.example .env
docker compose up -d
wraithwall check
wraithwall servefrom wraithwall import create_app, Client
from wraithwall.link_checker import analyze
from wraithwall.gateway import Gateway
app = create_app()
client = Client("http://localhost:8000", api_key="...")
print(client.health())
result = analyze("https://example.com")
blocked = Gateway.is_ip_blocked("203.0.113.1")from ravenscan import scan
from canary_kit import create_canary
profile = scan(".")
token = create_canary("my-sdk", "1.0.0")wraithwall check
wraithwall serve --port 8000
wraithwall routes
raven scan .
canary-kit mint my-pkg 1.0.0 --type runtime
honeypot-mitre sample.json
dml validate traps.yamlAll secrets and infrastructure endpoints come from environment variables (see .env.example). Nothing is hardcoded to a specific deployment.
- LAUNCH.md — Field guide and platform tour
- docs/architecture.md — Architecture overview
- docs/deployment.md — Deployment guide
- docs/api.md — API surface
- ROADMAP.md — Direction and priorities
- CHANGELOG.md — Version history
- docs/COMMUNITY_ROADMAP.md — Community roadmap
- docs/knowledge-pipeline/ — Technical knowledge articles
Install the full stack with ./install.sh, run pytest, then open a PR. Each package under packages/ has its own README and examples. See CONTRIBUTING.md for details.