Skip to content

stride lite.stub

Jump to bottom
Nicolas Cravino edited this page Aug 28, 2026 · 2 revisions

id: stride-lite name: STRIDE-Lite repo_path: ~/Documents/sw30labs/repos/STRIDE-Lite remote_url: https://github.com/sw30labs/STRIDE-Lite.git primary_language: Python framework: LangGraph + LangChain (OpenAI-compatible; local oMLX supported) category: ai-security stacks: [langgraph, agentic, pentest, compliance, mlx] ingested: 2026-08-22 last_commit_date: 2026-08-21

STRIDE-Lite

Purpose

Local STRIDE / DREAD threat models, ATT&CK-templated attack scenarios, and a linked-note Vault. v2.1, Apache-2.0. Explicitly framed as a personal research tool — not affiliated with or endorsed by any employer, and its outputs are hypothetical artifacts, not advice.

Three workflows

  1. Threat model — a LangGraph workflow producing a STRIDE catalog with DREAD scores through iterative QA, saved as parseable JSON (field aliases, all six STRIDE categories).
  2. Scenario — a CVE brief, CTI feed, and kill-chain narrative layered on top of a saved model from an ATT&CK technique template.
  3. Vault — models, scenarios, templates and applications as linked notes: a polar six-slice catalog map (radius = data/cloud share) with a ternary Human / Infra / Data toggle, a one-hop LOCAL graph, compare, quality flags, and a ⌘P switcher. Kill chains open as a Campaign Score — a phase × lane grid with a playable spine, plus sequence and storyboard views and a deterministic HTML/SVG export via score_export.py.

Architecture

src/python/ (~4,300 lines) holds the engine, src/gui/ a vanilla-JS command deck on 127.0.0.1:8765, src/yaml/ the prompt and template definitions:

  • model.py (623) — the STRIDE → DREAD LangGraph workflow.
  • campaign_score.py (590) and killchains.py (311) — the phase × lane scoring model.
  • vault_index.py (580) — note graph, compare, quality flags.
  • utils.py (530), gui.py (517) — provider plumbing and the local HTTP deck.
  • scenario.py (438), attack_stix.py (154), catalog_map.py (276), score_export.py (265).
  • Both a GUI and a CLI path over the same artifacts; Prometheus metrics default to :9100, deliberately off 8000 because that is the usual oMLX port.

v2.1 — agent-runtime threat templates

The version shipped in this tree adds buy-side agent-runtime attack templates — MNPI exfiltration, MCP abuse, shadow agents, poisoned-copilot integrity — plus an APP-303030 research gateway. This is the threat-modeling side of the same agent supply-chain problem skillspector-trial and oscal-skills-guardrails address at admission time.

Stated limits

The README and ROADMAP are unusually direct about what is not real yet:

  • The three scenario QA nodes auto-approve — "rubber stamps" — so those reports are drafts.
  • The default CVE feed is a single sample record; there is no live NVD download. Point --cve_feed / CVE_FEED at your own JSON list.
  • ATT&CK enrichment only happens if a local STIX 2.x bundle is dropped at data/enterprise-attack.json; nothing is ever fetched.
  • Some template T-IDs are historically mistyped; the Vault flags them rather than silently rewriting the JSON.

Data hygiene

Demo inventory is fictional ACME applications with APP-* IDs and generic fields; the control taxonomy uses project-native SL-01…SL-19 IDs invented for the repo rather than real industry catalog IDs. Git history deliberately starts at v2.0. .env, output/ and logs/ stay untracked. The README carves out Contingency Atlas as a separate, non-public operational-risk system — "the console look is deliberate kinship, not a bundle."

Dependencies

langgraph 1.2.11, langchain 1.3.15, langchain-community 0.4.2, langchain-openai 1.5.2, langsmith 0.11.0, pandas 3.0.5, pydantic 2.13.4, prometheus-client, python-dotenv, pyyaml — all pinned exactly. Python 3.11+. Inference is OpenAI-compatible, so a local oMLX endpoint substitutes for a hosted key (--provider mlx, OMLX_* aliases accepted).

CI/CD

No CI workflows. tests/test_stride_lite.py and tests/test_gui_http.py under unittest, plus an optional real-Chrome E2E pass (tests/e2e_browser.mjs, e2e_chrome.py) and a screenshot capture script. Ships a .grok/skills/attack-campaign-score skill. In-browser API check at /selftest.html.

Entities and topics

Home | Index | Sitemap | Sitemap-Stacks | SCHEMA | Log

Clone this wiki locally