# 545e/snmk architecture

> Architecture diagram of the GitHub repository 545e/snmk, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/545e/snmk
- Repository: https://github.com/545e/snmk

## Overview

SNMK is an autonomous cybersecurity assessment and operations platform. Its main workflow accepts an authorized target and scan configuration, governs scope, coordinates specialist agents and scanners, and produces findings for persistence, scoring, remediation, and reporting. Separate product branches provide network intelligence and forensics, cyber kill-chain analysis, integrations, and AI-assisted reasoning. The sampled sources show the web/API entry points and parts of orchestration; some subsystem links are documented only by the README or SOURCE INDEX, so unverified call paths are omitted.

Main entry points: [`web/server.py`](https://github.com/545e/snmk/blob/main/web/server.py) (Web API), [`agents/orchestrator.py`](https://github.com/545e/snmk/blob/main/agents/orchestrator.py) (Assessment orchestrator), [`core/database.py`](https://github.com/545e/snmk/blob/main/core/database.py) (Platform database), [`core/llm_client.py`](https://github.com/545e/snmk/blob/main/core/llm_client.py) (AI reasoning)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Product Entry"]
  node_webapi["Web API<br/>[server.py]"]
  node_v1api["Versioned API<br/>[router.py]"]
end

subgraph group_assessment["Assessment Workforce"]
  node_scope["Scope governance<br/>[scope_policy.py]"]
  node_orchestrator["Assessment orchestrator<br/>[orchestrator.py]"]
  node_agents["Specialist agents<br/>[agent_workforce.py]"]
  node_amass["Asset discovery<br/>[amass_engine.py]"]
  node_scanners["Scanner adapters"]
  node_owasp["OWASP plugins<br/>[owasp_plugins.py]"]
end

subgraph group_operations["Security Operations"]
  node_findings["Findings and scoring<br/>[scoring.py]"]
  node_remediation["Remediation"]
  node_reports["Security reports<br/>[generator.py]"]
  node_killchain["Kill-chain analysis<br/>[engine.py]"]
  node_forensics["Digital forensics"]
  node_network["Network intelligence<br/>[geo_engine.py]"]
end

subgraph group_platform["Shared Platform"]
  node_integrations["Provider integrations<br/>[registry.py]"]
  node_llm["AI reasoning<br/>[llm_client.py]"]
  node_database[("Platform database<br/>[database.py]")]
  node_queue["Event queue<br/>[queue_manager.py]"]
  node_registry["Agent registry<br/>[agent_registry.py]"]
end

node_users(("Security users"))

node_users -->|"submits requests"| node_webapi
node_webapi -->|"starts assessments"| node_orchestrator
node_users -->|"uses API"| node_v1api
node_v1api -->|"routes assessments"| node_orchestrator
node_orchestrator -->|"checks scope"| node_scope
node_orchestrator -->|"coordinates"| node_agents
node_orchestrator -->|"runs scans"| node_scanners
node_orchestrator -->|"incorporates assets"| node_amass
node_registry -->|"discovers agents"| node_agents
node_orchestrator -->|"emits events"| node_queue
node_orchestrator -->|"synchronizes state"| node_database
node_webapi -->|"reads and writes"| node_database
node_scanners -->|"enforces scope"| node_scope
node_webapi -->|"offers audit plugins"| node_owasp
node_webapi -->|"scores findings"| node_findings
node_findings -.->|"guides fixes"| node_remediation
node_webapi -->|"generates reports"| node_reports
node_webapi -->|"routes analysis"| node_killchain
node_killchain -->|"persists analysis"| node_database
node_webapi -.->|"offers forensics"| node_forensics
node_webapi -.->|"offers network tools"| node_network
node_llm -->|"gets credentials"| node_integrations
node_integrations -->|"persists settings"| node_database
node_llm -->|"grounds responses"| node_database

click node_webapi "https://github.com/545e/snmk/blob/main/web/server.py"
click node_v1api "https://github.com/545e/snmk/blob/main/web/v1/router.py"
click node_scope "https://github.com/545e/snmk/blob/main/core/scope_policy.py"
click node_orchestrator "https://github.com/545e/snmk/blob/main/agents/orchestrator.py"
click node_agents "https://github.com/545e/snmk/blob/main/agents/agent_workforce.py"
click node_amass "https://github.com/545e/snmk/blob/main/agents/amass_engine.py"
click node_scanners "https://github.com/545e/snmk/blob/main/core/scanner_integrations.py"
click node_owasp "https://github.com/545e/snmk/blob/main/plugins/owasp_plugins.py"
click node_findings "https://github.com/545e/snmk/blob/main/core/scoring.py"
click node_remediation "https://github.com/545e/snmk/blob/main/core/remediation_engine.py"
click node_reports "https://github.com/545e/snmk/blob/main/reports/generator.py"
click node_killchain "https://github.com/545e/snmk/blob/main/core/kill_chain/engine.py"
click node_forensics "https://github.com/545e/snmk/blob/main/core/forensics_engine.py"
click node_network "https://github.com/545e/snmk/blob/main/core/network/geo_engine.py"
click node_integrations "https://github.com/545e/snmk/blob/main/core/integrations/registry.py"
click node_llm "https://github.com/545e/snmk/blob/main/core/llm_client.py"
click node_database "https://github.com/545e/snmk/blob/main/core/database.py"
click node_queue "https://github.com/545e/snmk/blob/main/core/queue_manager.py"
click node_registry "https://github.com/545e/snmk/blob/main/core/agent_registry.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_webapi,node_v1api,node_users toneBlue
class node_scope,node_orchestrator,node_agents,node_amass,node_scanners,node_owasp toneAmber
class node_findings,node_remediation,node_reports,node_killchain,node_forensics,node_network toneMint
class node_integrations,node_llm,node_database,node_queue,node_registry toneRose
```

## Components

### Product Entry

- [Web API](https://github.com/545e/snmk/blob/main/web/server.py): `web/server.py`
- [Versioned API](https://github.com/545e/snmk/blob/main/web/v1/router.py): `web/v1/router.py`

### Assessment Workforce

- [Scope governance](https://github.com/545e/snmk/blob/main/core/scope_policy.py): `core/scope_policy.py`
- [Assessment orchestrator](https://github.com/545e/snmk/blob/main/agents/orchestrator.py): `agents/orchestrator.py`
- [Specialist agents](https://github.com/545e/snmk/blob/main/agents/agent_workforce.py): `agents/agent_workforce.py`
- [Asset discovery](https://github.com/545e/snmk/blob/main/agents/amass_engine.py): `agents/amass_engine.py`
- [Scanner adapters](https://github.com/545e/snmk/blob/main/core/scanner_integrations.py): `core/scanner_integrations.py`
- [OWASP plugins](https://github.com/545e/snmk/blob/main/plugins/owasp_plugins.py): `plugins/owasp_plugins.py`

### Security Operations

- [Findings and scoring](https://github.com/545e/snmk/blob/main/core/scoring.py): `core/scoring.py`
- [Remediation](https://github.com/545e/snmk/blob/main/core/remediation_engine.py): `core/remediation_engine.py`
- [Security reports](https://github.com/545e/snmk/blob/main/reports/generator.py): `reports/generator.py`
- [Kill-chain analysis](https://github.com/545e/snmk/blob/main/core/kill_chain/engine.py): `core/kill_chain/engine.py`
- [Digital forensics](https://github.com/545e/snmk/blob/main/core/forensics_engine.py): `core/forensics_engine.py`
- [Network intelligence](https://github.com/545e/snmk/blob/main/core/network/geo_engine.py): `core/network/geo_engine.py`

### Shared Platform

- [Provider integrations](https://github.com/545e/snmk/blob/main/core/integrations/registry.py): `core/integrations/registry.py`
- [AI reasoning](https://github.com/545e/snmk/blob/main/core/llm_client.py): `core/llm_client.py`
- [Platform database](https://github.com/545e/snmk/blob/main/core/database.py): `core/database.py`
- [Event queue](https://github.com/545e/snmk/blob/main/core/queue_manager.py): `core/queue_manager.py`
- [Agent registry](https://github.com/545e/snmk/blob/main/core/agent_registry.py): `core/agent_registry.py`

### Other components

- **Security users**

## Connections

- Security users → Web API: submits requests
- Web API → Assessment orchestrator: starts assessments (evidence: `web/server.py`)
- Security users → Versioned API: uses API
- Versioned API → Assessment orchestrator: routes assessments (evidence: `web/v1/router.py`)
- Assessment orchestrator → Scope governance: checks scope (evidence: `agents/orchestrator.py`)
- Assessment orchestrator → Specialist agents: coordinates (evidence: `agents/orchestrator.py`)
- Assessment orchestrator → Scanner adapters: runs scans (evidence: `agents/orchestrator.py`)
- Assessment orchestrator → Asset discovery: incorporates assets (evidence: `agents/orchestrator.py`)
- Agent registry → Specialist agents: discovers agents (evidence: `core/agent_registry.py`)
- Assessment orchestrator → Event queue: emits events (evidence: `agents/orchestrator.py`)
- Assessment orchestrator → Platform database: synchronizes state (evidence: `agents/orchestrator.py`)
- Web API → Platform database: reads and writes (evidence: `web/server.py`)
- Scanner adapters → Scope governance: enforces scope (evidence: `core/scanner_integrations.py`)
- Web API → OWASP plugins: offers audit plugins (evidence: `web/server.py`)
- Web API → Findings and scoring: scores findings (evidence: `web/server.py`)
- Findings and scoring → Remediation: guides fixes
- Web API → Security reports: generates reports (evidence: `web/server.py`)
- Web API → Kill-chain analysis: routes analysis
- Kill-chain analysis → Platform database: persists analysis
- Web API → Digital forensics: offers forensics (evidence: `web/server.py`)
- Web API → Network intelligence: offers network tools
- AI reasoning → Provider integrations: gets credentials (evidence: `core/llm_client.py`)
- Provider integrations → Platform database: persists settings (evidence: `core/integrations/registry.py`)
- AI reasoning → Platform database: grounds responses (evidence: `core/llm_client.py`)