astroicers/athena

1. Repository Role

This is the public product-facing repository for Athena, an autonomous cyber-operations platform. The production Rust OODA core (athena-core) is private; this repo exposes architecture documentation, extension guidance, a sample tool manifest, and a CI contract checker. Primary onboarding starts at README.md, with operational/API details in docs/http-api.md.

2. Autonomous OODA Control Plane

Athena’s intended core flow is Observe → Orient → Decide → Act, continuously using newly collected facts to select subsequent actions. Orient is LLM-driven with a deterministic fallback; Decide applies mandatory scope, OPSEC-budget, and Rules-of-Engagement gates before execution. This repository documents rather than implements that private control plane:

• README.md

• docs/demo-walkthrough.md

• docs/http-api.md

3. External API and Operational State Boundary

The documented stable HTTP surface covers operations, OODA phases, scheduling, facts, knowledge base, vulnerabilities, campaigns, reports, and status. This is the principal integration boundary for operators or control systems; the README explicitly distinguishes planned inbound MCP-server control from current delivered functionality.

• docs/http-api.md

• README.md

4. Extensibility and Decision Plugins

The open ecosystem separates public contracts from private decision implementations. External developers provide deterministic scoring/selection behavior through the SDK contract, enabling hot-swappable decision modules without core source access. The repository includes a Rust-based validation executable for scorer contracts.

• docs/extending.md

• ci/scorer-check/Cargo.toml

• ci/scorer-check/src/main.rs

5. MCP Tool-Container Integration

Athena orchestrates security-tool containers through MCP. Tool capabilities are declared through manifests, then reviewed, deployed through operator opt-in, discovered during Orient, and scheduled by the core. The local sample defines a tool’s container, port, ATT&CK techniques, description, and intended OODA phase.

• examples/my-tool/athena-tool.toml

• docs/extending.md

• README.md

6. Runtime, Deployment, and External Dependencies

The private v2 core is described as a modular Rust workspace; the public checker is also Rust/Cargo. Decision intelligence can use hosted, local, or mock LLM backends. Local LLM support and MCP container orchestration enable air-gapped deployment; tool containers represent the main execution-side infrastructure.

• docs/llm-config.md

• ci/scorer-check/Cargo.toml

• README.md

7. Governance and Delivery Controls

Compliance is designed as an execution-path boundary rather than post-run auditing: target scope, OPSEC noise budget, RoE policy, and human review for high-risk/suspected-honeypot actions. CI enforces published contracts and documentation quality, including scorer validation, link checking, and leak gates.

• .github/workflows/contracts.yml

• .github/scripts/leak-gate.sh

• .github/scripts/check-links.sh