# b-3llum/sliver-lab architecture

> Architecture diagram of the GitHub repository b-3llum/sliver-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/b-3llum/sliver-lab
- Repository: https://github.com/b-3llum/sliver-lab

## Overview

sliver-lab is a browser-based operator console for an authorized Sliver red-team lab. The principal workflow is operator authentication, reviewing live sessions or beacons, opening a session console to issue operations, and observing task and teamserver events; separate screens manage listeners, tunnels, files, loot, builds, profiles, BOFs, jobs, graphs, audit, and reports. The FastAPI BFF authenticates API routes and brokers operations to Sliver, while a shared WebSocket fans events to the UI. Uninspected route implementations are represented by their exact tree paths; their finer-grained wiring is not inferred.

Main entry points: [`ui/backend/main.py`](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/main.py) (FastAPI entry), [`ui/frontend/src/App.tsx`](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/App.tsx) (App routes), [`ui/frontend/src/api.ts`](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/api.ts) (HTTP API client), [`ui/backend/sliver_client.py`](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/sliver_client.py) (Sliver event hub)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_frontend["Operator UI"]
  node_app["App routes<br/>[App.tsx]"]
  node_authgate["Auth gate<br/>[AuthGate.tsx]"]
  node_api["HTTP API client<br/>[api.ts]"]
  node_wsclient["Event client<br/>[ws.ts]"]
  node_sessionsview["Sessions console<br/>[Sessions.tsx]"]
  node_consoleview["Implant console<br/>[Console.tsx]"]
  node_managementviews["Management screens<br/>[Listeners.tsx]"]
  node_artifactviews["Artifacts screens<br/>[Build.tsx]"]
  node_observabilityviews["Visibility screens<br/>[Audit.tsx]"]
end

subgraph group_backend["API backend"]
  node_fastapi["FastAPI entry<br/>[main.py]"]
  node_sessionroutes["Session routes<br/>[sessions.py]"]
  node_otherdomains["Other domain routes<br/>[graph.py]"]
  node_hub["Sliver event hub<br/>[sliver_client.py]"]
  node_wsroute["WebSocket endpoint<br/>[ws.py]"]
end

subgraph group_operations["Implant operations"]
  node_artifactroutes["Build and artifact routes<br/>[build.py]"]
  node_taskroutes["Task routes<br/>[tasks.py]"]
  node_taskregistry["Task registry<br/>[task_registry.py]"]
end

subgraph group_infrastructure["Lab infrastructure"]
  node_managementroutes["Listener and tunnel routes<br/>[listeners.py]"]
  node_tunnelregistry["Tunnel registry<br/>[tunnel_registry.py]"]
  node_ngrokroute["Ngrok routes<br/>[ngrok.py]"]
  node_ngrokregistry["Ngrok registry<br/>[ngrok_registry.py]"]
end

subgraph group_visibility["Monitoring"]
end

node_operator(("Operator"))
node_teamserver{{"Sliver teamserver"}}

node_operator -->|"enters token"| node_authgate
node_authgate -->|"unlocks UI"| node_app
node_app -->|"routes to"| node_sessionsview
node_app -->|"routes to"| node_consoleview
node_app -->|"routes to"| node_managementviews
node_app -->|"routes to"| node_artifactviews
node_app -->|"routes to"| node_observabilityviews
node_sessionsview -->|"fetches sessions"| node_api
node_consoleview -->|"sends operations"| node_api
node_managementviews -->|"calls endpoints"| node_api
node_artifactviews -->|"calls endpoints"| node_api
node_observabilityviews -->|"calls endpoints"| node_api
node_api -->|"HTTP requests"| node_fastapi
node_fastapi -->|"dispatches"| node_sessionroutes
node_fastapi -->|"dispatches"| node_managementroutes
node_fastapi -->|"dispatches"| node_ngrokroute
node_fastapi -->|"dispatches"| node_artifactroutes
node_fastapi -->|"dispatches"| node_taskroutes
node_fastapi -->|"dispatches"| node_otherdomains
node_sessionroutes -->|"queries sessions"| node_hub
node_managementroutes -->|"manages tunnels"| node_tunnelregistry
node_ngrokroute -->|"manages tunnels"| node_ngrokregistry
node_artifactroutes -->|"tracks tasks"| node_taskregistry
node_taskroutes -->|"reads task results"| node_taskregistry
node_fastapi -->|"starts and stops"| node_hub
node_hub -->|"connects and receives events"| node_teamserver
node_fastapi -->|"mounts endpoint"| node_wsroute
node_hub -->|"fans out events"| node_wsroute
node_taskregistry -->|"broadcasts updates"| node_hub
node_wsclient -->|"subscribes to events"| node_wsroute
node_sessionsview -->|"refreshes on events"| node_wsclient
node_consoleview -->|"observes events"| node_wsclient
node_operator -.->|"implant activity"| node_teamserver
node_artifactroutes -.->|"optional avgen hook"| node_operator

click node_app "https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/App.tsx"
click node_authgate "https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/components/AuthGate.tsx"
click node_api "https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/api.ts"
click node_wsclient "https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/ws.ts"
click node_sessionsview "https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/views/Sessions.tsx"
click node_consoleview "https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/views/Console.tsx"
click node_managementviews "https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/views/Listeners.tsx"
click node_artifactviews "https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/views/Build.tsx"
click node_observabilityviews "https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/views/Audit.tsx"
click node_fastapi "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/main.py"
click node_sessionroutes "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/sessions.py"
click node_managementroutes "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/listeners.py"
click node_tunnelregistry "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/tunnel_registry.py"
click node_ngrokroute "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/ngrok.py"
click node_ngrokregistry "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/ngrok_registry.py"
click node_artifactroutes "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/build.py"
click node_taskroutes "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/tasks.py"
click node_taskregistry "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/task_registry.py"
click node_otherdomains "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/graph.py"
click node_hub "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/sliver_client.py"
click node_wsroute "https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/ws.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_authgate,node_api,node_wsclient,node_sessionsview,node_consoleview,node_managementviews,node_artifactviews,node_observabilityviews toneBlue
class node_fastapi,node_sessionroutes,node_otherdomains,node_hub,node_wsroute toneAmber
class node_artifactroutes,node_taskroutes,node_taskregistry,node_teamserver toneMint
class node_managementroutes,node_tunnelregistry,node_ngrokroute,node_ngrokregistry toneRose
class node_operator toneIndigo
```

## Components

### Operator UI

- [App routes](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/App.tsx): `ui/frontend/src/App.tsx`
- [Auth gate](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/components/AuthGate.tsx): `ui/frontend/src/components/AuthGate.tsx`
- [HTTP API client](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/api.ts): `ui/frontend/src/api.ts`
- [Event client](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/ws.ts): `ui/frontend/src/ws.ts`
- [Sessions console](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/views/Sessions.tsx): `ui/frontend/src/views/Sessions.tsx`
- [Implant console](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/views/Console.tsx): `ui/frontend/src/views/Console.tsx`
- [Management screens](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/views/Listeners.tsx): `ui/frontend/src/views/Listeners.tsx`
- [Artifacts screens](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/views/Build.tsx): `ui/frontend/src/views/Build.tsx`
- [Visibility screens](https://github.com/b-3llum/sliver-lab/blob/master/ui/frontend/src/views/Audit.tsx): `ui/frontend/src/views/Audit.tsx`

### API backend

- [FastAPI entry](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/main.py): `ui/backend/main.py`
- [Session routes](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/sessions.py): `ui/backend/routes/sessions.py`
- [Other domain routes](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/graph.py): `ui/backend/routes/graph.py`
- [Sliver event hub](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/sliver_client.py): `ui/backend/sliver_client.py`
- [WebSocket endpoint](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/ws.py): `ui/backend/ws.py`

### Implant operations

- [Build and artifact routes](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/build.py): `ui/backend/routes/build.py`
- [Task routes](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/tasks.py): `ui/backend/routes/tasks.py`
- [Task registry](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/task_registry.py): `ui/backend/task_registry.py`

### Lab infrastructure

- [Listener and tunnel routes](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/listeners.py): `ui/backend/routes/listeners.py`
- [Tunnel registry](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/tunnel_registry.py): `ui/backend/tunnel_registry.py`
- [Ngrok routes](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/routes/ngrok.py): `ui/backend/routes/ngrok.py`
- [Ngrok registry](https://github.com/b-3llum/sliver-lab/blob/master/ui/backend/ngrok_registry.py): `ui/backend/ngrok_registry.py`

### Other components

- **Operator**
- **Sliver teamserver**

## Connections

- Operator → Auth gate: enters token
- Auth gate → App routes: unlocks UI
- App routes → Sessions console: routes to
- App routes → Implant console: routes to
- App routes → Management screens: routes to
- App routes → Artifacts screens: routes to
- App routes → Visibility screens: routes to
- Sessions console → HTTP API client: fetches sessions
- Implant console → HTTP API client: sends operations
- Management screens → HTTP API client: calls endpoints
- Artifacts screens → HTTP API client: calls endpoints
- Visibility screens → HTTP API client: calls endpoints
- HTTP API client → FastAPI entry: HTTP requests
- FastAPI entry → Session routes: dispatches
- FastAPI entry → Listener and tunnel routes: dispatches
- FastAPI entry → Ngrok routes: dispatches
- FastAPI entry → Build and artifact routes: dispatches
- FastAPI entry → Task routes: dispatches
- FastAPI entry → Other domain routes: dispatches
- Session routes → Sliver event hub: queries sessions
- Listener and tunnel routes → Tunnel registry: manages tunnels
- Ngrok routes → Ngrok registry: manages tunnels
- Build and artifact routes → Task registry: tracks tasks
- Task routes → Task registry: reads task results
- FastAPI entry → Sliver event hub: starts and stops
- Sliver event hub → Sliver teamserver: connects and receives events
- FastAPI entry → WebSocket endpoint: mounts endpoint
- Sliver event hub → WebSocket endpoint: fans out events
- Task registry → Sliver event hub: broadcasts updates
- Event client → WebSocket endpoint: subscribes to events
- Sessions console → Event client: refreshes on events
- Implant console → Event client: observes events
- Operator → Sliver teamserver: implant activity
- Build and artifact routes → Operator: optional avgen hook