How gadievron/raptor works
RAPTOR is an autonomous security research framework for investigating source code, binaries, dependencies, and running applications, with human review of results. Its principal codebase workflow maps attack surface, investigates suspicious code, assesses findings, validates exploitability, and prepares candidate PoCs or patches. Distinct branches cover software composition analysis, binary and crash research, runtime web/Frida investigation, and project-history forensics. The graph reflects README-documented capabilities; sampled source excerpts are partial, so unshown implementation-level call relationships are not asserted.
Main entry points: driver.py Agentic Workflow · pipeline.py Composition Analysis · exploitability_validation/orchestrator.py Exploit Validation · fuzzing/orchestrator.py Fuzzing
Components 21
Source Investigation
- Agentic Workflow
core/orchestration/driver.py - Attack Surface
core/understand_graph/ingest.py - Static Analysis
core/detectors/pipeline.py - Audit Engine
core/audit/pipeline.py - Taint Analysis
core/taint/engine.py - Finding Review
core/audit/llm_review.py
Exploit Research
- Exploit Validation
packages/exploitability_validation/orchestrator.py - PoC Generation
core/orchestration/exploit_bridge.py - Patch Writing
core/analysis/patch_localize.py
Supply Chain
- Composition Analysis
packages/sca/pipeline.py - Advisory Sources
core/cve/cwe.py - SBOM
core/oci/sbom.py
Runtime and Binary
- Binary Analysis
packages/binary_analysis/pipeline.py - Fuzzing
packages/fuzzing/orchestrator.py - Crash Investigation
packages/binary_analysis/pipeline.py - Web Exploration
packages/web/client.py - Frida Instrumentation
packages/frida/templates/bb-coverage.js
Research Memory
- OSS Forensics
core/forensics/bq_query.py - Project Memory
core/project/sessions.py - Research Report
core/audit/report.py
Other components
- Researcher
Connections 19
- Researcher → Agentic Workflow: starts
README.md - Agentic Workflow → Attack Surface: maps surface
README.md - Agentic Workflow → Static Analysis: investigates code
README.md - Agentic Workflow → Audit Engine: audits
README.md - Agentic Workflow → Finding Review: assesses findings
README.md - Agentic Workflow → Exploit Validation: tests exploitability
README.md - Exploit Validation → PoC Generation: generates PoCs
README.md - Agentic Workflow → Patch Writing: prepares fixes
README.md - Researcher → Composition Analysis: runs SCA
README.md - Composition Analysis → Advisory Sources: checks risks
README.md - Composition Analysis → SBOM: produces SBOM
README.md - Researcher → Binary Analysis: investigates binary
README.md - Researcher → Fuzzing: fuzzes target
README.md - Fuzzing → Crash Investigation: supplies witnesses
README.md - Researcher → Web Exploration: explores endpoints
README.md - Researcher → Frida Instrumentation: instruments runtime
README.md - Researcher → OSS Forensics: investigates history
README.md - Agentic Workflow → Project Memory: retains research
README.md - Agentic Workflow → Research Report: reports findings
README.md