# gadievron/raptor architecture

> Architecture diagram of the GitHub repository gadievron/raptor, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/gadievron/raptor
- Repository: https://github.com/gadievron/raptor

## Overview

RAPTOR is an autonomous security research framework for investigating source code, binaries, dependencies, and running applications, with human review of results. Its principal codebase workflow maps attack surface, investigates suspicious code, assesses findings, validates exploitability, and prepares candidate PoCs or patches. Distinct branches cover software composition analysis, binary and crash research, runtime web/Frida investigation, and project-history forensics. The graph reflects README-documented capabilities; sampled source excerpts are partial, so unshown implementation-level call relationships are not asserted.

Main entry points: [`core/orchestration/driver.py`](https://github.com/gadievron/raptor/blob/main/core/orchestration/driver.py) (Agentic Workflow), [`packages/sca/pipeline.py`](https://github.com/gadievron/raptor/blob/main/packages/sca/pipeline.py) (Composition Analysis), [`packages/exploitability_validation/orchestrator.py`](https://github.com/gadievron/raptor/blob/main/packages/exploitability_validation/orchestrator.py) (Exploit Validation), [`packages/fuzzing/orchestrator.py`](https://github.com/gadievron/raptor/blob/main/packages/fuzzing/orchestrator.py) (Fuzzing)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_source["Source Investigation"]
  node_agentic["Agentic Workflow<br/>[driver.py]"]
  node_attack_surface["Attack Surface<br/>[ingest.py]"]
  node_static_analysis["Static Analysis<br/>[pipeline.py]"]
  node_audit["Audit Engine<br/>[pipeline.py]"]
  node_taint["Taint Analysis<br/>[engine.py]"]
  node_finding_review["Finding Review<br/>[llm_review.py]"]
end

subgraph group_validation["Exploit Research"]
  node_validation["Exploit Validation<br/>[orchestrator.py]"]
  node_exploit["PoC Generation<br/>[exploit_bridge.py]"]
  node_patch["Patch Writing<br/>[patch_localize.py]"]
end

subgraph group_supply["Supply Chain"]
  node_sca["Composition Analysis<br/>[pipeline.py]"]
  node_advisories["Advisory Sources<br/>[cwe.py]"]
  node_sbom["SBOM<br/>[sbom.py]"]
end

subgraph group_runtime["Runtime and Binary"]
  node_binary["Binary Analysis<br/>[pipeline.py]"]
  node_fuzzing["Fuzzing<br/>[orchestrator.py]"]
  node_crash["Crash Investigation<br/>[pipeline.py]"]
  node_web["Web Exploration<br/>[client.py]"]
  node_frida["Frida Instrumentation<br/>[bb-coverage.js]"]
end

subgraph group_research["Research Memory"]
  node_forensics["OSS Forensics<br/>[bq_query.py]"]
  node_projects[("Project Memory<br/>[sessions.py]")]
  node_report["Research Report<br/>[report.py]"]
end

node_operator(("Researcher"))

node_operator -->|"starts"| node_agentic
node_agentic -->|"maps surface"| node_attack_surface
node_agentic -->|"investigates code"| node_static_analysis
node_agentic -->|"audits"| node_audit
node_agentic -->|"assesses findings"| node_finding_review
node_agentic -->|"tests exploitability"| node_validation
node_validation -->|"generates PoCs"| node_exploit
node_agentic -->|"prepares fixes"| node_patch
node_operator -->|"runs SCA"| node_sca
node_sca -->|"checks risks"| node_advisories
node_sca -->|"produces SBOM"| node_sbom
node_operator -->|"investigates binary"| node_binary
node_operator -->|"fuzzes target"| node_fuzzing
node_fuzzing -->|"supplies witnesses"| node_crash
node_operator -->|"explores endpoints"| node_web
node_operator -->|"instruments runtime"| node_frida
node_operator -->|"investigates history"| node_forensics
node_agentic -->|"retains research"| node_projects
node_agentic -->|"reports findings"| node_report

click node_agentic "https://github.com/gadievron/raptor/blob/main/core/orchestration/driver.py"
click node_attack_surface "https://github.com/gadievron/raptor/blob/main/core/understand_graph/ingest.py"
click node_static_analysis "https://github.com/gadievron/raptor/blob/main/core/detectors/pipeline.py"
click node_audit "https://github.com/gadievron/raptor/blob/main/core/audit/pipeline.py"
click node_taint "https://github.com/gadievron/raptor/blob/main/core/taint/engine.py"
click node_finding_review "https://github.com/gadievron/raptor/blob/main/core/audit/llm_review.py"
click node_validation "https://github.com/gadievron/raptor/blob/main/packages/exploitability_validation/orchestrator.py"
click node_exploit "https://github.com/gadievron/raptor/blob/main/core/orchestration/exploit_bridge.py"
click node_patch "https://github.com/gadievron/raptor/blob/main/core/analysis/patch_localize.py"
click node_sca "https://github.com/gadievron/raptor/blob/main/packages/sca/pipeline.py"
click node_advisories "https://github.com/gadievron/raptor/blob/main/core/cve/cwe.py"
click node_sbom "https://github.com/gadievron/raptor/blob/main/core/oci/sbom.py"
click node_binary "https://github.com/gadievron/raptor/blob/main/packages/binary_analysis/pipeline.py"
click node_fuzzing "https://github.com/gadievron/raptor/blob/main/packages/fuzzing/orchestrator.py"
click node_crash "https://github.com/gadievron/raptor/blob/main/packages/binary_analysis/pipeline.py"
click node_web "https://github.com/gadievron/raptor/blob/main/packages/web/client.py"
click node_frida "https://github.com/gadievron/raptor/blob/main/packages/frida/templates/bb-coverage.js"
click node_forensics "https://github.com/gadievron/raptor/blob/main/core/forensics/bq_query.py"
click node_projects "https://github.com/gadievron/raptor/blob/main/core/project/sessions.py"
click node_report "https://github.com/gadievron/raptor/blob/main/core/audit/report.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_agentic,node_attack_surface,node_static_analysis,node_audit,node_taint,node_finding_review toneBlue
class node_validation,node_exploit,node_patch toneAmber
class node_sca,node_advisories,node_sbom toneMint
class node_binary,node_fuzzing,node_crash,node_web,node_frida toneRose
class node_forensics,node_projects,node_report,node_operator toneIndigo
```

## Components

### Source Investigation

- [Agentic Workflow](https://github.com/gadievron/raptor/blob/main/core/orchestration/driver.py): `core/orchestration/driver.py`
- [Attack Surface](https://github.com/gadievron/raptor/blob/main/core/understand_graph/ingest.py): `core/understand_graph/ingest.py`
- [Static Analysis](https://github.com/gadievron/raptor/blob/main/core/detectors/pipeline.py): `core/detectors/pipeline.py`
- [Audit Engine](https://github.com/gadievron/raptor/blob/main/core/audit/pipeline.py): `core/audit/pipeline.py`
- [Taint Analysis](https://github.com/gadievron/raptor/blob/main/core/taint/engine.py): `core/taint/engine.py`
- [Finding Review](https://github.com/gadievron/raptor/blob/main/core/audit/llm_review.py): `core/audit/llm_review.py`

### Exploit Research

- [Exploit Validation](https://github.com/gadievron/raptor/blob/main/packages/exploitability_validation/orchestrator.py): `packages/exploitability_validation/orchestrator.py`
- [PoC Generation](https://github.com/gadievron/raptor/blob/main/core/orchestration/exploit_bridge.py): `core/orchestration/exploit_bridge.py`
- [Patch Writing](https://github.com/gadievron/raptor/blob/main/core/analysis/patch_localize.py): `core/analysis/patch_localize.py`

### Supply Chain

- [Composition Analysis](https://github.com/gadievron/raptor/blob/main/packages/sca/pipeline.py): `packages/sca/pipeline.py`
- [Advisory Sources](https://github.com/gadievron/raptor/blob/main/core/cve/cwe.py): `core/cve/cwe.py`
- [SBOM](https://github.com/gadievron/raptor/blob/main/core/oci/sbom.py): `core/oci/sbom.py`

### Runtime and Binary

- [Binary Analysis](https://github.com/gadievron/raptor/blob/main/packages/binary_analysis/pipeline.py): `packages/binary_analysis/pipeline.py`
- [Fuzzing](https://github.com/gadievron/raptor/blob/main/packages/fuzzing/orchestrator.py): `packages/fuzzing/orchestrator.py`
- [Crash Investigation](https://github.com/gadievron/raptor/blob/main/packages/binary_analysis/pipeline.py): `packages/binary_analysis/pipeline.py`
- [Web Exploration](https://github.com/gadievron/raptor/blob/main/packages/web/client.py): `packages/web/client.py`
- [Frida Instrumentation](https://github.com/gadievron/raptor/blob/main/packages/frida/templates/bb-coverage.js): `packages/frida/templates/bb-coverage.js`

### Research Memory

- [OSS Forensics](https://github.com/gadievron/raptor/blob/main/core/forensics/bq_query.py): `core/forensics/bq_query.py`
- [Project Memory](https://github.com/gadievron/raptor/blob/main/core/project/sessions.py): `core/project/sessions.py`
- [Research Report](https://github.com/gadievron/raptor/blob/main/core/audit/report.py): `core/audit/report.py`

### Other components

- **Researcher**

## Connections

- Researcher → Agentic Workflow: starts (evidence: `README.md`)
- Agentic Workflow → Attack Surface: maps surface (evidence: `README.md`)
- Agentic Workflow → Static Analysis: investigates code (evidence: `README.md`)
- Agentic Workflow → Audit Engine: audits (evidence: `README.md`)
- Agentic Workflow → Finding Review: assesses findings (evidence: `README.md`)
- Agentic Workflow → Exploit Validation: tests exploitability (evidence: `README.md`)
- Exploit Validation → PoC Generation: generates PoCs (evidence: `README.md`)
- Agentic Workflow → Patch Writing: prepares fixes (evidence: `README.md`)
- Researcher → Composition Analysis: runs SCA (evidence: `README.md`)
- Composition Analysis → Advisory Sources: checks risks (evidence: `README.md`)
- Composition Analysis → SBOM: produces SBOM (evidence: `README.md`)
- Researcher → Binary Analysis: investigates binary (evidence: `README.md`)
- Researcher → Fuzzing: fuzzes target (evidence: `README.md`)
- Fuzzing → Crash Investigation: supplies witnesses (evidence: `README.md`)
- Researcher → Web Exploration: explores endpoints (evidence: `README.md`)
- Researcher → Frida Instrumentation: instruments runtime (evidence: `README.md`)
- Researcher → OSS Forensics: investigates history (evidence: `README.md`)
- Agentic Workflow → Project Memory: retains research (evidence: `README.md`)
- Agentic Workflow → Research Report: reports findings (evidence: `README.md`)