See every hop from public entry point to crown-jewel asset — then fix the one link that breaks the chain.
Armelis is a 100% Free and Open Source (FOSS) security intelligence platform architected and developed by Johan Vasquez. Published under the permissive MIT License, it transforms raw, disjointed vulnerability scanner output (Trivy, Semgrep, Gitleaks) into cohesive, actionable attack path models and prioritized remediation workflows.
Instead of overwhelming security and development teams with an unfiltered wall of 200 medium-severity alerts, Armelis maps the full exploitation route:
By isolating the critical single fix that severs the chain, developers and SOC analysts resolve root risks in minutes.
AI coding assistants (Cursor, GitHub Copilot, Devin, Claude Code) generate code at unprecedented speeds, but frequently introduce subtle security risks:
- Missing Ownership & Tenant Isolation (IDOR): Boilerplate CRUD endpoints generated without verifying authenticated user identity against requested resources.
- Committed Cloud Secrets: Plaintext credentials and IAM keys inadvertently committed in generated Terraform or Docker compose files.
- Supply Chain Hallucinations: Imports of non-existent, abandoned, or typo-squatted dependencies.
Armelis provides:
- Deterministic Reachability Analysis: Validates whether an alert is actually exposed to public internet attack surfaces.
- 1-Click AI Fix Prompts: Synthesizes context-aware, deterministic remediation prompts engineered for instant, 1-turn resolution in Cursor, Copilot, or Claude Code.
- Rescan Verification: Deterministically verifies that the applied patch broke the attack path and eliminated exposure.
- Unified Multi-Scanner Normalization: Ingests Trivy (vulnerabilities, misconfigs, secrets, licenses), Semgrep (SAST), and Gitleaks evidence into a canonical, strict JSON Schema (
packages/finding-model). - Automated Secret Redaction: Deep recursive sanitization permanently masks sensitive keys (
secret,token,password,key,plaintext) as[REDACTED]before persistence, display, or SIEM streaming. - Adversary Framework Mapping: Automatically cross-references findings to MITRE ATT&CK Enterprise Tactics & Techniques (e.g. T1190, T1552.001, T1068, T1195.002) and OWASP Top 10 (2021).
- Native SIEM Exporter: Out-of-the-box streaming and batch exports in CEF (Splunk, ArcSight, QRadar), ECS / NDJSON (Elasticsearch, Kibana, Wazuh), and RFC 5424 Syslog.
- Air-Gapped & Local-First: Runs 100% locally on your machine. Zero telemetry, zero analytics tracking, and zero source code exfiltration.
- Dual-Client Architecture:
- Web Client (
apps/web): Next.js 15 App Router, React 19, GSAP, Anime.js, and Tailwind CSS. - Desktop Client (
apps/desktop): Secure workstation runner powered by Tauri 2 (Rust native command bridge) for offline repository analysis.
- Web Client (
┌────────────────┐ ┌────────────────┐ ┌────────────────┐
│ Trivy │ │ Semgrep │ │ Gitleaks │
│ (CVEs / IaC) │ │ (SAST) │ │ (Secrets) │
└────────┬───────┘ └────────┬───────┘ └────────┬───────┘
│ │ │
└──────────────────────┼──────────────────────┘
▼
┌──────────────────────────────────────────────┐
│ Recursive Sanitizer (Secret Redaction) │
└──────────────────────┬───────────────────────┘
▼
┌──────────────────────────────────────────────┐
│ Canonical Finding Schema (Draft 2020-12) │
│ + MITRE ATT&CK & OWASP Top 10 Correlation │
└──────────────────────┬───────────────────────┘
▼
┌──────────────────────────────────────────────┐
│ Graph Reachability & Attack Path Synthesizer│
└──────────────────────┬───────────────────────┘
▼
┌──────────────────────────────────────────────┐
│ Armelis Security Console │
│ ├── Visual Kill-Chain Inspector │
│ ├── 1-Click AI Fix Prompts (Cursor/Copilot) │
│ └── SIEM Exporter (CEF / ECS / Syslog) │
└──────────────────────────────────────────────┘
Armelis/
├── bin/ # Global executable launcher (node bin/armelis.js)
├── apps/
│ ├── web/ # Web dashboard & portal (Next.js 15+, React 19, GSAP)
│ └── desktop/ # Workstation client (Tauri 2 + Vite + React + Rust)
├── packages/
│ ├── cli/ # Zero-dependency Armelis CLI (scan, trace, break, export)
│ ├── finding-model/ # Canonical JSON Schema for normalized findings
│ └── scanner-adapters/ # Provider ingestion modules
│ └── trivy/ # Trivy runner, normalizer, and SIEM exporter
├── docs/ # Architecture decision records, threat models & specifications
├── DESIGN.md # Armelis Design System & Anti-Vibecoding Standards
├── APPLE_DESIGN.md # Apple HIG and macOS design specification
├── POLITICS.md # Project governance, Terms of Use & Privacy Policy
├── SECURITY.md # Hardening, secure coding & threat model standards
└── LICENSE # MIT License (Copyright 2026 Johan Vasquez)
Install Armelis globally across macOS, Linux, or Windows with Node 18+:
npm install -g armelisVerify your installation:
armelis --version
armelis --helpFor local, air-gapped visual attack path inspection and interactive repository analysis:
Run scans, trace lateral attack reachability, or break exploit chains without installing:
# Scan local repository or directory
npx armelis scan .
# Trace attack reachability graph
npx armelis trace .
# Pinpoint minimal choke-point cut
npx armelis break .
# Stream telemetry to SIEM (CEF / Syslog)
npx armelis export . --format cefgit clone https://github.com/Johanvasquezdev/armelis.git
cd armelis
npm install
node bin/armelis.js scan .Prefer a small target first so cold Trivy DB downloads and filesystem walks stay within budget:
# Fixture-first (fast smoke)
node bin/armelis.js scan packages/scanner-adapters/trivy/test/fixture
# Explicit subdirectory
node bin/armelis.js scan apps/web
# Full monorepo (skips node_modules, .git, dist, build, .next, target, .venv; 10m default timeout)
node bin/armelis.js scan .If a root scan still times out on OneDrive/network drives, pass a narrower --target (via the adapter CLI) or raise --timeout-ms.
From the monorepo root (npm install) uses .npmrc legacy-peer-deps=true to avoid npm 10 arborist peer crashes (matches / edgesOut) seen with Next/SWC optional peers and class-variance-authority on Node 22.
Run security intelligence, graph traversal, and chain severance directly from your terminal:
# Scan repository and normalize multi-scanner findings
node bin/armelis.js scan .
# Trace reachability attack paths (hops) from public entry points to crown jewels
node bin/armelis.js trace .
# Find the single critical link that breaks the attack chain + get 1-click AI fix prompt
node bin/armelis.js break .
# Stream normalized findings to SIEM (CEF / ECS / Syslog)
node bin/armelis.js export . --format cefcd apps/web
npm install
npm run devVisit http://localhost:3000 for the landing page or http://localhost:3000/dashboard for the live security console.
cd apps/desktop
npm install
npm run tauri devArmelis maps scanner evidence against leading industry security controls to accelerate audit readiness:
- SOC 2 Type II: Trust Services Criteria (CC6.1 Logical Access, CC6.6 Vulnerability Management, CC7.1 Threat Detection).
- ISO/IEC 27001:2022: Annex A.8.8 Management of Technical Vulnerabilities, A.8.12 Data Leakage Prevention, A.8.28 Secure Coding.
- OWASP Top 10 (2021): Direct tagging for Broken Access Control (A01), Cryptographic Failures (A02), Injection (A03), and Vulnerable Components (A06).
(Note: Armelis provides evidence correlation and audit preparedness workflows; it does not issue automated compliance certifications).
- Authorized Testing Only: Operators must only scan repositories and systems they own or have documented permission to audit.
- Zero Telemetry: Armelis does not collect telemetry, analytics, or user metrics. All scan payloads and source code remain strictly local.
This project is licensed under the MIT License — see the LICENSE file for details.
Copyright (c) 2026 Johan Vasquez. Free for personal, open source, academic, and commercial use.