luozhonglzw/cybersec-agent
Developer toolsこのページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る
Security operations AI agent built with LangGraph, deterministic policy enforcement, human approval, auditable tool use, and MCP.
概要
A security-operations agent prototype built on LangGraph, with a deliberate boundary between untrusted model output and authoritative planning, policy, and audit behavior. Security analysts spend much of their time turning raw telemetry into a defensible conclusion: is this indicator malicious, how serious is it, what should be done about it, and who approved that action. CyberSec Agent is a prototype that answers those questions over structured security events and threat-intelligence records — and that makes the answer auditable. The design premise is that the language model is an untrusted component. The model contributes intent, tool selection, and prose. The risk level, the response plan, the approval requirement, and the audit trail are produced by deterministic rule engines that never read the model's output. The evaluation harness is built to check that this separation actually holds. This is a research and engineering prototype.
README
以下は原文 README の抜粋です。原文を見る。
CyberSec Agent
Release v0.5.0 · MIT License · Python 3.12+ · LangGraph · FastAPI
A security-operations agent prototype built on LangGraph, with a deliberate boundary between untrusted model output and authoritative planning, policy, and audit behavior.
中文项目介绍与面试材料 — 项目定位、技术栈、技术贡献、限制与面试问答（简体中文）。
Current release: v0.5.0 (2026-10-24) — knowledge-base Q&A over a version-controlled corpus, with three explicitly selected retrieval backends and structural citation validation.
Run the offline demo (no LLM provider required)
uv run python scripts/demo_offline.py
Four scenarios, each computed from a real return value — no API key, no network, no Docker. First time here? Quick Start covers environment setup; this section deliberately does not repeat it.
| Scenario | Kind | What it demonstrates |
|---|---|---|
DEMO 1 RBAC |
real HTTP through the real FastAPI app | 401 / 403; unknown and missing credentials are byte-identical |
DEMO 2 Citation validation |
real corpus, real retrieval, real validator | fabricated citations → grounded=false |
DEMO 3 Retrieval fail-closed |
real Qdrant Local assembly path | broken index → status="unavailable", no fallback |
DEMO 4 HITL |
test-based (real pytest subprocess) | pause / resume / thread isolation / approver constraints |
DEMO 2’s answer text is scripted — there is no provider in this run — but the retrieval, the evidence envelope and the citation validator are real code. DEMO 4 is a test-based demonstration, not a live /triage → /resume round trip: that path enters the graph at the agent node, so it needs a reachable provider. The script exits non-zero if any scenario fails.
Output of a real local run at b3e7950:
PASS DEMO 1 RBAC — authentication and role admission
PASS DEMO 2 Citation validation — fabricated citations are rejected
PASS DEMO 3 Retrieval fail-closed — a broken index is refused, not replaced
PASS DEMO 4 HITL approval and resume — TEST-BASED DEMONSTRATION
DEMO PASSED: 4/4 scenarios
Verified by CI
| Job | Scope | Observed at b3e7950 |
|---|---|---|
test |
offline suite — no network, no API key | 2,283 passed, then the 4/4 demo |
test-postgres |
PostgreSQL integration against a throwaway server | 373 passed, 0 skipped |
docker |
real image build + corpus load + route check | image built; 40 docs / 80 chunks in-container |
インストール
docker exec -i cybersec-pg-test-postgres-1 psql -v ON_ERROR_STOP=1 \