一个基于LangGraph构建的安全操作代理原型，故意在不可信模型输出与权威规划、策略和审计行为之间划定界限。

概述

安全分析师大量时间将原始遥测数据转化为可辩护的结论：该指标是否恶意、严重程度、应采取何种措施以及是谁批准了该行动。CyberSec Agent 是一个原型，通过结构化的安全事件和威胁情报记录回答这些问题——并使答案可审计。

设计前提是语言模型是一个不可信的组件。模型贡献意图、工具选择和文体。风险级别、响应计划、审批要求和审计轨迹由确定性规则引擎生成，这些规则引擎从不读取模型输出。评估框架旨在验证这种分离是否成立。

这是一个研究和工程原型。它尚未准备好生产环境，也不是企业级SOC产品。它不自主：它规划并请求批准，且不对真实基础设施执行修复措施。

CyberSec Agent

Release v0.5.0 · MIT License · Python 3.12+ · LangGraph · FastAPI

A security-operations agent prototype built on LangGraph, with a deliberate boundary between untrusted model output and authoritative planning, policy, and audit behavior.

中文项目介绍与面试材料 — 项目定位、技术栈、技术贡献、限制与面试问答（简体中文）。

Current release: v0.5.0 (2026-10-24) — knowledge-base Q&A over a version-controlled corpus, with three explicitly selected retrieval backends and structural citation validation.

Run the offline demo (no LLM provider required)

uv run python scripts/demo_offline.py

Four scenarios, each computed from a real return value — no API key, no network, no Docker. First time here? Quick Start covers environment setup; this section deliberately does not repeat it.

DEMO 2’s answer text is scripted — there is no provider in this run — but the retrieval, the evidence envelope and the citation validator are real code. DEMO 4 is a test-based demonstration, not a live /triage → /resume round trip: that path enters the graph at the agent node, so it needs a reachable provider. The script exits non-zero if any scenario fails.

Output of a real local run at b3e7950:

  PASS  DEMO 1  RBAC — authentication and role admission
  PASS  DEMO 2  Citation validation — fabricated citations are rejected
  PASS  DEMO 3  Retrieval fail-closed — a broken index is refused, not replaced
  PASS  DEMO 4  HITL approval and resume — TEST-BASED DEMONSTRATION

DEMO PASSED: 4/4 scenarios

Verified by CI