Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

WillBanasik/socai

https://github.com/WillBanasik/socai · scanned 2026-06-16 00:58 UTC (2 months, 1 week ago)

98 raw signals (0 security + 98 graph)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 94 actionable findings from 1 signal source. 4 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 94 findings

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 1 Medium 18 Low 49 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 94 Crowd 0 Layer: Software 30 Api 1 Network 2 Hardware 7 Frontend 1 Security 8 Cicd 1 Quality 44

Exclude dismissed / FP Exclude test files

All 2368 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

Label	Layer	Status	Path
`_setup_logging`	software	healthy	`socai.py:41`
`_read_lines`	software	healthy	`socai.py:50`
`_glob_logs`	software	healthy	`socai.py:61`
`cmd_create_case`	software	dead	`socai.py:80`
`cmd_report`	software	dead	`socai.py:97`
`cmd_weekly`	software	dead	`socai.py:105`
`cmd_close`	software	dead	`socai.py:115`
`cmd_list`	software	dead	`socai.py:123`
`cmd_enrich`	software	dead	`socai.py:139`
`cmd_client_query`	software	dead	`socai.py:149`
`cmd_mdr_report`	software	dead	`socai.py:154`
`cmd_pup_report`	software	dead	`socai.py:160`
`cmd_secarch`	software	dead	`socai.py:166`
`cmd_queries`	software	dead	`socai.py:172`
`cmd_triage`	software	dead	`socai.py:189`
`cmd_email_analyse`	software	dead	`socai.py:196`
`cmd_landscape`	software	dead	`socai.py:204`
`cmd_campaigns`	software	dead	`socai.py:216`
`cmd_errors`	software	dead	`socai.py:223`
`cmd_mcp_usage`	software	dead	`socai.py:234`
`cmd_sandbox`	software	dead	`socai.py:247`
`cmd_exposure`	software	dead	`socai.py:254`
`cmd_coverage`	software	dead	`socai.py:292`
`cmd_anomalies`	software	dead	`socai.py:338`
`cmd_timeline`	software	dead	`socai.py:345`
`cmd_pe_analysis`	software	dead	`socai.py:356`
`cmd_yara`	software	dead	`socai.py:368`
`cmd_evtx`	software	dead	`socai.py:379`
`cmd_cve_context`	software	dead	`socai.py:391`
`cmd_exec_summary`	software	dead	`socai.py:402`
`cmd_response_actions`	software	dead	`socai.py:408`
`cmd_closure_comment`	software	dead	`socai.py:421`
`cmd_fp_tuning`	software	dead	`socai.py:461`
`_next_case_id`	software	healthy	`socai.py:501`
`cmd_matrix`	software	dead	`socai.py:507`
`cmd_followup`	software	dead	`socai.py:540`
`cmd_quality_gate`	software	dead	`socai.py:573`
`cmd_determination`	software	dead	`socai.py:599`
`cmd_articles`	software	dead	`socai.py:636`
`cmd_articles_list`	software	dead	`socai.py:709`
`cmd_articles_generate`	software	dead	`socai.py:725`
`cmd_batch_submit`	software	dead	`socai.py:762`
`cmd_batch_status`	software	dead	`socai.py:766`
`cmd_batch_collect`	software	dead	`socai.py:770`
`cmd_velociraptor`	software	dead	`socai.py:774`
`cmd_browser_session`	software	dead	`socai.py:852`
`cmd_browser_stop`	software	dead	`socai.py:925`
`cmd_browser_list`	software	dead	`socai.py:935`
`cmd_sandbox_session`	software	dead	`socai.py:956`
`cmd_sandbox_stop`	software	dead	`socai.py:1040`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`package.sh`	software	healthy	`package.sh`
`.mcp.json`	software	healthy	`.mcp.json`
`socai.py`	software	healthy	`socai.py`
`tail-usage.sh`	software	healthy	`tail-usage.sh`
`README.md`	software	healthy	`README.md`
`CLAUDE.md`	software	healthy	`CLAUDE.md`
`install.sh`	software	healthy	`install.sh`
`Dockerfile`	software	healthy	`Dockerfile`
`requirements.txt`	software	healthy	`requirements.txt`
`monitor.py`	software	healthy	`docker/sandbox/monitor.py`
`Dockerfile`	software	healthy	`docker/sandbox/Dockerfile`
`honeypot.py`	software	healthy	`docker/sandbox/honeypot.py`
`entrypoint.sh`	software	healthy	`docker/sandbox/entrypoint.sh`
`Dockerfile`	software	healthy	`docker/browser/Dockerfile`
`entrypoint.sh`	software	healthy	`docker/browser/entrypoint.sh`
`__init__.py`	software	healthy	`config/__init__.py`
`client_playbook.example.json`	software	healthy	`config/client_playbook.example.json`
`article_prompts.py`	software	healthy	`config/article_prompts.py`
`roles.json`	software	healthy	`config/roles.json`
`logscale_syntax.md`	software	healthy	`config/logscale_syntax.md`
`article_sources.json`	software	healthy	`config/article_sources.json`
`coverage_domains.json`	software	healthy	`config/coverage_domains.json`
`settings.py`	software	healthy	`config/settings.py`
`analytical_guidelines.md`	software	healthy	`config/analytical_guidelines.md`
`client_entities.example.json`	software	healthy	`config/client_entities.example.json`
`sentinel_schema.py`	software	healthy	`config/sentinel_schema.py`
`sentinel.yaml`	software	healthy	`config/platforms/sentinel.yaml`
`logscale.yaml`	software	healthy	`config/platforms/logscale.yaml`
`account-compromise.yaml`	software	healthy	`config/playbooks/account-compromise.yaml`
`ioc-hunt.yaml`	software	healthy	`config/playbooks/ioc-hunt.yaml`
`lateral-movement.yaml`	software	healthy	`config/playbooks/lateral-movement.yaml`
`persistence.yaml`	software	healthy	`config/playbooks/persistence.yaml`
`oauth-consent.yaml`	software	healthy	`config/playbooks/oauth-consent.yaml`
`credential-access.yaml`	software	healthy	`config/playbooks/credential-access.yaml`
`phishing.yaml`	software	healthy	`config/playbooks/phishing.yaml`
`reconnaissance.yaml`	software	healthy	`config/playbooks/reconnaissance.yaml`
`bec.yaml`	software	healthy	`config/playbooks/bec.yaml`
`malware-execution.yaml`	software	healthy	`config/playbooks/malware-execution.yaml`
`insider-data-staging.yaml`	software	healthy	`config/playbooks/insider-data-staging.yaml`
`privilege-escalation.yaml`	software	healthy	`config/playbooks/privilege-escalation.yaml`
`defence-evasion.yaml`	software	healthy	`config/playbooks/defence-evasion.yaml`
`data-exfiltration.yaml`	software	healthy	`config/playbooks/data-exfiltration.yaml`
`ransomware.yaml`	software	healthy	`config/playbooks/ransomware.yaml`
`web-shell.yaml`	software	healthy	`config/playbooks/web-shell.yaml`
`vulnerability-hunting.yaml`	software	healthy	`config/playbooks/vulnerability-hunting.yaml`
`command-and-control.yaml`	software	healthy	`config/playbooks/command-and-control.yaml`
`cql_grammar.json`	software	healthy	`config/ngsiem/cql_grammar.json`
`ngsiem_columns.yaml`	software	healthy	`config/ngsiem/ngsiem_columns.yaml`
`ngsiem_rules.md`	software	healthy	`config/ngsiem/ngsiem_rules.md`
`_TEMPLATE.md`	software	healthy	`config/clients/_TEMPLATE.md`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`TestDetectSampleType`	software	healthy	`tests/test_sandbox_session.py:50`
`TestNeedsWine`	software	healthy	`tests/test_sandbox_session.py:105`
`TestSessionState`	software	healthy	`tests/test_sandbox_session.py:123`
`TestStraceParsing`	software	healthy	`tests/test_sandbox_session.py:153`
`TestSystemChanges`	software	healthy	`tests/test_sandbox_session.py:208`
`TestEntityExtraction`	software	healthy	`tests/test_sandbox_session.py:235`
`TestStartSession`	software	healthy	`tests/test_sandbox_session.py:278`
`TestStopSession`	software	healthy	`tests/test_sandbox_session.py:315`
`TestExecInSandbox`	software	healthy	`tests/test_sandbox_session.py:361`
`TestListSessions`	software	healthy	`tests/test_sandbox_session.py:421`
`TestArtefactCollection`	software	healthy	`tests/test_sandbox_session.py:453`
`_Collector`	software	healthy	`tests/test_uploads_http.py:45`
`TestLogMcpCall`	software	healthy	`tests/test_mcp_usage.py:32`
`TestTokenAccounting`	software	healthy	`tests/test_mcp_usage.py:79`
`TestAssessMcpUsage`	software	healthy	`tests/test_mcp_usage.py:128`
`TestClearUsageLog`	software	healthy	`tests/test_mcp_usage.py:192`
`TestInstallWatcher`	software	healthy	`tests/test_mcp_usage.py:215`
`TestRedaction`	software	healthy	`tests/test_darkweb.py:41`
`TestDetectType`	software	healthy	`tests/test_darkweb.py:95`
`TestXposedOrNot`	software	healthy	`tests/test_darkweb.py:122`
`TestAhmia`	software	healthy	`tests/test_darkweb.py:190`
`TestIntelX`	software	healthy	`tests/test_darkweb.py:267`
`TestStealerParser`	software	healthy	`tests/test_darkweb.py:386`
`TestDarkwebSummary`	software	healthy	`tests/test_darkweb.py:418`
`TestExtractTablesFromKql`	software	healthy	`tests/test_sentinel_schema.py:30`
`TestValidateTables`	software	healthy	`tests/test_sentinel_schema.py:112`
`TestGetTableSchemaSummary`	software	healthy	`tests/test_sentinel_schema.py:174`
`TestWorkspaceHelpers`	software	healthy	`tests/test_sentinel_schema.py:209`
`_FakeResponse`	software	healthy	`tests/test_crowdstrike.py:20`
`TestResolveConfig`	software	healthy	`tests/test_crowdstrike.py:85`
`TestIsConfigured`	software	healthy	`tests/test_crowdstrike.py:105`
`TestEnvKey`	software	healthy	`tests/test_crowdstrike.py:120`
`TestAcquireToken`	software	healthy	`tests/test_crowdstrike.py:131`
`TestRunFalconCql`	software	healthy	`tests/test_crowdstrike.py:152`
`TestQueryPaged`	software	healthy	`tests/test_crowdstrike.py:205`
`TestCaseFromSession`	software	healthy	`tests/test_token_cost_report.py:32`
`TestProjectApi`	software	healthy	`tests/test_token_cost_report.py:47`
`TestRepriceCosting`	software	healthy	`tests/test_token_cost_report.py:83`
`TestLoadWindowsLive`	software	healthy	`tests/test_token_cost_report.py:119`
`TestCaseMemory`	software	healthy	`tests/test_intelligence.py:43`
`TestClientBaseline`	software	healthy	`tests/test_intelligence.py:182`
`TestGeoIP`	software	healthy	`tests/test_intelligence.py:323`
`TestScheduler`	software	healthy	`tests/test_intelligence.py:412`
`TestListScenarios`	software	healthy	`tests/test_sentinel_queries.py:29`
`TestLoadScenario`	software	healthy	`tests/test_sentinel_queries.py:48`
`TestRenderQuery`	software	healthy	`tests/test_sentinel_queries.py:73`
`TestTemplateQuality`	software	healthy	`tests/test_sentinel_queries.py:159`
`_Resp`	software	healthy	`tests/test_bug_sweep_p2p3.py:265`
`_FakeResponse`	software	healthy	`tests/test_defender_hunting.py:20`
`TestResolveTenant`	software	healthy	`tests/test_defender_hunting.py:76`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`127.0.0.1`	network	healthy	`Dockerfile`
`10.99.99.1`	network	healthy	`docker/sandbox/honeypot.py`
`120.0.0.0`	network	healthy	`config/settings.py`
`192.168.1.100`	network	healthy	`tests/test_sandbox_session.py`
`10.0.0.1`	network	healthy	`tests/test_sandbox_session.py`
`10.0.0.2`	network	healthy	`tests/test_sandbox_session.py`
`1.2.3.4`	network	healthy	`tests/test_sandbox_session.py`
`192.168.1.1`	network	healthy	`tests/test_darkweb.py`
`10.0.0.0`	network	healthy	`tests/test_darkweb.py`
`8.8.8.8`	network	healthy	`tests/test_friction_fixes.py`
`148.197.0.0`	network	healthy	`tests/test_friction_fixes.py`
`1.1.1.1`	network	healthy	`tests/test_import_enrichment.py`
`2.2.2.2`	network	healthy	`tests/test_import_enrichment.py`
`3.3.3.3`	network	healthy	`tests/test_import_enrichment.py`
`4.4.4.4`	network	healthy	`tests/test_import_enrichment.py`
`8.8.8.0`	network	healthy	`tests/test_import_enrichment.py`
`9.9.9.9`	network	healthy	`tests/test_import_enrichment.py`
`192.168.1.0`	network	healthy	`tests/test_exposure.py`
`5.6.7.8`	network	healthy	`tests/test_intelligence.py`
`185.220.101.45`	network	healthy	`tests/test_bug_sweep_p2p3.py`
`203.0.113.7`	network	healthy	`tests/test_reports_http.py`
`91.199.212.52`	network	healthy	`tests/test_tools.py`
`198.51.100.10`	network	healthy	`tests/test_tools.py`
`203.0.113.5`	network	healthy	`tests/test_tools.py`
`198.51.100.99`	network	healthy	`tests/test_tools.py`
`10.0.0.3`	network	healthy	`tests/test_tools.py`
`126.0.0.0`	network	healthy	`scripts/eql_direct.py`
`192.168.1.5`	network	healthy	`tools/mde_ingest.py`
`154.119.71.68`	network	healthy	`tools/recall.py`
`89.42.218.223`	network	healthy	`tools/generate_pptx.py`
`169.254.169.254`	network	healthy	`tools/web_capture.py`
`149.72.92.159`	network	healthy	`tools/generate_capabilities_pptx.py`
`8.8.4.4`	network	healthy	`tools/campaign_cluster.py`
`1.0.0.1`	network	healthy	`tools/campaign_cluster.py`
`1.0.0.2`	network	healthy	`tools/campaign_cluster.py`
`10.99.99.0`	network	healthy	`tools/sandbox_session.py`

Label	Layer	Status	Path
`auth::tests/test_tools.py`	security	healthy	`tests/test_tools.py`
`auth::README.md`	security	healthy	`README.md`
`auth::config/platforms/logscale.yaml`	security	healthy	`config/platforms/logscale.yaml`
`auth::tools/classify_attack.py`	security	healthy	`tools/classify_attack.py`
`auth::mcp_server/auth.py`	security	healthy	`mcp_server/auth.py`
`auth::mcp_server/server.py`	security	healthy	`mcp_server/server.py`
`auth::api/auth.py`	security	healthy	`api/auth.py`
`auth::tools/determination.py`	security	healthy	`tools/determination.py`
`auth::tests/test_reports_http.py`	security	healthy	`tests/test_reports_http.py`
`auth::scripts/backfill_identity_response.py`	security	healthy	`scripts/backfill_identity_response.py`
`auth::tests/test_uploads_http.py`	security	healthy	`tests/test_uploads_http.py`
`auth::tools/defender_hunting.py`	security	healthy	`tools/defender_hunting.py`
`auth::tools/investigation_matrix.py`	security	healthy	`tools/investigation_matrix.py`
`auth::tools/crowdstrike.py`	security	healthy	`tools/crowdstrike.py`
`auth::tests/test_sentinel_queries.py`	security	healthy	`tests/test_sentinel_queries.py`
`auth::tools/security_arch_review.py`	security	healthy	`tools/security_arch_review.py`
`auth::CLAUDE.md`	security	healthy	`CLAUDE.md`
`auth::config/playbooks/bec.yaml`	security	healthy	`config/playbooks/bec.yaml`
`auth::tools/eql.py`	security	healthy	`tools/eql.py`
`auth::mcp_server/prompts.py`	security	healthy	`mcp_server/prompts.py`
`auth::mcp_server/uploads_http.py`	security	healthy	`mcp_server/uploads_http.py`
`auth::mcp_server/resources.py`	security	healthy	`mcp_server/resources.py`
`auth::mcp_server/tools.py`	security	healthy	`mcp_server/tools.py`
`auth::config/playbooks/oauth-consent.yaml`	security	healthy	`config/playbooks/oauth-consent.yaml`
`auth::tools/response_actions.py`	security	healthy	`tools/response_actions.py`
`auth::mcp_server/reports_http.py`	security	healthy	`mcp_server/reports_http.py`

Label	Layer	Status	Path
`docker`	software	healthy	`docker`
`sandbox`	software	healthy	`docker/sandbox`
`browser`	software	healthy	`docker/browser`
`config`	software	healthy	`config`
`platforms`	software	healthy	`config/platforms`
`playbooks`	software	healthy	`config/playbooks`
`ngsiem`	software	healthy	`config/ngsiem`
`clients`	software	healthy	`config/clients`
`fp_templates`	software	healthy	`config/fp_templates`
`tests`	software	healthy	`tests`
`fixtures`	software	healthy	`tests/fixtures`
`api`	software	healthy	`api`
`docs`	software	healthy	`docs`
`audits`	software	healthy	`docs/audits`
`scripts`	software	healthy	`scripts`
`deploy`	software	healthy	`deploy`
`agents`	software	healthy	`agents`
`tools`	software	healthy	`tools`
`mcp_server`	software	healthy	`mcp_server`

Label	Layer	Status	Path
`port:11`	network	healthy	`tail-usage.sh`
`port:19`	network	healthy	`tail-usage.sh`
`port:8001`	network	healthy	`Dockerfile`
`port:16`	network	healthy	`docker/sandbox/honeypot.py`
`port:7900`	network	healthy	`docker/browser/Dockerfile`
`port:8888`	network	healthy	`deploy/docker-compose.vpn.yml`
`port:127`	network	healthy	`tools/darkweb.py`

Label	Layer	Status	Path
`mysql`	data	healthy	`tools/exposure_test.py`
`postgresql`	data	healthy	`tools/exposure_test.py`
`redis`	data	healthy	`tools/exposure_test.py`
`elasticsearch`	data	healthy	`tools/exposure_test.py`
`mongodb`	data	healthy	`tools/exposure_test.py`
`mariadb`	data	healthy	`tools/generate_pptx.py`

Label	Layer	Status	Path
`vps::azure`	hardware	healthy	`README.md`
`vps::ec2`	hardware	healthy	`tools/classify_attack.py`
`vps::aws`	hardware	healthy	`tools/detect_phishing_page.py`
`vps::gcp`	hardware	healthy	`tools/enrich.py`
`vps::linode`	hardware	healthy	`tools/enrich.py`
`vps::digitalocean`	hardware	healthy	`tools/enrich.py`

Label	Layer	Status	Path
`image::Dockerfile`	hardware	healthy	`Dockerfile`
`image::docker/sandbox/Dockerfile`	hardware	healthy	`docker/sandbox/Dockerfile`
`image::docker/browser/Dockerfile`	hardware	healthy	`docker/browser/Dockerfile`

Label	Layer	Status	Path
`repobility-clone-729f59jj`	software	healthy	`/tmp/repobility-clone-729f59jj`

Label	Layer	Status	Path
`nginx`	network	healthy	`config/playbooks/web-shell.yaml`

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/8f9e10b2-cd93-48ee-9b10-7b6256dacfeb/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/8f9e10b2-cd93-48ee-9b10-7b6256dacfeb/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.

WillBanasik/socai

Complete repo analysis

function 50+

file 50+

class 50+

service 36

auth 26

directory 19

port 7

database 6

vps 6

container 3

repo 1

load_balancer 1