Atropos Observatory is the searchable, human-readable reference for Atropos security semantics.
It turns model facts into crawlable symbol pages: the modeled role, watched access path, CWE mapping, attacker-oriented explanation, review checklist, provenance, and a handoff to Lachesis for repository-level reachability analysis.
The Observatory is deliberately static. A modeled boundary is not automatically a vulnerability in every program; the surrounding code still needs review.
The catalog is generated from a sibling Atropos checkout:
workspace/
├── atropos/
└── atropos-observatory/
git clone https://github.com/UnboundCompute/atropos.git
git clone https://github.com/UnboundCompute/atropos-observatory.git
cd atropos-observatory
npm ci
npm run devFor a production static export:
npm run build
ATROPOS_ROOT=/path/to/atropos npm run buildThe generated site is written to out/ and validates the model schema, content overlays, routes, canonical URLs, sitemap, robots directive, and internal links.
- Collision-safe symbol routes from the current Atropos model pack
- Search index at
public/generated/search-index.json - Role, language, kind, and CWE browse facets
- Static
sitemap.xmlandrobots.txt - Reviewed overlays from
content/editorial.json - Per-kind attacker and reviewer templates from
content/kind-templates.json - CWE descriptions from
content/cwe.json
Model facts remain authoritative. Editorial files add explanation and safer-direction guidance without duplicating model fields.
| Command | Purpose |
|---|---|
npm run dev |
Start the local development server |
npm run lint |
Type-check the application |
npm run build |
Generate data, build, and validate the static export |
npm run check:catalog |
Validate generated model data |
npm run check:content |
Validate editorial content |
npm run check:output |
Validate generated HTML and links |
Everything in out/ is static and can be served by Vercel, Hostinger, or any CDN. To upload one archive instead of thousands of files:
(cd out && zip -qr ../atropos-observatory-static.zip .)Extract the archive into the host's public web root.
See CONTRIBUTING.md. Security reports are described in SECURITY.md.
Observatory application code is MIT licensed. Atropos model data remains under its upstream license; see the Atropos repository for those terms.
- Atropos — the model pack and analyzer
- Lachesis — repository-level reachability analysis
- Atropos Observatory — this searchable reference