SCOPE: Security Cloud Ops Purple Engagement

SCOPE runs AWS purple-team workflows with deterministic Python inventory and bounded AI agents. It audits AWS resources, validates attack paths, generates review-only exploit playbooks, produces controls, and guides Splunk investigations.

How It Works

Run SCOPE from Claude Code, Antigravity CLI, Gemini CLI, or Codex CLI:

/scope:audit --all

Quick Start

git clone https://github.com/tayontech/SCOPE.git
cd SCOPE
uv run python -m scope.install

export AWS_PROFILE=your-profile

/scope:audit --all
/scope:audit iam s3 lambda
/scope:exploit arn:aws:iam::123456789012:role/target-role
/scope:exploit
/scope:investigate

Requirements: Python 3.11+, uv, AWS CLI with read-only credentials, and one supported runtime. Node.js supports dashboard generation and Splunk MCP mcp-remote transport.

Scripted installs:

uv run python -m scope.install --claude --local --no-splunk-mcp
uv run python -m scope.install --antigravity --local --no-splunk-mcp
uv run python -m scope.install --gemini --local --no-splunk-mcp
uv run python -m scope.install --codex --local --no-splunk-mcp
uv run python -m scope.install --all --local --with-splunk-mcp

Interactive install asks whether to configure bundled Splunk MCP defaults. Scripted installs skip MCP server settings unless you pass --with-splunk-mcp. Use --no-splunk-mcp when automation should show the choice in logs. SCOPE remains SPL-first until the project adds query-language profiles. See config/mcp-setup.md.

Safety

SCOPE agents run read-only AWS activity by default. config/hooks/scope-safety-guard.sh blocks destructive AWS shell operations before execution. Audit and exploit may write AWS CLI replay command artifacts for human review; agents do not execute those write commands.

Dashboard

Generate one self-contained report for a run:

cd dashboard && npm run dashboard
open dashboard/reports/<run-id>-dashboard.html

An explicit audit run directory basename becomes the dashboard run ID. dashboard/public/index.json stores reports[]; each report points to one audit JSON export and optional controls JSON export. Controls attach to the audit report, so one audit workflow creates one selectable dashboard report.

The dashboard shows attack graphs, path details, public exposure findings, controls, SPL detections, dashboard ideas, policy replacements, and remediation.

Platforms

Google announced on May 19, 2026 that Gemini CLI and Gemini Code Assist IDE extensions stop serving requests for Google AI Pro, Ultra, and free individual users on June 18, 2026. Use Antigravity CLI for new Google installs. SCOPE keeps --gemini for enterprise/API-key users and migration.

Agents And Models

Top-level agents inherit the runtime session model:

• scope-audit orchestrates audit gates, Python runtime execution, attack analysis, replay artifacts, and controls chaining.
• scope-controls orchestrates org-wide issues, detections, dashboard ideas, policy replacements, remediation, and validation.
• scope-exploit generates principal-scoped red-team playbooks.
• scope-investigate runs alert, run-guided, and intel investigation modes.

Subagents run bounded reasoning tasks:

• scope-attack-analyze, scope-attack-validate, scope-public-exposure-analysis, and scope-awscli-replay support attack-path analysis and replay artifacts.
• scope-controls-org-wide, scope-controls-detections, scope-controls-dashboards, scope-controls-policy, scope-controls-remediation, and scope-controls-validate support controls.
• scope-investigate-alert, scope-investigate-intel, and scope-investigate-run prepare investigation context.

When you run /scope:audit --all, the orchestrator runs on your session model, calls scope audit for deterministic Python enumeration and post-processing, seeds IAM and public/service-connected candidates with scope.attack.candidates, dispatches scope-attack-analyze, optionally enriches candidates through scope-research, then can generate review-only AWS CLI replay artifacts for validated paths before chaining controls on a reasoning model.

Claude subagents use the opus[1m] alias for larger context during artifact-heavy analysis and validation. Enumeration uses deterministic Python, not an AI model.

Documentation

Community

• Issues
• Pull Requests

Created by Tayvion Payton