Oracle logo

Attack paths, not rows

Ask how they get in.
Get the path back.

Oracle is a query language whose results are attack paths across identity and network graphs. Ask how a principal can reach a capability, and Oracle returns the concrete chain of permissions and trust that gets them there, hop by hop, with the exact edge behind each step.

View on GitHub See the queries
# who can reach admin, and exactly how?
PATHS FROM user("alice") TO action("iam:*")

alice --sts:AssumeRole--> role("ci-runner")
    --iam:PassRole--> role("deployer")
    --iam:PutUserPolicy--> action("iam:*")

Run a real query, right here

How to use this playground

Pick a start principal and, for path queries, a target capability, then run one of the three query kinds. PATHS shows every route from that principal to the target, hop by hop. ESCALATE finds routes to administrative power. BLAST shows everything the principal can already reach. The compiled OQL query and its result render live below, using the same engine as the Rust tool.

The graph this is searching

One query, the whole chain.

A real run against the synthetic identity graph the repo ships in data/sample-graph.json.

$ cargo run -- query 'PATHS FROM user("alice") TO action("*")'
5 attack path(s):

[1] user:alice --[member_of]--> group:developers --[can_assume sts:AssumeRole]--> role:build-runner
[2] user:alice --[member_of]--> group:developers --[can_assume sts:AssumeRole]--> role:build-runner --[can_assume sts:AssumeRole]--> role:deployer
[3] user:alice ... role:deployer --[has_permission s3:*]--> resource:prod-artifacts
[4] user:alice ... role:deployer --[has_permission iam:PutRolePolicy]--> role:admin
[5] user:alice ... role:admin --[has_permission *]--> resource:all-resources

Path 5 is the full escalation: alice reaches a role that holds *, so every resource is in reach. The chain, not just the verdict.

How it differs

IAM policy simulators

Answer "can alice do X" for one action. Oracle answers "how does alice become admin" and shows the multi-hop route through roles and trust.

Graph dumps

Give you nodes and edges to eyeball. Oracle compiles a question into a path search and returns only the chain that matters.

Oracle

A small query language over the identity graph. It imports AWS IAM from get-account-authorization-details and answers privilege-escalation and lateral-movement questions in OQL, with an MCP tool so an agent can ask them directly.

The query language

Four questions, four queries.

PATHS

PATHS FROM user("alice") TO action("*"). Every route from a principal to a capability, hop by hop.

ESCALATE

ESCALATE FROM role("ci-runner"). Where a starting principal can climb to more privilege.

BLAST

BLAST role("deployer"). Everything a compromised principal can reach, its blast radius.

VIA / WITHIN / ON

Constrain a search to pass through a node, stay within a hop budget, or land on a specific resource.

CLI, HTTP API, and an MCP tool.

Import

Feed it AWS get-account-authorization-details JSON and Oracle builds the identity graph.

Query

Run OQL from the CLI, or POST it to the HTTP API and get the paths back as JSON, with a browser UI to explore.

MCP server

An agent auditing an account can ask Oracle for escalation paths and blast radius directly over MCP.

Rust

One static binary, a graph engine and an OQL parser, no external services.