Attack paths, not rows
Oracle is a query language whose results are attack paths across identity and network graphs. Ask how a principal can reach a capability, and Oracle returns the concrete chain of permissions and trust that gets them there, hop by hop, with the exact edge behind each step.
Run a real query, right here
Answer "can alice do X" for one action. Oracle answers "how does alice become admin" and shows the multi-hop route through roles and trust.
Give you nodes and edges to eyeball. Oracle compiles a question into a path search and returns only the chain that matters.
A small query language over the identity graph. It imports AWS IAM from get-account-authorization-details and answers privilege-escalation and lateral-movement questions in OQL, with an MCP tool so an agent can ask them directly.
The query language
PATHS FROM user("alice") TO action("*"). Every route from a principal to a capability, hop by hop.
ESCALATE FROM role("ci-runner"). Where a starting principal can climb to more privilege.
BLAST role("deployer"). Everything a compromised principal can reach, its blast radius.
Constrain a search to pass through a node, stay within a hop budget, or land on a specific resource.
Feed it AWS get-account-authorization-details JSON and Oracle builds the identity graph.
Run OQL from the CLI, or POST it to the HTTP API and get the paths back as JSON, with a browser UI to explore.
An agent auditing an account can ask Oracle for escalation paths and blast radius directly over MCP.
One static binary, a graph engine and an OQL parser, no external services.