Umbryx Module Registry¶
Status: Living document — reflects the current codebase. When the code changes shape, update this page with it.
The registry distinguishes three kinds of "module" in Umbryx: formal
backend plugin modules (BackendModule), decorator registries for
pluggable adapters, and manifest-based extension modules shipped in
the repository modules/ directory.
Section A: Formal plugin modules (BackendModule)¶
4 builtin BackendModules registered in app/plugins/loader.py.
| # | Module | Description |
|---|---|---|
| A1 | topology |
Network topology builder from scan imports. Gated by registry.get("topology") in routes; has its own router package (routers/topology/). |
| A2 | nmap_parser |
Nmap XML parser + scan tool connectors (nmap, nuclei, netexec, httpx, ffuf, donpapi). |
| A3 | attacker_ssh |
Remote SSH execution on attacker machines. Config stored in global_settings.attacker_ssh_config; used by the scan/exec/bulk routers and core/attacker_transport.py. |
| A4 | c2_integration |
C2 framework sync (Adaptix, Mythic, Sliver; Cobalt Strike — not supported at this stage). Router package routers/c2/; has an auto-sync background loop. |
Each can be disabled by an admin (POST /api/modules/{id}/disable)
without breaking the rest of the platform.
Section B: Decorator registries¶
These use the @Registry.register("type") adapter pattern.
| # | Registry | Registered items | Notes |
|---|---|---|---|
| B1 | CloudProviderRegistry (ee/infra/cloud_provider.py) |
ssh_host, hetzner, proxmox, aws, docker, k8s, cloudflare_dns, route53_dns |
Cloud and DNS provider adapters (Enterprise Edition infra stack). |
| B2 | DeployMethodRegistry (ee/infra/deploy_method.py) |
ssh, docker, k8s, terraform, ssh_bare |
ssh_bare deploys nginx directly on the host via the distro package manager. |
| B3 | ProviderRegistry (legacy, ee/infra/provider_adapter.py) |
ssh, docker, k8s |
Superseded by B1+B2; kept for backward compatibility. |
| B4 | DNS provider registry | core: manual, cloudflare; EE adds cloudflare_dns, route53_dns adapters with zone sync and ANetExec DNS-01 |
DNS lives under /api/infra-v2/dns in the EE Platform Ops UI. |
| B5 | Storage backend (core/storage.py) |
Local filesystem, S3 | Loot, attachments and evidence storage. |
| B6 | AI provider manager (core/ai_manager.py) |
anthropic, openai, groq, mistral, openrouter, ollama, litellm | OpenAI-compatible local endpoints (ollama, litellm) for air-gapped use. |
| B7 | Notification dispatcher (core/notifications.py) |
Telegram, Slack, Webhook | Config-driven, fire-and-forget. |
Section C: Routers¶
Routers live in app/routers/ (70+ modules plus the c2/,
playbooks/ and topology/ packages) and are registered centrally by
app/routing.py::register_all. The Enterprise Edition adds
app/ee/routers/:
| EE-only router | Prefix |
|---|---|
dns_api |
/api/infra-v2/dns |
infra_v2_api |
/api/infra-v2 (providers, stacks, services, credentials, agents) |
instance_templates_api, managed_instances_api, instance_credentials_api |
managed instance lifecycle |
ssl_api |
certificates / ANetExec |
Notable core routers (not an exhaustive list):
| Router | Prefix | Purpose |
|---|---|---|
auth, oidc_auth, oidc_admin, oidc_platform_admin |
/api/auth, /api/orgs/{id}/oidc-providers, /api/system/oidc-providers |
sessions, MFA, SSO |
projects, members, organizations, project_access |
/api/projects, /api/orgs |
project and org lifecycle, aggregated access info |
hosts, creds, findings, notes, loots, domains |
/api/... |
engagement entities |
scans, bulk_actions, attacker_exec, jobs |
/api/... |
operations run through attacker machines |
c2 package (8 files) |
/api/c2 |
integrations, sessions, exec, sync |
c2_ops_api |
/api/infra-v2/c2 |
on-demand listeners and payload generation |
playbooks package, automations_api |
/api/playbooks, /api/automations |
playbook runs and automations |
sync_api |
/api/sync |
instance-to-instance sync (HMAC-signed events) |
firewall_configs |
/api/.../firewall-configs |
firewall/router config import (9 vendors) |
surface_monitor_api |
/api/.../watch |
attack-surface monitoring |
deconfliction |
/api/.../deconfliction |
host claims between operators |
ai_v2 |
/api/ai |
AI chats, providers, settings |
modules_api, plugins, system_modules |
/api/modules, /api/plugins, /api/admin/modules |
module toggles, .rnplugin bundles, server-side module upload |
admin, audit, audit_api, system_api, system_metrics |
/api/admin, /api/audit, /api/system |
platform administration |
Section D: Models¶
app/models/ holds ~47 files covering projects/members/orgs/teams,
engagement entities (hosts, creds, findings, notes, loot, scopes),
infra v2 (stacks, services, links, credentials, deploy steps, DNS
records), workstations (pool, access, SSH keys, actions), OIDC,
licenses, AI chats, automations, firewall configs, proxies, scan
snapshots, surface watches, and the sync/conflict tables.
Section E: Manifest-based extension modules¶
Repository modules/ directory — extension modules with a
manifest.yaml (see the Module developer guide):
hello-world, ai-assistant, dns-management, notifications,
reporting, roe, ioc-tracker, playbook-automation.
Frontend extension points (sidebar nav, tabs, panels, object views)
are registered from these manifests and rendered through
ExtensionPoint components in the frontend.
Section F: Frontend views¶
The frontend nav groups views into Overview / Recon / Exploit /
Automate / Infra / Output (see frontend/src/constants.js::TAB_GROUPS).
Extension modules can add tabs and panels via the plugin registry
(frontend/src/features/plugins/registry.js).