Skip to content

Umbryx — Current features and their status

Scale of the codebase today: 100+ Alembic migrations, ~90 router modules (~640 endpoints), ~45 view components, ~47 model files, 260+ backend test files.

Operational core

Feature Status Details
Hosts management Working CRUD, bulk import (Nmap/APS/NetExec/Nessus/Burp), scope filtering, tags, roles, IPs, ports
Credentials Working CRUD, encryption at rest, validation, domain accounts, cred matrix, host linking
Findings Working CRUD, severity, CVSS, CVE, approval workflow, bulk undo
Notes Working CRUD, version control, attachments, markdown, confidentiality tags
Loot Working CRUD, file uploads, encryption, type classification
Scopes Working CIDR/domain/regex, in/out scope, entry gateway, scope filtering on import
Timeline Working Auto-logging, reversible events
Checklist Working Phase-based, order tracking
Objectives Working Flag capture, scoring, categories
Search Working Full-text, saved searches, scope filtering
Collections Working Host grouping, dynamic filters
KB Working Articles, snippets, MITRE ATT&CK catalog

Timeline Scope Objectives

Network Map & Topology

Feature Status Details
Interactive SVG canvas Working Pan, zoom, node drag, region drag/resize
Auto-layout Working Tier-based, attacker cluster, subnet placement
Smart Build Working Role inference, service deps, privilege paths, pivot routes
Attack Graph overlay Working Credential edges, access edges, privilege paths, DA detection
Network regions Working CIDR zones, zone types, manual positioning
BloodHou

Network Map nd import | Working | JSON parser, node/edge ingestion | | Topology builder | Working | Manual proposals, command generation, preview/apply |

C2 Integration

Feature Status Details
Adaptix C2 Working Sync, live agents, execute, BOF catalog, tasks
Mythic C2 Working Sync, live agents, execute, tasks
Slive

Scans / C2 r C2 | Working | Sync, live agents, execute, tasks | | C2 host actions | Working | Multi-framework, session-aware, cred substitution | | C2 webhooks | Working | Inbound beacon data ingestion |

Playbooks & Jobs

Feature Status Details
Playbook editor Working DAG visualization, step search, conditional branching
Job runner Working Worker pool (arq/in-process), cancellation, retry, output streaming
Operation Packs Working Reusable step blocks,

Jobs marketplace templates | | Scheduled playbooks | Working | Cron-based, last-run tracking | | Bulk operations | Working | Multi-host execution, bulk edit, undo | | Attacker SSH exec | Working | Proxychains, global targets, credential resolution |

Attack Path

Feature Status Details
Attack path V2 Working

Attack Path | Tree layout, branches, status/confidence, risk scoring | | Graph API | Working | Nodes/edges/branches CRUD, versioning (snapshot/revert) | | Entity links | Working | Cross-entity relations, dependency graph | | Attack metrics | Working | Tree depth, branch counting, impact/likelihood |

Multi-User & Organizations

Feature Status Details
Organizations Working Org CRUD, plans, team management
P

Organizations roject members | Working | Invite, roles — 11 project roles (owner -> auditor) | | RBAC | Working | 80+ permissions, per-project enforcement | | User management | Working | Admin CRUD, active/inactive, MFA (TOTP) | | Audit trail | Working | All member actions, ROE changes, immutable | | ROE | Working | Rules of Engagement per project |

Infrastructure Auto-Deploy

Feature Status Details
Provisioning engine Working Modular: cloud + deploy + links + creds + engine
Cloud VPS creation Working Hetzner, DigitalOcean, Vultr (auto SSH wait)
Cloud VPS destroy Working Server ID tracking, cleanup
SSH deploy Working paramiko (Ed25519/ECDSA/RSA/DSS), docker run
Docker API deploy Working Remote API, port bindings, volumes
K8s deploy Working kubectl apply, namespace isolation
Nginx redirector config Working Auto proxy_pass C2 backend
DNS (Cloudflare) Working A-record creation via API (in LinkManager)
Stack blueprints Working 3 builtins (C2+Redirector+Dropper, C2+Redirector, Pivot Chain (Ligolo))
Service presets Working 9 presets (adaptix, mythic, sliver, etc.)
Operator workstations Working Docker/K8s cloud provisioning
Instance pool Working Pre-provisioned VPS pool

Security & Encryption

Feature Status Details
JWT auth Working Access + refresh tokens, blacklist
Per-project DEK Working Envelope encryption (KEK -> DEK)
DEK rotation Working Per-project, with rewrap
TOTP MFA Working Setup, verify, disable
Plugin signing Working HMAC-SHA256 bundle verification
Project secrets Working Lifecycle, auto-revoke on closure
Secret scrubbing Working Log redaction (passwords, tokens, hashes)

Platform Operations

Feature Status Details
System logs Working 6 categories (system, security, ops, audit, infra, perf)
System dashboard Working Worker status, queue depth, metrics
DevOps role Working System access without project data
Leader election Working Redis-based, periodic tasks
WebSocket realtime Working Broadcast, filtered by permissions
Notifications **Worki

Platform Ops ng** | Per-user, unread counts | | Project closure | Working | Decommission report, infra teardown, secret revoke | | Snapshots | Working | Project state export/import | | AI assistant | Working | LiteLLM integration, tool calling | | DNS management | Working | Manual records everywhere; zone sync and record

Commands management for Cloudflare and Route53 plus ANetExec/Let's Encrypt DNS-01 in the Enterprise infra stack |

Dashboards

Feature Status Details
Project overview Working Engagement summary on the Overview tab
System dashboard Working Admin → System: health checks (DB/Redis), job and entity metrics
Risk scores Working Per-host risk scores (/api/hosts/risk-scores) and per-path risk distribution in the attack-path view