mxcwpp

module

v0.0.0-...-8877ced Latest Latest Go to latest Published: Jun 25, 2026 License: AGPL-3.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/matrixplusio/mxcwpp

Links

Open Source Insights

README ¶

MxCwpp Platform Community Edition

English | 中文

An open-source, enterprise-grade host and container security management platform. Covers security baselines, asset management, vulnerability scanning, antivirus, runtime detection, and compliance auditing — providing a unified management view for security operations teams.

Community Edition

MxCwpp Platform Community Edition includes the complete platform framework and all core security capabilities, sharing the same architecture as the internal version. The Community Edition is fully free with no license required. Currently open-sourced capabilities include:

Full on-device capabilities: Agent data collection, asset fingerprinting, eBPF runtime probes, baseline check plugins, etc.
Full backend capabilities: AgentCenter, Manager, Consumer, service discovery — all horizontally scalable.
Complete management console: Security overview, asset center, alert management, baseline checks, vulnerability management, container security, and more.
Built-in detection rules: 212 CIS baseline rules, 80 container baseline rules, CEL runtime detection policy samples.

To build a more comprehensive security operations system, we recommend extending policies via the built-in CEL rule engine and integrating threat intelligence for secondary processing.

Function List

Feature	Community Edition	Enterprise Edition
Linux data collection (eBPF)	✅	✅
Agent control plane (upgrade/config/task dispatch)	✅	✅
Host status and details	✅	✅
Asset collection (11 types)	✅	✅
Asset fingerprint (global view)	✅	✅
K8s cluster asset collection	✅	✅
Host/container intrusion detection	`built-in samples`	✅
Runtime detection (eBPF + CEL)	`built-in samples`	✅
K8s Audit intrusion detection	`built-in samples`	✅
Behavioral sequence detection	❌	✅
Alert whitelist	✅	✅
Alert aggregation and tracing	✅	✅
Threat response (kill/quarantine/network block)	✅	✅
File quarantine	✅	✅
Vulnerability detection (OSV.dev + CVSS)	✅	✅
Vulnerability intelligence hot-update	❌	✅
Baseline check (CIS Benchmark)	✅	✅
Baseline auto-remediation	✅	✅
Virus scanning (ClamAV + YARA-X)	✅	✅
File integrity monitoring (FIM)	✅	✅
Threat intelligence (MISP IOC)	✅	✅
Container CIS baseline (80 rules)	✅	✅
Audit log	✅	✅
Component management and plugin distribution	✅	✅
System monitoring (Prometheus)	✅	✅
Ops inspection and report export	✅	✅
Memory threat detection (memfd_exec / process hollowing / shellcode / LSASS dump)	✅	✅
AD / LDAP domain controller audit (7 rules: DCSync / Kerberoasting / brute force / etc.)	✅	✅
DKOM rootkit detection (hidden PID / kernel module / port / LD_PRELOAD)	✅	✅
Honeypot sensors (SSH / HTTP decoys + file decoy policy)	✅	✅
VEX vulnerability statement export (CycloneDX 1.5 / CSAF 2.0)	✅	✅
YARA-X malware signature library (73 rules / 50 families)	✅	✅
Threat hunting (SPL-like DSL → SQL transpiler)	✅	✅
Attack storyline (ATT&CK kill-chain timeline)	✅	✅
Behavior baseline detection (ML anomaly scoring)	✅	✅
Windows support	❌	🚧
Active defense (NPatch eBPF hot-patching)	`built-in samples`	✅
Cloud antivirus	❌	🚧

✅ Supported built-in samples includes sample rules ❌ Not supported 🚧 Planned

Features

Module	Description
Security Baseline	9 checkers, 212 rules covering CIS Benchmark core items, single-host and batch auto-remediation
Asset Center	11 asset types (processes, ports, users, packages, containers, etc.), relationship mapping and export
Vulnerability Management	Package PURL collection + OSV.dev matching + CVSS v3.1 scoring + SBOM export
Antivirus	ClamAV + YARA-X dual-engine scanning, task management + quarantine
File Integrity	AIDE-based FIM checks with full-cycle policy, event, and task management
Runtime Detection	Tetragon/eBPF event collection + CEL rule engine + MITRE ATT&CK mapping
Container Security	K8s cluster management, container CIS baseline (80 rules), Audit Webhook integration
Alert Center	Alert aggregation, whitelisting, auto-response (kill/quarantine), tracing timeline
Threat Intelligence	MISP IOC import + Redis cache + CEL real-time matching
Memory Forensics	memfd_exec / process hollowing / shellcode injection / LSASS dump detection (EDR-3)
AD/LDAP Audit	7 detection rules: DCSync, Kerberoasting, brute force, off-hour RDP, privilege assignment, etc. (EDR-4)
Honeypot Sensors	SSH/HTTP decoys + file decoys with whitelist for legitimate backup tools (C1)
Rootkit Detection	DKOM hidden PID / kernel module / port / LD_PRELOAD / /proc inconsistency (C2)
Threat Hunting	SPL-like DSL → SQL transpiler over ClickHouse event archive
VEX Export	CycloneDX VEX 1.5 + CSAF 2.0 for vendor vulnerability statements (B7)

Screenshots

Security Overview — Real-time security posture scoring, alert trends, risk radar Vulnerability List

Vulnerability Management — CVE scanning, CVSS scoring, patch prioritization

Baseline Remediation — CIS Benchmark auto-fix with one-click remediation

Vulnerability Bulletin — CVE intelligence tracking, SLA management

ML Anomaly Detection — Isolation Forest behavioral anomaly scoring

Component Management — Plugin distribution, version control, remote push

Architecture

Browser ─→ Nginx ─→ Manager ×N ─→ MySQL / Redis / ClickHouse / Prometheus
Agent ─→ gRPC(mTLS) ─→ AgentCenter ×N ─→ Kafka ─┬→ Consumer ×N ─→ Storage (persist)
                                                 └→ Engine ×N    ─→ Alerts (detection)
Manager ──HTTP──→ LLMProxy ×N (multi-LLM gateway)   VulnSync ×N ──Kafka──→ Manager/Engine

In v2.0 the backend is split into six microservices: Manager / AgentCenter / Consumer / Engine / LLMProxy / VulnSync. The control plane is fully stateless and scales horizontally. Kafka decouples data persistence from detection (two ConsumerGroups with independent offsets), Redis handles service discovery and distributed locks, and ClickHouse stores time-series analytics and event archives. VulnSync pulls OS vendor advisories and publishes them to Kafka, where the Manager consumer matches them against host software.

See Architecture Documentation for details.

Tech Stack

Layer	Technology
Backend	Go 1.25+ (Gin / gRPC / Gorm / Zap)
Frontend	Next.js 15 + React 19 + TypeScript + TailwindCSS + Zustand + TanStack Query
Storage	MySQL 8.0+ / Redis 7 / ClickHouse 24
Messaging	Kafka (KRaft mode, 7 Topics + DLQ)
Monitoring	Prometheus (sole data source for host metrics)
Communication	gRPC bidirectional streaming + mTLS + Protobuf
Deployment	Docker Compose / Systemd + Nginx

Supported Platforms

Host OS: Rocky Linux 9/10, Oracle Linux 7/8/9, CentOS 7/8/9, Debian 10/11/12, Ubuntu 20.04/22.04

Runtime: Physical / Virtual machines, Docker container hosts, Kubernetes nodes and clusters

Quick Start

git clone https://github.com/matrixplusio/mxcwpp.git
cd mxcwpp/deploy

cp .env.example .env
vim .env  # Edit SERVER_IP / JWT_SECRET / database passwords

# Start control plane (HA mode)
docker compose --env-file .env up -d \
  --scale manager=2 --scale agentcenter=2 --scale consumer=2

Visit http://<SERVER_IP> to access the management console. Default credentials: admin / admin123.

See Deployment Documentation for detailed setup instructions.

Build Commands

make build-server                                        # Build server
make build-consumer                                      # Build consumer
make package-agent-all VERSION=1.0.0 SERVER_HOST=IP:6751 # Package agent (RPM/DEB)
make package-plugins-all VERSION=1.0.0                   # Package plugins
make proto                                               # Generate Protobuf code
make test                                                # Run tests
make lint                                                # Lint check

Project Structure

mxcwpp/
├── cmd/                    # Entry points (agent + 6 server services + mxctl + tools)
│   ├── agent/              # Agent entry
│   └── server/             # manager / agentcenter / consumer / engine / llmproxy / vulnsync
├── internal/
│   ├── server/             # Server packages (manager / agentcenter / consumer / engine / llmproxy / vulnsync / common)
│   └── agent/              # Agent (connection / transport / plugin / heartbeat / edr 25+ submods)
├── plugins/                # 11 plugins (baseline / collector / fim / scanner / avscanner / remediation / rasp-go / rasp-java / rasp-python / rasp-php / rasp-node)
├── api/proto/              # Protobuf definitions
├── web/                    # Frontend (Next.js 15 + React 19 + TypeScript)
├── configs/                # Config files (server.yaml / agent.yaml / rule files)
├── deploy/                 # Docker Compose (dev / v2 / pret) + Nginx + systemd + prod cluster
├── scripts/                # Build and deployment scripts
└── docs/                   # Documentation

Documentation

Architecture - System topology, component responsibilities, data pipeline, HA design
Deployment - Environment setup, single/cluster deployment, Agent installation, upgrades and backups
Configuration - Server config, Agent config, environment variables
API Reference - REST API endpoints, request/response formats, authentication
FAQ - Common issues and troubleshooting
Governance - Project governance model, decision process, security policy
Contributing - Contribution guide, dev environment, code standards, submission process

Star History

Contributors

See CONTRIBUTORS.md.

License

Apache License 2.0

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
agent command Package main 是 Agent 主程序入口	Package main 是 Agent 主程序入口
server/agentcenter command Package main 是 AgentCenter 主程序入口	Package main 是 AgentCenter 主程序入口
server/consumer command Package main 是 Consumer 主程序入口 Consumer 订阅 Kafka Topic，将消息路由写入 MySQL / ClickHouse	Package main 是 Consumer 主程序入口 Consumer 订阅 Kafka Topic，将消息路由写入 MySQL / ClickHouse
server/engine command Package main 是 Engine 主程序入口。	Package main 是 Engine 主程序入口。
server/llmproxy command Package main 是 LLMProxy 主程序入口。	Package main 是 LLMProxy 主程序入口。
server/manager command Package main 是 Manager HTTP API Server 主程序入口	Package main 是 Manager HTTP API Server 主程序入口
server/scanner command Package main 是独立镜像扫描服务入口。	Package main 是独立镜像扫描服务入口。
server/vulnsync command Package main 是 VulnSync 主程序入口。	Package main 是 VulnSync 主程序入口。
tools/advisory-replay-verify command Command advisory-replay-verify 验证「VulnSync→Kafka→Manager consumer」新路径与旧「manager syncCoreAdvisories 自拉」路径产出的 host_vuln 集合等价（S2 红线门）。	Command advisory-replay-verify 验证「VulnSync→Kafka→Manager consumer」新路径与旧「manager syncCoreAdvisories 自拉」路径产出的 host_vuln 集合等价（S2 红线门）。
tools/baseline-import command Package main 将 Elkeid baseline yaml 转成 mxcwpp baseline JSON。	Package main 将 Elkeid baseline yaml 转成 mxcwpp baseline JSON。
tools/etl-alerts-vulns-ch command Command etl-alerts-vulns-ch 一次性把 MySQL 的 alerts / vulnerabilities / host_vulnerabilities 三张表全量迁到 ClickHouse 对应表。	Command etl-alerts-vulns-ch 一次性把 MySQL 的 alerts / vulnerabilities / host_vulnerabilities 三张表全量迁到 ClickHouse 对应表。
tools/etl-audit-log command Command etl-audit-log 一次性把 MySQL audit_logs 历史数据迁到 ClickHouse mxcwpp.audit_log。	Command etl-audit-log 一次性把 MySQL audit_logs 历史数据迁到 ClickHouse mxcwpp.audit_log。
tools/etl-host-metrics command Command etl-host-metrics 把 MySQL host_metrics 全表迁到 ClickHouse mxcwpp.host_metrics。	Command etl-host-metrics 把 MySQL host_metrics 全表迁到 ClickHouse mxcwpp.host_metrics。
tools/etl-storyline-events command Command etl-storyline-events 一次性把 MySQL storyline_events 全表迁到 ClickHouse mxcwpp.storyline_events。	Command etl-storyline-events 一次性把 MySQL storyline_events 全表迁到 ClickHouse mxcwpp.storyline_events。
tools/kms-gen-kek command Package main 生成 mxcwpp KMS 主密钥 (KEK), 一次性初次部署用。	Package main 生成 mxcwpp KMS 主密钥 (KEK), 一次性初次部署用。
tools/migrate-metrics command migrate-metrics 将 MySQL host_metrics 历史数据迁移到 ClickHouse	migrate-metrics 将 MySQL host_metrics 历史数据迁移到 ClickHouse
tools/mxctl command
tools/ruletest command Package main 提供检测规则测试 CLI 工具用法：go run ./cmd/tools/ruletest --rules rules/ --tests testcases/	Package main 提供检测规则测试 CLI 工具用法：go run ./cmd/tools/ruletest --rules rules/ --tests testcases/
tools/stress command stress 是 MxCwpp AgentCenter 压测工具模拟 N 个 Agent 并发通过 gRPC BiDi 流发送心跳，验证 AC → Kafka → Consumer 链路	stress 是 MxCwpp AgentCenter 压测工具模拟 N 个 Agent 并发通过 gRPC BiDi 流发送心跳，验证 AC → Kafka → Consumer 链路
tools/stress-http command stress-http 是 MxCwpp Manager HTTP API 压测工具模拟 N 个并发用户持续请求 Manager API，验证读链路（MySQL/ClickHouse → Manager）	stress-http 是 MxCwpp Manager HTTP API 压测工具模拟 N 个并发用户持续请求 Manager API，验证读链路（MySQL/ClickHouse → Manager）
configs
agent-rules Package agentrules 提供内嵌的 Agent YAML 检测规则	Package agentrules 提供内嵌的 Agent YAML 检测规则
rules Package rules 提供内置检测规则的嵌入数据	Package rules 提供内置检测规则的嵌入数据
internal
agent/buffer Package buffer 提供 Agent 数据传输的环形缓冲区	Package buffer 提供 Agent 数据传输的环形缓冲区
agent/cache Package cache 提供本地缓存功能，用于断网时暂存数据	Package cache 提供本地缓存功能，用于断网时暂存数据
agent/cli Package cli 实现 Agent 辅助命令行子功能（--status / --logs / --config / --diag）	Package cli 实现 Agent 辅助命令行子功能（--status / --logs / --config / --diag）
agent/config Package config 提供配置引导功能	Package config 提供配置引导功能
agent/connection Package connection 提供连接管理功能（服务发现、mTLS）	Package connection 提供连接管理功能（服务发现、mTLS）
agent/dependency Package dependency 管理 Agent 端外部依赖的安装、卸载和状态检测	Package dependency 管理 Agent 端外部依赖的安装、卸载和状态检测
agent/edr Package edr implements the built-in EDR engine for the MxCwpp Agent.	Package edr implements the built-in EDR engine for the MxCwpp Agent.
agent/edr/antidebug Package antidebug 实现 Agent 自我加固 (M1-6)。	Package antidebug 实现 Agent 自我加固 (M1-6)。
agent/edr/av/clamav Package clamav — clamd UDS / TCP 客户端 (B8).	Package clamav — clamd UDS / TCP 客户端 (B8).
agent/edr/bde Package bde implements the Behavior Detection Engine (BDE) profiler.	Package bde implements the Behavior Detection Engine (BDE) profiler.
agent/edr/canary Package canary — 反勒索 / 反横移蜜罐诱饵文件 (B9).	Package canary — 反勒索 / 反横移蜜罐诱饵文件 (B9).
agent/edr/collector Package collector defines the interface and mode detection for EDR event collectors.	Package collector defines the interface and mode detection for EDR event collectors.
agent/edr/container Package container provides container metadata resolution for EDR events.	Package container provides container metadata resolution for EDR events.
agent/edr/elfparse Package elfparse — ELF 二进制解析 + strings 抽取 + entropy 反混淆 (C8).	Package elfparse — ELF 二进制解析 + strings 抽取 + entropy 反混淆 (C8).
agent/edr/event Package event defines unified EDR event types for process, file, and network events.	Package event defines unified EDR event types for process, file, and network events.