README
¶
Smithy
Smithy is a workflow engine for security tooling powered by smithy.security that automates security teams' frameworks built on top of Open Cybersecurity Schema Framework.
Links
- Architecture: understand how Smithy works
- SDK: build your custom security tooling on top of Smithy. Example.
- Smithyctl: CLI to build and execute workflows
- Blog
- Smithy at AppSecDublin: slides and video
- Smithy at State Of Open Conf UK 2025: slides and video
Getting Started
Prerequisites
Execute a workflow
Clone this repository git clone https://github.com/smithy-security/smithy.git and run the
following command from within it:
smithyctl workflow run --spec-path=examples/golang/workflow.yaml --build-component-images=true
Check the findings in the logs.
Contacts
Join our Discord server to get support and ask questions.
Directories
¶
| Path | Synopsis |
|---|---|
|
api
|
|
|
cmd
|
|
|
consumers
Package consumers provides helper functions for working with Smithy compatible outputs as a Consumer.
|
Package consumers provides helper functions for working with Smithy compatible outputs as a Consumer. |
|
consumers/aws-s3
Package main of the aws-s3 consumer implements a simple consumer for uploading smithy results to the S3 bucket passed as an argument the consumer expects the environment variables AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY to be set
|
Package main of the aws-s3 consumer implements a simple consumer for uploading smithy results to the S3 bucket passed as an argument the consumer expects the environment variables AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY to be set |
|
consumers/bigquery
Package main of the bigquery consumer puts smithy issues into the target bigquery dataset, it will create teh dataset and the schema if one does not exist
|
Package main of the bigquery consumer puts smithy issues into the target bigquery dataset, it will create teh dataset and the schema if one does not exist |
|
consumers/pdf
Package main of the pdf consumer implements a simple consumer for applying a go-template to a smithy scan, converting the result to pdf and then uploading the result to the S3 bucket passed as an argument the consumer expects the environment variables AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY to be set along with the "bucket" and "region" arguments to be passed
|
Package main of the pdf consumer implements a simple consumer for applying a go-template to a smithy scan, converting the result to pdf and then uploading the result to the S3 bucket passed as an argument the consumer expects the environment variables AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY to be set along with the "bucket" and "region" arguments to be passed |
|
enrichers
Package enrichers provides helper functions for writing Smithy compatible enrichers that enrich smithy outputs.
|
Package enrichers provides helper functions for writing Smithy compatible enrichers that enrich smithy outputs. |
|
enrichers/codeowners
Package main of the codeowners enricher handles enrichment of individual issues with the groups/usernames listed in the github repository CODEOWNERS files.
|
Package main of the codeowners enricher handles enrichment of individual issues with the groups/usernames listed in the github repository CODEOWNERS files. |
|
enrichers/custom-annotation
Package main of the codeowners enricher handles enrichment of individual issues with the groups/usernames listed in the github repository CODEOWNERS files.
|
Package main of the codeowners enricher handles enrichment of individual issues with the groups/usernames listed in the github repository CODEOWNERS files. |
|
enrichers/github-url
Package main of the codeowners enricher handles enrichment of individual issues with the groups/usernames listed in the github repository CODEOWNERS files.
|
Package main of the codeowners enricher handles enrichment of individual issues with the groups/usernames listed in the github repository CODEOWNERS files. |
|
producers
Package producers provides helper functions for writing Smithy compatible producers that parse tool outputs.
|
Package producers provides helper functions for writing Smithy compatible producers that parse tool outputs. |
|
producers/cdxgen
Package main of the cdxgen producer parses the CycloneDX output of cdxgen and create a singular Smithy issue from it
|
Package main of the cdxgen producer parses the CycloneDX output of cdxgen and create a singular Smithy issue from it |
|
producers/dependency-track
Package main of the dependency track producer reads a dependency track export and translates it to smithy format
|
Package main of the dependency track producer reads a dependency track export and translates it to smithy format |
|
producers/trufflehog
Package main implements the binary for parsing trufflehog results into the smithy format
|
Package main implements the binary for parsing trufflehog results into the smithy format |
|
reporters/defectdojo
Module
|
|
|
reporters/discord
Module
|
|
|
reporters/elasticsearch
Module
|
|
|
reporters/jira
Module
|
|
|
reporters/json-logger
Module
|
|
|
reporters/linear
Module
|
|
|
reporters/pdf
Module
|
|
|
reporters/slack
Module
|
|
|
scanners/bandit
Module
|
|
|
scanners/checkov
Module
|
|
|
scanners/codeql
Module
|
|
|
scanners/gosec
Module
|
|
|
scanners/kics
Module
|
|
|
scanners/mobsfscan
Module
|
|
|
scanners/osv-scanner
Module
|
|
|
scanners/semgrep
Module
|
|
|
scanners/snyk
Module
|
|
|
scanners/trivy
Module
|
|
|
scanners/trufflehog
Module
|
|
|
scanners/zaproxy
Module
|
|
|
targets/git-clone
Module
|
|
|
new-components
|
|
|
enrichers/custom-annotation
Module
|
|
|
reporters/json-logger
Module
|
|
|
scanners/bandit
Module
|
|
|
scanners/gosec
Module
|
|
|
targets/git-clone
Module
|
|
|
pkg
|
|
|
context
Package context offers a set of methods which permit components to
|
Package context offers a set of methods which permit components to |
|
enumtransformers
Package enumtransformers transforms from smithy internal enums to text and back
|
Package enumtransformers transforms from smithy internal enums to text and back |
|
templating
Package templating includes helper methods that apply go templates to Smithy Raw and Enriched Issues and return the resulting str
|
Package templating includes helper methods that apply go templates to Smithy Raw and Enriched Issues and return the resulting str |
|
testutil
Package testutil contains helper functions and subpackages to make testing the project easier
|
Package testutil contains helper functions and subpackages to make testing the project easier |
|
sdk
module
|
|
|
smithyctl
module
|
Click to show internal directories.
Click to hide internal directories.