ChaosGuard · raising the shield

000

CHAOSGUARD

Open source · security and chaos engineering

Drop in a GitHub URL. Get back the attacks, and the fixes.

A full security audit, attack chain analysis, a chaos resilience report and fix pull requests, from four escalating tiers of AI agents. All on local models: no API keys, no cloud, no code leaves your machine.

Run it locallySource on GitHub ↗

01 / The scan

Four tiers. Each one deeper than the last.

Start with a one-second static sweep. Go all the way to agents probing your running app. Try it:

01 Recon

02 Hunter

03 Siege

04 Live

  1. Paste a repository and launch. This page plays an example scan of a deliberately vulnerable demo app.
  1. 01ReconSecrets, vulnerable dependencies, risky config, dangerous callsabout 1 second
  2. 02HunterLLM vulnerability hunting with the code retrieved as contextabout 8 minutes
  3. 03SiegeAttack chains, chaos cascades, pentest playbooksabout 15 minutes
  4. 04LiveEverything in Siege, plus active probes against the running appabout 35 minutes

02 / Attack chains

Three small findings. One critical path.

Scanners list issues one by one. The Siege tier reasons like an attacker and joins findings that look harmless alone into the path to your data.

  1. Finding · Medium alone

    JWT secret falls back to a hard-coded string

  2. Finding · Low alone

    Admin role read from the token, not the database

  3. Finding · Low alone

    Export endpoint has no rate limit

  4. Chain · Critical together

    Forge an admin token with the default secret, then export every user

  5. Example chain, on the demo app.

03 / Chaos

What breaks next, before it does.

Beyond vulnerabilities: resilience. ChaosGuard finds what's missing and simulates how one failure spreads.

  • ●Missing circuit breakers, retries, timeouts and health checks
  • ●Compound failure cascades across service boundaries
  • ●Blast radius and recovery time for each scenario
  • ●LitmusChaos experiment specs, ready for Kubernetes
  • ●Real fault injection in a sandbox: latency, CPU, memory, disk, partitions

04 / Fixes

Every finding comes with its fix.

Template fixes for known patterns, LLM patches for the rest. Each one is validated in a sandbox and reviewed by the model before it surfaces, then becomes a pull request in one click.

routes/users.jsvalidated in sandbox
  router.get('/users', async (req, res) => {-   const sql = `SELECT * FROM users WHERE name = '${req.query.name}'`;-   const rows = await db.query(sql);+   const rows = await db.query('SELECT * FROM users WHERE name = $1', [req.query.name]);    res.json(rows);  });

Example fix, on the demo app.

05 / Architecture

Fourteen services. One docker compose up.

A Kafka-driven agent system that runs on a laptop and scales to Kubernetes with the included Helm charts.

Dashboard
Next.js 14
Gateway
Spring Boot 3.2, JWT, WebSocket, circuit breakers
Event bus
Apache Kafka
Agents
Recon, Hunter, Siege and Live workers, LangGraph
Indexer
Repository chunking and embeddings
Vector store
ChromaDB
Models
Ollama, on the host
Stores
PostgreSQL 16, Redis 7
MCP server
ChaosGuard as tools for AI assistants
Observability
Prometheus, Grafana, Tempo

06 / Run it

No API keys. No cloud. Your code stays yours.

docker
$ git clone https://github.com/Ayush1906saxena/ChaosGuard.git$ cd ChaosGuard && cp .env.example .env# models run on your machine$ ollama pull qwen2.5-coder:7b && ollama pull llama3.1:8b && ollama pull nomic-embed-text$ docker compose pull && docker compose up -d# open http://localhost:3000

Prebuilt images on GitHub Packages, rebuilt on every push to master by CI:

  • ghcr.io/ayush1906saxena/chaosguard-gateway
  • ghcr.io/ayush1906saxena/chaosguard-agents
  • ghcr.io/ayush1906saxena/chaosguard-indexer
  • ghcr.io/ayush1906saxena/chaosguard-mcp-server
  • ghcr.io/ayush1906saxena/chaosguard-frontend
GitHub ↗Read the docs ↗

Built by Ayush Saxena · Spring Boot, Python, Kafka, Ollama, ChromaDB · this page: three.js TSL compute