Revolutionary Platform Automates Protocol Repair, Enhancing Real-Time Security with AI and CI/CD Integration
August 26, 2026
The platform centers on automatic repair, supporting sixteen attacker models and guiding search with GNNs for practical, real-time protocol analysis.
Readers are invited to provide feedback from verification-tool communities, and the project remains in development with decisions implemented in code, not as a shipped product.
Converters enable importing descriptions from ProVerif, Tamarin, Scyther, Avispa, CryptoVerif, and Maude to ease adoption across existing models.
CI/CD integration runs as a GitHub Action on every commit, failing builds with concrete attack traces and proposed fixes, and exports machine-readable outputs for pipelines.
The tool transitions from a laboratory instrument to an industrial platform by embedding into development lifecycles and CI/CD workflows.
Unlike ProVerif and Tamarin, which identify attacks, the new tool aims to repair protocols and address quantum, side-channel, and real-world protocols like TLS 1.3, Signal, and WireGuard.
A collaborative web UI visualizes attack graphs, supports side-by-side repairs, and enables in-platform security reviews with comments and approvals.
Key architectural choices include arena allocation, hash-consing for fast terms, work-stealing parallelism with incremental knowledge closure, batch SMT encoding, and Rust for safe parallelism.
Progress includes a stable symbolic analysis core, a repair module that produces verified patches, a GNN-guided search with active learning, and initial quantum, leakage, and MPC modules; gaps remain in Horn clause verification, format exports, distributed analysis, and a WASM web playground.
The tool aims to generate patches that block specific attacks, verify patches against security properties, and optimize across security, performance, and complexity.
The project seeks to automatically repair detected attacks using formally verified patches via Counterexample-Guided Protocol Synthesis (CEGPS).
A daemon with a gRPC API monitors live traffic with a sniffer, performing bounded-state exploration to detect issues during execution.
Summary based on 2 sources

