Research artifact. Seed & Vine was developed as an academic proof-of-concept to validate the architectural feasibility of neuro-symbolic adversary emulation with structured safety controls. All evaluation was conducted in controlled, isolated lab environments against sandboxed agents; the plugin has never been tested against production infrastructure.
Lab conditions deliberately simplify network topology, agent diversity, and threat complexity. They are not a substitute for real-world validation. This is intentional: the goal was to establish whether the architecture works, not to ship a production tool.
The patterns demonstrated here (FSM-layered planning, HITL approval gates, LLM-agnostic provider rotation, pseudonymized AI context) are intended as a research foundation and reference implementation. Researchers building on this architecture, extending its capabilities, or validating it against more complex environments are encouraged to do so.
Autonomous adversary emulation for MITRE CALDERA, driven by a neuro-symbolic AI engine.
Seed & Vine is a CALDERA v4 plugin that accepts a mission goal from a human operator, performs automated reconnaissance against a deployed agent, and then autonomously executes a full ATT&CK kill chain, searching a semantic library of 2000+ techniques (Seed), generating new ones on demand (Vine), and halting for human approval before every high-risk action.
| Capability | Detail |
|---|---|
| Autonomous kill-chain planning | A three-layer FSM drives discovery → privilege escalation → defense evasion → credential access → collection → exfiltration without manual tactic selection |
| Semantic ability search | ChromaDB + ONNX embeddings index every loaded CALDERA ability; the AI searches by natural-language objective, not by ability ID |
| On-demand ability generation | When no existing ability fits a task, SeedVineFactory synthesizes a new CALDERA-compatible YAML ability at runtime |
| Human-in-the-loop approval gate | High-risk tactics (privilege escalation, credential access, exfiltration) pause the operation and wait up to 30 minutes for operator approval |
| PII shielding | Hostnames, usernames, IP addresses, and domain names are replaced with pseudonyms before they reach any LLM; an append-only ledger records every substitution |
| Multi-provider LLM rotation | Anthropic Claude and Google Gemini providers are pooled with sliding-window rate limiting; the planner transparently fails over when a provider is rate-limited |
| Anthropic prompt caching | Tool definitions and system prompts are cache-controlled via LiteLLM; cache reads cost ~10% of a full inference |
| Threat actor emulation | APT41 (G0096) and Lazarus Group (G0032) TTP profiles drive default tactic ordering and exfiltration method priority |
| MLflow experiment tracking | Every operation is recorded as an MLflow run (local SQLite backend) with full execution history |
| Real-time SSE console | The Vue.js operator console streams AI reasoning, tool calls, phase transitions, approval requests, and pseudonym events via Server-Sent Events |
MITRE CALDERA's official MCP plugin enables AI-driven ability selection and execution. Four gaps motivated this work:
| Gap | Issue |
|---|---|
| Infrastructure data privacy | Agent hostnames, usernames, and IP addresses pass raw to external LLM APIs, leaking network topology to third-party providers. |
| No rejection memory or human veto | The operator can observe but cannot reject a specific approach. Rejected decisions are not fed back to the planner, so the same strategy recurs. |
| No emergency stop | There is no mechanism to halt an in-progress operation mid-execution without killing the CALDERA process. |
| Unstructured AI autonomy | The AI can propose any ability in any order: no kill-chain sequencing, no phase guardrails, no iteration cap. |
Existing automated red-team tools (PentestGPT, PentestAgent, VulnBot, AutoRedTeamer) address subsets of this space: LLM-guided planning, tool-calling wrappers, or automated vulnerability chains. None simultaneously enforce a structured kill chain, gate high-risk actions on human approval, and shield network topology from external LLMs within an extensible adversary emulation platform.
| Gap | Mechanism |
|---|---|
| Infrastructure data privacy | PseudonymManager replaces all host identifiers with opaque tokens before any LLM call; an append-only audit ledger records every substitution |
| Human control and rejection memory | An asyncio.Event approval gate halts execution before high-risk actions; rejected approaches are stored in rejection_memory and injected into every subsequent prompt |
| Emergency stop | POST /api/stop cancels the running asyncio task mid-loop; cleanup removes all temporary CALDERA operations and adversaries |
| Kill chain enforcement | A three-layer FSM (SeedVineService → KillChainGovernor → TaskState) enforces ATT&CK phase ordering and caps total iterations |
Seed & Vine demonstrates that a neuro-symbolic architecture (LLM planning layered over a deterministic FSM with rule-based guardrails) can achieve adaptive adversary emulation with structured safety controls. It is appropriate for:
- Security researchers exploring AI-assisted adversary emulation architectures
- Red teams evaluating human-in-the-loop control mechanisms for AI agents
- Academics studying neuro-symbolic AI applied to cybersecurity
It is not a replacement for mature platforms, has not been validated against production infrastructure, and does not implement lateral movement, persistence, or impact phases.
Operator (Vue.js GUI)
│ REST / SSE
▼
seed_vine_api.py ←─── 21 HTTP routes + SSE stream
│
▼
seed_vine_svc.py ←─── Layer 1: Operation FSM
(SeedVineService) state, approval gate, SSE, cleanup
│
▼
kill_chain_governor.py ←─── Layer 2: Adaptive Planning FSM
(KillChainGovernor) reason → execute → validate → adapt
│
▼
task_state.py ←─── Layer 3: Per-task lifecycle
(TaskState) not_started → in_progress → completed
│
┌────┴────────────────────────────┐
▼ ▼
seed_vine_planner_client.py ability_executor.py
DSPy ReAct (max_iters=10) CALDERA link injection
+ MCP subprocess temp adversary → operation
+ provider rotation → link → poll → harvest
│
▼
seed_vine_server.py ←─── 11 FastMCP tools
search_*_ability_library (search, execute, propose,
execute_existing_ability store_fact, signal_*)
propose_new_ability
│
▼
ability_index.py ←─── ChromaDB (ONNX embeddings)
semantic search persisted to data/.chroma_index/
tactic filter built once, mmap reads
The operation controller (SeedVineService) owns one asyncio.Lock: only one operation runs at a time; a concurrent start request returns an error immediately. An asyncio.Event implements the approval gate: the coroutine pauses in place without losing state while waiting for the operator's APPROVE or REJECT.
Chinese Ministry of State Security contractor group. Characterized by blended espionage and financially motivated operations.
Default exfiltration priority: Cloudflare C2 → DNS Tunneling → OneDrive
Lazarus Group (HIDDEN COBRA), MITRE G0032
North Korean Reconnaissance General Bureau unit. Known for long-dwell, financially motivated intrusions.
Default exfiltration priority: Direct C2 Channel → SMTP Email → Dropbox
| Tactic | ATT&CK ID | Name | Risk |
|---|---|---|---|
| discovery | T1082 | SV Pre-Operation Reconnaissance | Low (dedicated path) |
| exfiltration | T1041 | Lazarus - Direct C2 Channel | Critical |
| exfiltration | T1041 | APT41 - Cloudflare C2 Channel | Critical |
| exfiltration | T1048.001 | APT41 - DNS Tunneling Exfiltration | Critical |
| exfiltration | T1567.002 | Lazarus - Dropbox Cloud Storage | Critical |
| exfiltration | T1567.002 | APT41 - OneDrive Cloud Storage | Critical |
| exfiltration | T1048.003 | Lazarus - SMTP Email Exfiltration | Critical |
Discovery runs via a dedicated code path (_run_discovery_ability) that bypasses the RISK_MATRIX approval gate entirely; it is not subject to the auto_approve flag. All exfiltration abilities require explicit operator approval regardless of threat actor selection.
# 1. Clone CALDERA (if you haven't already)
git clone https://github.com/mitre/caldera.git --recursive
cd caldera
# 2. Install CALDERA core dependencies
pip install -r requirements.txt
# 3. Install Seed & Vine dependencies
pip install -r plugins/seed_and_vine/requirements.txt
# 4. Configure secrets
cp plugins/seed_and_vine/.env.example plugins/seed_and_vine/.env
# Edit .env, set CALDERA_API_KEY and at least one LLM provider key
# 5. Start CALDERA (dev mode)
python server.py --insecure
# 6. Open the operator console
# http://localhost:8888/plugin/seed_and_vine/gui
# 7. MLflow experiment tracking
# http://localhost:5000For a full walkthrough including agent deployment, fact source configuration, and provider setup, see INSTALL.md.
| Document | Contents |
|---|---|
| INSTALL.md | Complete installation guide, prerequisites, first-run verification |
| ARCHITECTURE.md | Technical deep dive of every component: FSM layers, DSPy signatures, MCP tools, PII shielding |
| CONFIGURATION.md | Every configuration option with real defaults: .env, llm_providers.yaml, sv-facts.yml, risk matrix |
| CONTRIBUTING.md | How to add threat actors, abilities, and exfil methods; development workflow |
| Dependency | Version | Purpose |
|---|---|---|
| Python | ≥ 3.10 | Runtime |
| MITRE CALDERA | v4.x | Platform |
| dspy-ai | 3.1.2 | ReAct planner, ChainOfThought reasoner |
| chromadb | 1.5.0 | Semantic ability search |
| mcp | 1.26.0 | MCP tool server (FastMCP) |
| mlflow | 3.8.1 | Experiment tracking |
| anthropic | 0.77.0 | Claude API client |
| google-generativeai | 0.8.6 | Gemini API client |
| litellm | 1.81.3 | Unified LLM interface + cache hook |
| aiohttp | 3.13.3 | Async HTTP (CALDERA API calls) |
Full pinned dependency list: requirements.txt
Seed & Vine is a research proof-of-concept, not a production-ready tool. It is shared openly as a reference implementation.
Found a bug, have a question, or want to contribute? Please open an issue on the Issues page. Pull requests are welcome, see CONTRIBUTING.md.
This plugin is released under the same Apache 2.0 license as MITRE CALDERA.