CIRCLE Documentation

Open-source tools built by CIRCLE Cyber — private PKI infrastructure, real-time development frameworks, and cybersecurity utilities for air-gapped environments and production deployments.

Contribute GitHub

Infrastructure

Identity, private PKI, TLS routing and internal DNS — self-hosted, with no cloud or internet dependency.

Auth Service

Self-hosted OAuth 2.1 / OIDC identity provider. Multi-app RBAC, MFA (TOTP + passkeys) and passwordless sign-in, subscription plans with feature flags, consumption tracking, a prepaid credit wallet with an optional LiteLLM LLM gateway, organizations, social login, login history, and MCP server integration.

SNI Router

TLS/SNI passthrough router built on HAProxy. Route HTTPS traffic from a single public IP to multiple backends by hostname — without decrypting anything.

DNS Resolver

Internal DNS server combining CoreDNS and docker-gen. Resolves *.your.domain to your host IP and auto-registers every running container by name.

uPKI CA

Self-hosted Certificate Authority. Issue, renew, and revoke X.509 certificates via ZMQ. Supports custom certificate profiles, CRL generation, and OCSP checks.

uPKI RA

ACME v2 Registration Authority (RFC 8555). Plug Traefik, cert-manager or any ACME client into your private CA — no Let's Encrypt required.

uPKI CLI

Python client for the µPKI stack. Enroll EC P-256 certificates via ACME v2, automate renewal with systemd, and install certs into Firefox and Chrome.

Development

TypeScript frameworks and libraries for building real-time, authenticated backend applications.

IOServer

TypeScript framework combining Fastify (HTTP) and Socket.IO (WebSocket) behind a single API. Services, Controllers, Managers, Watchers, and Middlewares.

IOServer OIDC

Drop-in OIDC/OAuth2 JWT middleware set for IOServer. Protects HTTP routes and Socket.IO namespaces via remote JWKS — no secret storage on the application side.

Cyber

Offensive and defensive security tooling.

RE:GINE

LLM-driven reverse engineering — an autonomous agent pilots headless Ghidra through 230+ MCP tools and delivers a Markdown report. Curated workflows, per-function auto-enhance, binary comparison, cross-binary recall, and REST / MCP / A2A access.

Sysplant

Syscall factory generating Windows syscall bypasses in C, C++, NIM, and Rust — 7 gate iterators, 4 caller methods, symbol scrambling, and MCP server integration.

ShellSnip

Shellcode Factory generating PIC shellcode for Windows and Linux from reusable NASM snippets — recipes, pluggable XOR/chunk encoders, 9 output formats, and an MCP server.

PayloadFactory

AV/EDR-evasion payload factory injecting shellcode into Windows and Linux processes — 31+7 techniques, SysPlant syscalls, obfuscation, environmental keying, and DLL proxying.

HID-Shell

Headless cross-platform raw-HID shell payload for the Vandal agent — spawns a local OS shell and pumps bytes over 64-byte raw HID reports, no network, no console window.