Attack paths compose individual findings into multi-hop graphs: entrypoint → findings / hops → sensitive outcome. Barriers (effective controls) can mark a path BLOCKED while the standalone finding still stands.

​
CLI

Display filters (written JSON stays full / unfiltered):
  • --mode CONFIRMED_ONLY|CONFIRMED_AND_LIKELY|INCLUDE_UNKNOWN
  • --current / --blocked / --unknown / --critical / --shortest
Experimental / advanced flags:
  • --predictive — predictive surface signals (not findings)
  • --what-if SCENARIO — counterfactual against the graph
  • --diff PATH_A PATH_B — compare two saved attack-paths.json files (see Security Diff)
Diagnostic exit 0. Soft-run during axguard audit.

​
Path statuses

CONFIRMED · LIKELY · UNVERIFIED · INVALID · BLOCKED A path’s status follows its weakest hop plus barrier state. Unknown reachability stays UNVERIFIED — never a public exploit claim.

​
MCP

Slash command: /axguard-paths.