A deterministic grounding layer that lets AI systems reason about cybersecurity without hallucination.
KGCS (Knowledge Graph for CyberSecurity) agents answer by following an explicit causal chain through a knowledge graph built from ten authoritative sources — never by guessing.
The name is Ariadne's thread — the guide through the labyrinth. And hidden in plain sight: AR·IA·DNA — the DNA of grounded AI reasoning.
Every answer is a traversal. A platform (CPE) is linked to its vulnerabilities (CVE, scored with CVSS), each vulnerability to its underlying weakness (CWE), each weakness to the attack patterns that exploit it (CAPEC), each pattern to adversary techniques (ATT&CK), and each technique to defensive countermeasures (D3FEND), analytics (CAR), and deception/engagement playbooks (SHIELD, ENGAGE). No shortcut edges, no merged identifiers, full source provenance.
| Repo | What it is |
|---|---|
| kgcs-spec | The KGCS standard — OWL ontology, SHACL shapes, mappings and machine-readable contracts. Everything else pins a released version of this repo. |
| kgcs-pipeline | ETL pipeline — downloads the NVD/MITRE sources and builds the Neo4j graph in causal-chain order. Start here to deploy KGCS locally. |
| kgcs-server | Grounded query layer — schema-driven Systems/Offensive/Defensive agents, orchestrator, and an MCP path so any MCP-capable AI assistant (e.g. Claude) can query the graph directly. See docs/mcp/install-guide.md. |
| kgcs-explorer | Interactive graph explorer — schema browser, entity search, causal-chain traversal and rankings over a loaded KGCS graph. |
More components (deployment infrastructure) are being prepared for release.
The fastest path: restore a ready-made KGCS graph and query it from your own Claude Desktop app — no pipeline run, ~10-15 minutes, most of it a download.
→ 5-minute quickstart (versió en català)
Once connected, two tutorials show what a grounded traversal looks like end to end: a SOC investigation (four independent workflows an analyst runs during a shift) and a full incident lifecycle walkthrough (CVE-2021-44228 / Log4Shell, through every NIST SP 800-61 phase).
Need the full reference instead — every option, every failure mode? See kgcs-server's install guide.
Prefer to build the graph yourself instead of loading the published dump:
git clone https://github.com/Ariadna-KGCS/kgcs-pipeline.git
cd kgcs-pipeline && pip install -r requirements.txt
python sync_spec.py && python download.py --standard all
python run_all_etl.py # requires a running Neo4j instance (2026.05.x; Community edition is fine)KGCS v1.0 is a frozen, reproducible baseline — and the subject of ongoing research. Work in progress explores the next version of the spec: extending the causal chain with prioritization and exploitation-evidence signals (KEV, EPSS, SSVC), richer vulnerability semantics (CVE 5.x, VEX) and detection-layer standards (OCSF, Sigma), while deprecating sources that are no longer maintained upstream. Future spec versions will land here as versioned successors — the v1.0 artifacts stay frozen. A companion paper on grounded (neurosymbolic) AI reasoning over the graph is in preparation; a preprint will be linked here when available.
Apache 2.0. CPE, CVE, CVSS, CWE, CAPEC, ATT&CK, D3FEND, CAR, SHIELD and ENGAGE remain the property of their respective owners (NIST, MITRE); KGCS models their semantics and preserves source-specific provenance.