MAL Toolbox
Overview
MAL Toolbox is a collection of python modules to help developers create models and attack graphs by working with the Meta Attack Language (MAL).
It allows you to:
- Create system models from MAL languages.
- Create attack graphs that can be used to run simulations in MAL Simulator or run your own custom analysis on.
For in-depth documentation and tutorials refer to the mal-toolbox Wiki and the mal-tutorials repository.
Contributing
CI Pipeline
Checks are made with:
mypyruffpytest
Make sure pipeline passes before PR is marked "Ready for review".
Tests
There are unit tests inside of ./tests.
To run all tests, use the pytest command. To run just a specific file or test function use pytest tests/<filename> or pytest -k <function_name>.
Making a release
-
Make a PR with one commit that updates the version number in
pyproject.tomlandmaltoolbox/__init__.py. Follow Semantic versioning. -
Get the PR reviewed and merged to
main. -
Tag the latest commit on
mainwith the new version number. -
Push the tag.
Usage
Installation
pip install mal-toolbox
Requirements
If you wish to run visualisations with graphviz, you must first download and install it on your computer. Depending on your operating system, you can find out how to do this here: link to graphviz installation.
Once the software has been successfully installed, you must also include the python package by running:
pip install graphviz
Configuration
You can use a maltoolbox.yml file in the current working directory to
configure the toolbox.
The config should look like this:
logging:
log_level: INFO
log_file: "logs/log.txt"
attackgraph_file: "logs/attackgraph.json"
model_file: "logs/model.yml"
langspec_file: "logs/langspec_file.yml"
langgraph_file: "logs/langspec_file.yml"
neo4j:
uri: None
username: None
password: None
dbname: None
Alternatively, you can use the MALTOOLBOX_CONFIG
environment variable to set a custom config file location.
# in your shell, e.g. bash do:
export MALTOOLBOX_CONFIG=path/to/yml/config/file
The default configuration can be found here:
https://github.com/mal-lang/mal-toolbox/blob/main/maltoolbox/__init__.py#L39-L53
Command Line Client
You can use the maltoolbox cli to:
- Generate attack graphs from model files
- Compile MAL languages
- Upgrade model files from older versions
Command-line interface for MAL toolbox operations
Usage:
maltoolbox compile <lang_file> <output_file>
maltoolbox generate-attack-graph [--graphviz] <model_file> <lang_file>
maltoolbox upgrade-model <model_file> <lang_file> <output_file>
maltoolbox visualize-model <model_file> <lang_file>
Arguments:
<model_file> Path to JSON instance model file.
<lang_file> Path to .mar or .mal file containing MAL spec.
<output_file> Path to write the result of the compilation (yml/json).
Options:
-h --help Show this screen.
-g --graphviz Visualize with graphviz
Notes:
- <lang_file> can be either a .mar file (generated by the older MAL
compiler) or a .mal file containing the DSL written in MAL.```
1 maintainer
Metadata
1 maintainer
Release files for mal-toolbox 2.11.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| mal_toolbox-2.11.0.tar.gz | 77.9 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| mal_toolbox-2.11.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 168.7 kB
Release files / mal_toolbox-2.11.0.tar.gz
| Download URL | mal_toolbox-2.11.0.tar.gz |
|---|---|
| Size | 77.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
e81dbb7f743279277f279a3f96d91aba48b0f2dd2eafb06135a0838af0be43a5
|
|
BLAKE2b-256 checksum How to use checksums |
0a66bee5ea39fe7c76cc579d20d71b2589cae3ab601bcc49369ffc1d9d6e0e2c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 21, 2026.
Transparency logRelease files / mal_toolbox-2.11.0-py3-none-any.whl
| Download URL | mal_toolbox-2.11.0-py3-none-any.whl |
|---|---|
| Size | 90.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
654d61b83d09bc01a43230b882197eb83525ad32ba9ad7ee70e6357fa150b265
|
|
BLAKE2b-256 checksum How to use checksums |
5dfba61e0563ced0d5505d1f9f42cf010a98ec6d89fc80d8ba910284fa977431
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 21, 2026.
Transparency log
