Downloads
RAGE is the standard in the middle. Two companion tools produce and consume it - they are software, not part of the spec.
Get the standard
To build RAGE support into your own product, vendor a snapshot of the standard and
pin the spec_version (0.1). Everything the format defines is here -
schemas, taxonomy, mappings, rules, and the Exposure DB.
| in the bundle | what it is |
|---|---|
spec/ | normative wire-format, edges, and rule-evaluation text |
schemas/ | JSON Schema for all 8 record kinds |
vocab/ | 105 node types, 80 edge types, 16 conditions |
rules/ | derivation contract + 2,433 match→emit rules |
providers/ | 219 resource mappings + collection recipes (aws/gcp/azure) |
exposure-db/ | 1,048 exposure sites + vocabulary |
examples/ | a minimal valid graph exercising every record kind |
Prefer to pull just what you need? Each record kind's schema is downloadable on its schema page, and every registry file is in the repository.
The tools
Collect
Thunderstorm
Exchange
RAGE
Explore
Blaze Lite viewer
Thunderstorm
A collector and derivation engine. It maps your environment (clouds, identity, CI/CD,
containers, and the systems around them), evaluates effective permissions and trust, and writes a
complete attack graph as a single .rage.ndjson file. The input to everything else.
Thunderstorm ships with Blaze Lite, a self-contained offline viewer for any
.rage.ndjson graph — download the viewer.
The file
| extension | .rage.ndjson, or .rage.zip when compressed |
|---|---|
| media type | application/vnd.rage.graph+ndjson |
| shape | NDJSON - line 1 manifest, every other line a kind-tagged record |
Anything that reads or writes this file speaks RAGE. Emitting it yourself? Validate a record.