> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/gadievron/raptor/llms.txt
> Use this file to discover all available pages before exploring further.

# Dependencies and Licenses

> External tools, dependencies, and licensing information for RAPTOR

## Overview

RAPTOR requires several external tools for its security testing capabilities. This page lists all dependencies, their licenses, installation instructions, and important usage restrictions.

<Warning>
  **Important:** RAPTOR does not bundle external tools. Users must install them separately according to each tool's license terms. Without bundling, RAPTOR may auto-download tools as needed.
</Warning>

## What RAPTOR Includes

**Bundled with RAPTOR:**

* Custom Semgrep rules (`engine/semgrep/rules/`) - Written by RAPTOR authors, MIT licensed
* CodeQL query suites (`engine/codeql/suites/`) - Configuration files, MIT licensed
* Python code (all `packages/`, `core/`) - Written by RAPTOR authors, MIT licensed

**No external binaries or libraries are bundled with RAPTOR.**

***

## Required Tools

### Semgrep (Static Analysis Scanner)

<CodeGroup>
  ```bash Installation theme={null}
  pip install semgrep
  ```
</CodeGroup>

* **License:** LGPL 2.1
* **Source:** [https://github.com/semgrep/semgrep](https://github.com/semgrep/semgrep)
* **Usage:** RAPTOR calls `semgrep` command-line tool for pattern-based static analysis
* **Note:** User installs separately, not bundled with RAPTOR

<Info>
  Review Semgrep's LGPL 2.1 license for your specific use case, especially for commercial applications.
</Info>

### Python Packages

Install from requirements.txt:

<CodeGroup>
  ```bash Installation theme={null}
  pip install -r requirements.txt
  ```
</CodeGroup>

**Included packages:**

* `requests` (Apache 2.0) - HTTP client
* `anthropic` (MIT) - Anthropic API client
* `tabulate` (MIT) - Table formatting
* Additional packages listed in requirements.txt

***

## Optional Tools

These tools are required only for specific RAPTOR features.

### AFL++ (Binary Fuzzer)

<CodeGroup>
  ```bash macOS theme={null}
  brew install afl++
  ```

  ```bash Ubuntu/Debian theme={null}
  apt install afl++
  ```
</CodeGroup>

* **License:** Apache 2.0
* **Source:** [https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus)
* **Usage:** RAPTOR calls `afl-fuzz` command when using `/fuzz` command
* **Required for:** Binary fuzzing workflows

### CodeQL (Static Analysis Engine)

<CodeGroup>
  ```bash Installation theme={null}
  # Download from GitHub releases
  curl -L "https://github.com/github/codeql-cli-binaries/releases/download/v2.15.5/codeql-linux64.zip" -o codeql.zip
  unzip codeql.zip -d /opt
  export PATH="/opt/codeql:$PATH"
  ```
</CodeGroup>

* **License:** GitHub CodeQL Terms (free for security research)
* **Source:** [https://github.com/github/codeql](https://github.com/github/codeql)
* **Usage:** RAPTOR calls `codeql` command for deep semantic analysis
* **Required for:** `/codeql` and `/agentic` commands with CodeQL enabled

<Warning>
  **Commercial Use Restriction:** CodeQL does not allow commercial use. Review GitHub's CodeQL Terms before using in commercial environments.
</Warning>

### Ollama (Local/Remote Model Server)

<CodeGroup>
  ```bash Local Installation theme={null}
  # Download from https://ollama.ai
  curl -fsSL https://ollama.ai/install.sh | sh
  ```

  ```bash Remote Configuration theme={null}
  export OLLAMA_HOST=http://your-server:11434
  ```
</CodeGroup>

* **License:** MIT
* **Source:** [https://github.com/ollama/ollama](https://github.com/ollama/ollama)
* **Default:** `http://localhost:11434`
* **Usage:** RAPTOR connects to Ollama server for local model inference
* **Required for:** Local LLM analysis (alternative to cloud providers)

### rr (Record-Replay Debugger)

<CodeGroup>
  ```bash Ubuntu/Debian theme={null}
  apt install rr
  ```

  ```bash Build from Source theme={null}
  git clone https://github.com/rr-debugger/rr
  cd rr && cmake . && make && sudo make install
  ```
</CodeGroup>

* **License:** MIT
* **Source:** [https://github.com/rr-debugger/rr](https://github.com/rr-debugger/rr)
* **Platform:** Linux only (x86\_64)
* **Usage:** RAPTOR uses for deterministic debugging in `/crash-analysis` command
* **Required for:** Crash analysis workflows

<Info>
  rr requires kernel configuration: `echo 1 | sudo tee /proc/sys/kernel/perf_event_paranoid`
</Info>

### gcov (Code Coverage Tool)

* **License:** GPL (part of GCC)
* **Source:** [https://gcc.gnu.org/onlinedocs/gcc/Gcov.html](https://gcc.gnu.org/onlinedocs/gcc/Gcov.html)
* **Installation:** Bundled with gcc (no separate install needed)
* **Usage:** RAPTOR uses for code coverage analysis in `/crash-analysis` command
* **Note:** Automatically available with gcc installation

### AddressSanitizer (Memory Error Detector)

* **License:** Apache 2.0
* **Source:** [https://github.com/google/sanitizers](https://github.com/google/sanitizers)
* **Installation:** Built into gcc >= 4.8 and clang >= 3.1
* **Usage:** Compile with `-fsanitize=address` flag
* **Note:** RAPTOR detects ASAN builds for enhanced crash diagnostics

### Google Cloud BigQuery (OSS Forensics)

<CodeGroup>
  ```bash Setup theme={null}
  # Set credentials environment variable
  export GOOGLE_APPLICATION_CREDENTIALS="/path/to/credentials.json"
  ```
</CodeGroup>

* **License:** Google Cloud Terms of Service
* **Source:** [https://cloud.google.com/bigquery](https://cloud.google.com/bigquery)
* **Usage:** RAPTOR uses for GitHub Archive queries in `/oss-forensics` command
* **Required for:** OSS forensics investigations only
* **Documentation:** See `.claude/skills/oss-forensics/github-archive/SKILL.md`

***

## System Tools

These tools are pre-installed on most systems.

### LLDB (Debugger)

* **Platform:** macOS (pre-installed with Xcode Command Line Tools)
* **License:** Apache 2.0 (part of LLVM)
* **Usage:** RAPTOR uses for crash analysis on macOS

### GDB (Debugger)

* **Platform:** Most Linux distributions (pre-installed)
* **License:** GPL v3
* **Usage:** RAPTOR uses for crash analysis on Linux
* **macOS Installation:** `brew install gdb` (if needed)

### Standard Unix Tools

**Tools:** nm, addr2line, objdump, file, strings (GNU Binutils)

* **Platform:** macOS and most Linux distributions (pre-installed)
* **License:** GPL v3
* **Usage:** RAPTOR uses for binary analysis

***

## License Summary

<Card title="RAPTOR License" icon="scale-balanced">
  **License:** MIT

  **Copyright:** Gadi Evron and Daniel Cuthbert

  See LICENSE file in repository
</Card>

### External Tool Licenses

| Tool                         | License      | Commercial Use | Notes                  |
| ---------------------------- | ------------ | -------------- | ---------------------- |
| Semgrep                      | LGPL 2.1     | Review terms   | User installs          |
| AFL++                        | Apache 2.0   | ✅ Allowed      | User installs          |
| CodeQL                       | GitHub Terms | ❌ Restricted   | Security research only |
| Python packages              | Various OSS  | ✅ Allowed      | Managed by pip         |
| System tools (GDB, binutils) | GPL v3       | ⚠️ Note below  | Command-line use       |

<Warning>
  **GPL Tools:** GDB and binutils are used as command-line tools, not linked libraries. However, review GPL v3 terms for your specific use case.
</Warning>

***

## Compliance Notes

<AccordionGroup>
  <Accordion title="Commercial Use Considerations">
    * **CodeQL:** Does not allow commercial use. Free for security research and open source only.
    * **Semgrep:** Review LGPL 2.1 license terms for commercial applications.
    * **GPL Tools:** Used as command-line tools (not linked libraries), but review GPL v3 for your use case.
  </Accordion>

  <Accordion title="DevContainer Bundling">
    The RAPTOR devcontainer bundles all tools for convenience. When using the devcontainer:

    * You still must comply with each tool's license terms
    * Tools are installed from official sources during container build
    * No license terms are changed by bundling
  </Accordion>

  <Accordion title="Auto-Download Warning">
    Without using the devcontainer, RAPTOR may automatically download and install tools as needed. This happens when:

    * A command requires a tool that isn't installed
    * RAPTOR detects missing dependencies

    **Recommendation:** Pre-install required tools or use the devcontainer to control installations.
  </Accordion>
</AccordionGroup>

<Info>
  **Disclaimer:** You should review all respective tool licenses on your own. The information above is informational only and does not constitute legal advice.
</Info>

***

## DevContainer Advantage

The RAPTOR devcontainer includes all tools pre-installed:

✅ No manual installation required
✅ Consistent environment across platforms
✅ All dependencies pre-configured
✅ Version compatibility guaranteed

See [DevContainer Setup](/resources/devcontainer) for details.

***

## Installation Verification

<CodeGroup>
  ```bash Verify All Tools theme={null}
  # Check Semgrep
  semgrep --version

  # Check CodeQL
  codeql version

  # Check AFL++
  afl-fuzz -h

  # Check Python packages
  python3 -c "import anthropic, requests, tabulate; print('All packages installed')"

  # Check debuggers
  gdb --version
  lldb --version

  # Check rr (Linux only)
  rr --version
  ```
</CodeGroup>

<Check>
  If all commands succeed, you have all required tools installed.
</Check>