Most security tooling can't tell you whether a WAF actually works. Atlas Crew Security can. Crucible attacks. Synapse decides. Chimera receives. Crucible's ground-truth assertions evaluate whether what happened matches what should have happened — given Synapse's configuration. Four open-source products, one closed-loop measurement system.
Three flagship products form a measurement loop. Bridge orchestrates them. Each request carries an expected outcome; the assertion fires when actual matches expected — or doesn't. That's the whole point: without a defender in the path, half the assertions break. Synapse is the defender. Crucible is the assertion engine. Chimera is the canvas they share.
— Bring your own WAF. Crucible's assertions work against any defender. Use Synapse for the integrated reference path, or swap it for Cloudflare, AWS WAF, or your own stack — Bridge handles the routing.
Three flagship products at peer level — each useful on its own, integrated into a closed loop. Bridge orchestrates the lab. Each product page covers install, architecture, and the underlying engineering.
High-performance edge defense. Rust + Pingora WAF with embedded decisions, sub-millisecond detection, and fleet-aware intelligence. The inline defender that makes ground-truth assertions meaningful.
Synapse →480+ vulnerable API endpoints across 25 industry verticals — 12 with branded production-style frontends. Real attack surfaces with remediation built in. The standardized canvas that gives every scenario a consistent target.
Chimera →120+ attack scenarios authored against Chimera's specific endpoints. DAG execution, ground-truth assertions, MITRE ATT&CK mapped. The assertion engine that turns "we ran some attacks" into "the WAF blocked exactly what it should have."
Crucible →
Local operational console for the lab. Service inventory, visual config editor, log streamer, dependency-aware lifecycle. npx @atlascrew/bridge up — and the whole platform is running.
The simulation infrastructure beneath the lab. 11 protocol servers, AI red team autopilot, chaos engineering, deception. Used by all four flagship products for traffic, fuzzing, scenarios, and fault injection.
Atlas Crew Security ships with Synapse as the integrated reference defender, but Crucible's ground-truth assertions don't care what's in the path. Point Bridge at Cloudflare, AWS WAF, F5, or your own stack and use Crucible's scenarios to measure what those defenders actually catch — against the same standardized Chimera targets, with the same pass/fail rigor.
Bridge handles the lifecycle. Crucible runs scenarios. Synapse sits in the path. Chimera waits for traffic. Local-first, no signups, no telemetry, no SaaS dependency.