apache/caldera is a Python-based cyber security platform that automates adversary emulation, assists manual red teams, and automates incident response for authorized engagements.

apache/caldera occupies a unique position in the security tooling ecosystem: it is an active research project from MITRE, now hosted under the Apache Foundation, that turns the MITRE ATT&CK framework from a reference taxonomy into an executable engine. The platform is explicitly designed to do three things — automate adversary emulation, assist manual red teams, and automate incident response — which places it squarely in the purple-team space rather than being a single-purpose offensive tool. With over seven thousand stars and an Apache-2.0 license, it is one of the most mature open-source projects in the emulation category, and the README's emphasis on training, documentation, and a capture-the-flag course signals that its intended audience is professional practitioners operating in controlled environments.

Architecturally, the framework splits cleanly into two components. The first is the core system: an asynchronous command-and-control (C2) server exposing both a REST API and a web interface, written in Python 3.10+. The second is a plugin ecosystem that extends the core with agents, reporting, and collections of TTPs. This separation matters operationally because the core remains relatively lean while nearly all of the interesting capability — initial access tooling, payload compilation, technique libraries — lives in independently maintained plugin repositories. The asynchronous design of the C2 channel is worth noting for authorized engagements, as it allows agents to operate over intermittent or delayed contact patterns that mirror realistic adversary infrastructure behavior.

The plugin list in the README reads like a map of the entire emulation workflow. Sandcat is the default agent, Manx provides shell functionality and reverse shell payloads, and Stockpile acts as the storehouse for techniques and adversary profiles. Atomic imports TTPs from the Atomic Red Team project, while Emu brings in CTID adversary emulation plans, giving operators pre-built, intelligence-driven scenarios. On the tooling side, Builder dynamically compiles payloads (the README recommends GoLang 1.24+ for Go-based agents), Access packages initial access techniques, and Human generates simulated noise on endpoints to make operations look more like real user activity — a capability primarily useful for testing detection fidelity rather than evasion for its own sake.

The blue-team side of the house is equally developed, which is what distinguishes caldera from pure offensive frameworks. Response automates incident response actions, Debrief provides operations insights, and GameBoard visualizes joint red and blue operations — effectively a purpose-built purple-team console. Compass adds ATT&CK visualizations, and Magma supplies the new VueJS interface shipped with Caldera v5. There is even Caldera for OT, an ICS/OT capability extension, plus a community tier of plugins including Arsenal with MITRE ATLAS techniques for adversarial ML scenarios, SAML authentication, and third-party contributions like BountyHunter. The Skeleton plugin generator invitation underscores that extensibility is a first-class design goal.

Installation is deliberately straightforward, and the README recommends doing it inside a Python virtual environment. The concise path is a recursive clone followed by dependency installation and server startup: git clone https://github.com/apache/caldera.git --recursive, then pip3 install -r requirements.txt, then python3 server.py --insecure --build. The --build flag installs the VueJS UI dependencies, bundles them into a dist directory, and serves them from the Caldera server itself; you only rerun it when adding plugins or modifying the UI. The web interface then comes up on localhost:8888 with default credentials, and the documentation directs new users straight into the Training plugin's capture-the-flag course — a sensible onboarding flow that reflects how much operational depth the platform has.

For teams preferring containers, the README documents both a local docker build with a VARIANT=full build argument and a prebuilt image from the GitHub Container Registry (ghcr.io/apache/caldera:latest). The container story is thought through in detail: keys, usernames, and passwords are auto-generated on first start; persistence requires explicit volume bind mounts such as -v :/usr/src/app/data/; and the configuration should also be made persistent to avoid encryption-key issues. The full variant is intended for air-gapped environments without internet access, while slim omits data for the emu and atomic plugins and downloads it on demand. Notably, the builder plugin does not work inside Docker, and the atomic data can be swapped out by bind-mounting a local clone of the Atomic Red Team repository into /usr/src/app/plugins/atomic/data/atomic-red-team.

The security section of the README deserves close reading because it is unusually candid. The Caldera team explicitly recommends standing the server up on a secure, isolated network and not exposing it to the internet, stating plainly that the web application interface is not hardened or thoroughly penetration-tested and offers only basic authentication and security features. Both MITRE and its government sponsors, the README notes, run Caldera almost exclusively in secure environments and do not rely on the platform's own security protocols. For an authorized engagement infrastructure this is standard guidance — control-plane servers belong on restricted networks — but the directness of the admission is a useful reminder to treat the emulation server itself as sensitive infrastructure during scoping and hardening discussions.

That candor is backed by a real disclosure history. A February 2025 security notice advises all users to pull v5.1.0 or later for a patch covering CVE-2025-27364, a remote code execution vulnerability in Caldera itself, with particular urgency for instances hosted on publicly accessible networks. This cuts both ways for defenders: it is a concrete reason to keep any deployed instance patched and network-restricted, and it illustrates that offensive tooling is itself an attack surface. Anyone running caldera in a lab should treat the server with the same patch-discipline rigor they would apply to any internet-adjacent service, and the project's SECURITY.md and vulnerability disclosure documentation define the channel for reporting issues.

Operationally, where caldera fits in an authorized workflow is at the center of a repeatable emulation program. Rather than hand-crafting one-off attack scripts, a team defines adversaries and profiles in Stockpile, composes them from Atomic or Emu technique libraries, deploys Sandcat agents through scoped initial-access mechanisms, and executes operations through the web UI or REST API. Because every executed ability is mapped to an ATT&CK technique, the blue team can pull Debrief output and GameBoard timelines to measure which techniques were detected, which produced alerts, and which sailed through unnoticed. This closes the loop that manual red-teaming often leaves open, converting engagement findings into concrete detection engineering work.

The resource ecosystem around the project lowers the adoption barrier considerably. Full documentation lives at caldera.readthedocs.io, a tutorial playlist is published on YouTube, and the project maintains an official blog along with a homepage at caldera.apache.org. The Training plugin contains a certification-style training course, and the recommended hardware profile — 8GB+ of RAM and 2+ CPUs, NodeJS v16+ for the v5 UI — is modest enough that a competent lab can run the full stack on a single workstation. Teams committed to the platform can also participate in the Benefactor Program, with contact details in the README for organizations wanting to sustain its development.

For defenders, the telemetry angle is the most valuable lens on caldera. Emulation operations generate ATT&CK-mapped events across endpoints, network sensors, and log pipelines — exactly the evidence a detection engineering program needs. Purple-team operators should note the Human plugin's simulated noise feature as a way to stress-test detection baselines, and blue teams observing unexpected Sandcat-style beaconing in a lab should recognize it as an emulation artifact rather than assume compromise without verification. Used as intended — in labs, scoped engagements, and authorized assessments with proper rules of engagement — caldera is less a weapon than a measurement instrument for how well your defenses actually map to the adversary behaviors that matter.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• Inside Koi: a Python shell handler built for lab work, pivoting and LLM-driven sessions


• Yakit for interactive application security testing from a single gRPC-driven GUI