Menu
Build Stave from source and verify the binary and control catalog work, adapting to what is already installed
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
Author, test, and verify a custom Stave control using the forge toolchain
Run Stave against a tiny example observation and read your first findings — no AWS account required
Deploy a known-vulnerable Bishop Fox IAM lab, evaluate it with Stave, and confirm findings match the documented attack paths — trust via an independent oracle
Export Stave observation facts to JSONL/SMT-LIB and derive compound cross-asset chains with Z3, Soufflé, or Prolog — detection CEL alone cannot express
Capture a read-only configuration snapshot of your real AWS account and evaluate it with Stave on a local, deterministic snapshot
Verify cloud infrastructure security using the Stave platform with machine-verifiable contracts at every step
| name | stave-setup |
| description | Build Stave from source and verify the binary and control catalog work, adapting to what is already installed |
| triggers | ["first time touching Stave","install Stave","build Stave","set up Stave","get started with Stave"] |
| requires | ["go (>= 1.26 — see https://go.dev/dl/)","git",{"jq (apt":"sudo apt install jq)"}] |
Installs prerequisites, builds Stave from source, and verifies the binary + control catalog. Adapts to what is already installed — skip steps whose check already passes.
Time: ~5 minutes. No AWS account needed.
go version
wget https://go.dev/dl/go1.26.5.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.26.5.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
go version # → go1.26.x
jq --version || sudo apt install -y jq
git clone https://github.com/sufield/stave
cd stave
make build
Use make build, NOT bare go build — make build runs sync-schemas /
sync-controls first, which a fresh clone needs. If the build fails, report the
make output verbatim (usually a Go-version mismatch).
./stave version
Expect a version line (e.g. edge (production)). Both ./stave version and
./stave --version work.
./stave controls list -i controls | wc -l
Expect 2,600+ controls. If 0, the controls/ directory didn't clone — re-check step 3.
./stave search "privilege escalation"
Expect multiple results with control IDs and descriptions.
A working stave binary with 2,600+ controls, search functioning.
Next: first-evaluation.