Steam Network Architecture — Protocol Fidelity & Ecosystem Analysis
Automation has public infrastructure.
This module maps 252 public repositories, 3,320 GitHub profiles and 4,214 distinct profile–repository pairs in the collected Steam automation network. These records document public software and relationships between profiles and repositories. They provide a basis for examining automation capabilities and platform controls; they do not establish every operator's identity, Valve's knowledge of particular activity, or the absence of vulnerabilities in the software.
← Back to Executive briefingThe collected repositories make parts of the automation ecosystem inspectable: libraries implement client protocols, interact with Steam services and expose programmatic capabilities. Valve's Steamworks Web API overview confirms that Steam provides HTTP APIs, including public methods and protected methods requiring authentication. The existence of an interface establishes a technical capability; it does not establish that every use is authorized, safe or known to Valve.
The collection includes projects such as SteamKit, node-steam-user, ValvePython/steam and ArchiSteamFarm. Their public code and documentation are sources for studying client-protocol implementations, message schemas and automated workflows. This network analysis is not a comprehensive vulnerability audit of those projects. Repository membership, a fork or a contribution also does not by itself identify a bot operator or establish involvement in a particular theft. The accountability question is which controls apply to the documented capabilities and what evidence exists of their enforcement.
Official Protobuf Schemas
Automation libraries do not bypass security gates. They serialize official Protobuf messages (steammessages_clientserver.proto) over TCP/WebSockets directly to Valve's official CM clusters, exactly as the Steam Client does.
Authentication and programmatic access
Client libraries can expose authentication and trade-related workflows. Assessing a particular use requires evidence about the account, credentials, permissions and applicable controls. A library's capability alone does not prove that Valve authorized an operator or designed the feature for abuse.
Fees need a defined calculation
Fee analysis needs a stated item price, currency, platform charge, publisher charge and rounding rule. A combined charge should not automatically be described as revenue retained by Valve. The repository graph does not measure transaction volumes, fees paid or account-purchase revenue. See the separate card economy analysis for its data and calculation assumptions.
Public Developer & Repository Infrastructure
Detailed forensic catalog of 252 open-source repositories powering Steam automation. Traces how standard software engineering tools implement Valve's published API endpoints without exploits.
Global Engineering Ecosystem Metrics
Geographic and institutional breakdown of 3,320 software engineers contributing to the Steam automation ecosystem, including corporate affiliations across major technology employers.
Interactive Protocol & Developer Network Graph
Comprehensive Vis.js interactive network graph mapping repositories, protocol libraries (SteamKit, Steamworks, ASF), and cross-project contributor overlaps. Visually demonstrates the legitimate, interconnected open-source software architecture powering Steam's automation ecosystem.
Under the principle of Data Protection by Design and by Default, a platform architecture that permits silent API-key generation, unnotified trade cancellation, and machine-automated asset liquidation is an architectural choice of the platform operator. When Valve systematically rejects consumer reimbursement claims by asserting that losses were caused by "external cyberattacks," it conceals that the attack vector is Valve's own intentionally designed Web API architecture.
INTERACTIVE VIEW
Full interactive visualisation of the 252-repository, 3,320-developer network graph is available at network.html. Aggregate metrics are on the BI Metrics page.