Skip to content

FEATURES.md

Latest commit

 

History

History
960 lines (771 loc) · 30.1 KB

FEATURES.md

File metadata and controls

960 lines (771 loc) · 30.1 KB

CI/CD Security Scanning Platform - Feature Documentation

Executive Summary

The CI/CD Security Scanning Platform is a comprehensive enterprise security solution providing 406 MCP tools across 58 functional categories. This platform integrates vulnerability scanning, code quality analysis, software composition analysis, compliance reporting, policy enforcement, AI-powered analysis, container security, multi-cloud security, GitOps integration, and zero-trust security into a unified security automation framework.

Platform Version: 1.31.0

Key Capabilities

Category Group Tools Description
Core Scanning 37 Trivy, SonarQube, Dependency-Track scanning
DevOps Integration 21 Gitea, Drone CI, registry scanning
Security Operations 30 Dashboard, SARIF, scheduler, remediation
Enterprise Security 45 SSO, RBAC, API keys, teams, audit
Analytics & Reporting 35 Dashboard, trends, risk, reports, export
Compliance & Governance 22 Frameworks, governance, evidence, SLA
Notifications & Alerts 17 Channels, rules, escalation, webhooks
Container Security 41 K8s, runtime, signing, supply chain
AI-Powered Security 26 AI analysis, threat intel, NL queries
Infrastructure 22 Cache, metrics, scan history, assets
Multi-Cloud Security 16 AWS, Azure, GCP scanning
Enterprise Scale 30 HA, backup, quotas, performance
GitOps & Zero-Trust 64 GitOps, Zero-Trust, Service Mesh, API Security, K8s Operators, SIEM

Total: 406 MCP Tools

Platform Highlights

  • Enterprise Authentication: SAML/OIDC SSO, RBAC, API key management
  • AI-Powered Analysis: Claude-based vulnerability analysis and insights
  • Container Security: Kubernetes, runtime monitoring, image signing
  • Threat Intelligence: CVE enrichment, threat feeds, IOC management
  • Compliance Automation: SOC2, HIPAA, PCI-DSS, CIS, NIST frameworks
  • Natural Language Queries: Ask security questions in plain English
  • Multi-Cloud Security: AWS ECR/ECS/Lambda, Azure ACR/AKS, GCP GCR/GKE (v1.30.0)
  • High Availability: Cluster management, failover, split-brain detection (v1.30.0)
  • Backup & DR: Automated backups, scheduling, offsite export (v1.30.0)
  • Resource Quotas: Usage limits, breach tracking, alerts (v1.30.0)
  • Performance Optimization: Metrics, slow query analysis, index suggestions (v1.30.0)
  • GitOps Integration: ArgoCD/Flux security gates, drift detection (v1.31.0)
  • Zero-Trust Security: Sigstore/cosign, SLSA provenance, attestations (v1.31.0)
  • Service Mesh Security: Istio/Linkerd/Cilium mTLS, authorization policies (v1.31.0)
  • API Security Gateway: OpenAPI/GraphQL scanning, OWASP API Top 10 (v1.31.0)
  • K8s Operators Security: CRD validation, RBAC analysis, webhook auditing (v1.31.0)
  • Audit/SIEM Integration: Splunk, Elasticsearch, Azure Sentinel forwarding (v1.31.0)

Table of Contents

  1. Vulnerability Scanning (Trivy)
  2. Code Quality Analysis (SonarQube)
  3. Software Composition Analysis (Dependency-Track)
  4. Source Control (Gitea)
  5. CI/CD Automation (Drone)
  6. Container Registry Scanning
  7. Security Dashboard
  8. SARIF Reporting
  9. Scheduled Scanning
  10. Remediation Engine
  11. Compliance Reporting
  12. OPA/Rego Policy Engine
  13. Offline Vulnerability Database
  14. Distributed Caching
  15. Architecture Overview
  16. Integration Patterns

1. Vulnerability Scanning (Trivy)

Overview

Trivy integration provides comprehensive security scanning for containers, filesystems, IaC configurations, secrets, and licenses. The platform supports both online (Trivy server) and offline scanning modes.

Tools (11 MCP Tools)

Tool Description
trivy_scan_path Scan local filesystem for vulnerabilities
trivy_scan_image Scan Docker image for vulnerabilities
trivy_generate_sbom Generate SBOM for local path (CycloneDX/SPDX)
trivy_generate_sbom_image Generate SBOM for Docker image
trivy_scan_iac Scan IaC files (Terraform, K8s, Docker, CloudFormation)
trivy_scan_secrets Scan local path for hardcoded secrets
trivy_scan_secrets_image Scan Docker image for hardcoded secrets
trivy_scan_licenses Scan local path for license information
trivy_scan_licenses_image Scan Docker image for licenses
trivy_scan_image_full Comprehensive image scan (vulns + secrets + licenses + SBOM)
trivy_scan_path_full Comprehensive path scan (vulns + secrets + licenses + IaC + SBOM)

Scan Types

+------------------+     +------------------+     +------------------+
|   Path Scanning  |     |  Image Scanning  |     |   IaC Scanning   |
+------------------+     +------------------+     +------------------+
|                  |     |                  |     |                  |
| - Dependencies   |     | - OS Packages    |     | - Terraform      |
| - package.json   |     | - App Deps       |     | - Kubernetes     |
| - requirements   |     | - Base Image     |     | - Dockerfiles    |
| - go.mod         |     | - Multi-stage    |     | - CloudFormation |
+------------------+     +------------------+     +------------------+

Use Cases

  1. Pre-commit Scanning: Scan code before pushing to repository
  2. CI Pipeline Gate: Block builds with critical vulnerabilities
  3. Container Registry Audit: Scan all images in registry
  4. IaC Security Review: Validate infrastructure configurations

Example: Full Image Scan

{
  "tool": "trivy_scan_image_full",
  "input": {
    "image": "nginx:1.25",
    "severity": "HIGH,CRITICAL",
    "sbomFormat": "cyclonedx"
  }
}

// Response includes:
// - vulnerabilities: Full CVE list
// - secrets: Hardcoded credentials
// - licenses: License information
// - sbom: CycloneDX SBOM

2. Code Quality Analysis (SonarQube)

Overview

SonarQube integration provides static application security testing (SAST), code quality metrics, and security hotspot detection for continuous code inspection.

Tools (4 MCP Tools)

Tool Description
sonar_list_projects List all analyzed projects
sonar_get_issues Get bugs, vulnerabilities, code smells
sonar_get_security_hotspots Get security hotspots requiring review
sonar_get_metrics Get quality metrics (coverage, duplication, etc.)

Metrics Tracked

  • Bugs: Code defects that may cause runtime failures
  • Vulnerabilities: Security issues in code
  • Code Smells: Maintainability issues
  • Coverage: Test coverage percentage
  • Duplicated Lines: Code duplication metrics
  • Security Hotspots: Areas requiring security review

Example: Get Project Issues

{
  "tool": "sonar_get_issues",
  "input": {
    "projectKey": "ci-co",
    "types": "VULNERABILITY,BUG"
  }
}

3. Software Composition Analysis (Dependency-Track)

Overview

Dependency-Track integration provides software composition analysis (SCA) with continuous monitoring of component vulnerabilities and license compliance.

Tools (5 MCP Tools)

Tool Description
dtrack_list_projects List all Dependency-Track projects
dtrack_get_vulnerabilities Get vulnerabilities for project
dtrack_get_findings Get detailed security findings
dtrack_get_components List all components/dependencies
dtrack_upload_sbom Upload SBOM for analysis

Workflow

Generate SBOM (trivy_generate_sbom)
         |
         v
Upload to D-Track (dtrack_upload_sbom)
         |
         v
Continuous Monitoring
         |
         v
Get Findings (dtrack_get_findings)

4. Source Control (Gitea)

Overview

Gitea integration provides Git repository management including repository creation, branch management, and commit history.

Tools (6 MCP Tools)

Tool Description
gitea_list_repos List all repositories
gitea_get_repo Get repository details
gitea_get_branches List branches
gitea_get_commits Get commit history
gitea_create_repo Create new repository
gitea_migrate_repo Migrate from GitHub

5. CI/CD Automation (Drone)

Overview

Drone CI integration enables pipeline management, build triggering, and log retrieval for continuous integration and deployment workflows.

Tools (5 MCP Tools)

Tool Description
drone_list_repos List synced repositories
drone_get_builds Get build history
drone_get_build Get specific build details
drone_get_build_logs Get build step logs
drone_trigger_build Trigger new build

6. Container Registry Scanning

Overview

Multi-registry scanning supports Docker Registry, Amazon ECR, Azure ACR, Google GCR, GitHub GHCR, and Harbor with batch scanning capabilities.

Tools (10 MCP Tools)

Tool Description
registry_list_images List images in registry
registry_get_tags Get image tags
registry_scan Scan registry with filters
registry_detect_type Auto-detect registry type
registry_configure Configure registry authentication
registry_list_configs List configured registries
registry_get_config Get registry configuration
registry_remove_config Remove registry configuration
registry_test_connection Test registry connectivity
registry_scan_multiple Scan across multiple registries

Supported Registries

Registry Type Authentication
Docker Registry docker Basic auth
Amazon ECR ecr AWS credentials
Azure ACR acr Service principal
Google GCR gcr Service account
GitHub GHCR ghcr Personal access token
Harbor harbor Basic auth

Example: Multi-Registry Scan

{
  "tool": "registry_scan_multiple",
  "input": {
    "registries": ["production-ecr", "staging-acr"],
    "includePatterns": ["**/production-*"],
    "severity": "CRITICAL"
  }
}

7. Security Dashboard

Overview

Unified security dashboard aggregating findings from Trivy, SonarQube, and Dependency-Track into a single view.

Tools (2 MCP Tools)

Tool Description
security_scan_all Run comprehensive scan using all tools
get_security_dashboard Get unified security dashboard

Dashboard Response Structure

{
  "summary": {
    "critical": 5,
    "high": 12,
    "medium": 45,
    "low": 100,
    "total": 162
  },
  "sources": {
    "trivy": { "vulnerabilities": 50, "secrets": 2 },
    "sonarqube": { "bugs": 3, "vulnerabilities": 5, "hotspots": 10 },
    "dependencyTrack": { "findings": 50 }
  },
  "findings": [...]
}

8. SARIF Reporting

Overview

SARIF (Static Analysis Results Interchange Format) support enables integration with GitHub Code Scanning and other SARIF-compatible tools.

Tools (2 MCP Tools)

Tool Description
sarif_generate Generate SARIF report from scan results
sarif_upload_github Upload SARIF to GitHub Code Scanning

SARIF Integration

Scan Results --> sarif_generate --> SARIF 2.1.0 JSON
                                          |
                                          v
                                sarif_upload_github
                                          |
                                          v
                                GitHub Code Scanning
                                Security Alerts Tab

9. Scheduled Scanning

Overview

Automated security scanning with cron-based scheduling, webhook notifications, and execution history tracking.

Tools (9 MCP Tools)

Tool Description
schedule_create Create scheduled scan job
schedule_list List all scheduled jobs
schedule_get Get schedule details
schedule_update Update schedule configuration
schedule_delete Delete scheduled job
schedule_trigger Manually trigger scan
schedule_history Get execution history
cron_validate Validate cron expression
scheduler_control Start/stop scheduler

Cron Aliases

Alias Expression Description
@hourly 0 * * * * Every hour
@daily 0 0 * * * Every day at midnight
@weekly 0 0 * * 0 Every Sunday
@monthly 0 0 1 * * First of month

Example: Create Nightly Scan

{
  "tool": "schedule_create",
  "input": {
    "name": "production-nightly",
    "cron": "0 2 * * *",
    "target": {
      "type": "image",
      "value": "production:latest"
    },
    "notifications": {
      "webhooks": [{
        "url": "https://hooks.slack.com/services/xxx",
        "type": "slack"
      }]
    }
  }
}

10. Remediation Engine

Overview

Intelligent remediation suggestions with fix commands, priority ranking, and safe upgrade identification.

Tools (5 MCP Tools)

Tool Description
generate_remediations Generate fix commands for vulnerabilities
get_remediation_summary Get text summary of remediations
get_remediation_markdown Get Markdown-formatted report
get_high_priority_fixes Get CRITICAL/HIGH severity fixes
get_safe_fixes Get non-breaking upgrades only

Package Manager Support

  • npm: npm update, npm audit fix
  • pip: pip install --upgrade
  • go: go get -u
  • maven: POM version updates
  • gradle: Build file updates

Example: Get Safe Fixes

{
  "tool": "get_safe_fixes",
  "input": {
    "image": "myapp:latest",
    "excludeBreaking": true
  }
}

// Response
{
  "fixes": [
    {
      "package": "lodash",
      "currentVersion": "4.17.20",
      "fixedVersion": "4.17.21",
      "breaking": false,
      "command": "npm update lodash"
    }
  ]
}

11. Compliance Reporting

Overview

Map security findings to compliance frameworks with trend tracking and audit-ready HTML reports.

Tools (7 MCP Tools)

Tool Description
compliance_get_frameworks List available frameworks
compliance_get_controls Get framework controls
compliance_check_status Check compliance pass/fail
compliance_generate_report Generate JSON/HTML report
compliance_trend_record Record compliance snapshot
compliance_trend_get Get trends over time
compliance_trend_list_targets List tracked targets

Supported Frameworks

Framework Controls Use Cases
SOC2 6 SaaS providers, cloud services
HIPAA 6 Healthcare, PHI handling
PCI-DSS 6 Payment processing
CIS 5 General security hardening

Control Mapping Example

CVE-2024-1234 (CRITICAL)
         |
         +--> SOC2 CC7.1 (System Security)
         +--> PCI-DSS 6.2 (Secure Development)
         +--> HIPAA 164.312(e)(1) (Technical Safeguards)

Example: Generate Compliance Report

{
  "tool": "compliance_generate_report",
  "input": {
    "image": "production:latest",
    "frameworks": ["SOC2", "PCI-DSS"],
    "format": "html",
    "title": "Q4 2024 Compliance Report",
    "organization": "Acme Corp"
  }
}

12. OPA/Rego Policy Engine

Overview

Open Policy Agent (OPA) integration enables declarative security policies using the Rego policy language for flexible, auditable policy enforcement.

Tools (4 MCP Tools)

Tool Description
opa_list_policies List built-in policies
opa_get_policy_info Get policy details and Rego source
opa_validate_policy Validate Rego syntax
opa_evaluate_policy Evaluate scan against policy

Built-in Policies

Policy Description Default Thresholds
vulnerability-threshold Enforce vuln count limits critical: 0, high: 5
license-compliance Block forbidden licenses GPL, AGPL, SSPL
secrets-detection Fail if secrets found Zero tolerance
container-security Container best practices Root user, privileged
quality-gate Code quality requirements Coverage > 80%

Rego Policy Example

package security.vulnerability

default allow = false

allow {
    input.scan.critical == 0
    input.scan.high <= input.thresholds.high
}

violations[msg] {
    input.scan.critical > 0
    msg := sprintf("Found %d critical vulnerabilities", [input.scan.critical])
}

Example: Evaluate Policy

{
  "tool": "opa_evaluate_policy",
  "input": {
    "image": "production:latest",
    "policy": "vulnerability-threshold",
    "thresholds": {
      "critical": 0,
      "high": 0,
      "medium": 10
    }
  }
}

// Response
{
  "allow": false,
  "violations": [
    "Found 3 critical vulnerabilities (threshold: 0)"
  ]
}

13. Offline Vulnerability Database

Overview

Local vulnerability database for air-gapped environments with SQLite storage, Trivy DB synchronization, and offline scanning capabilities.

Tools (6 MCP Tools)

Tool Description
vuln_db_sync Download/update vulnerability database
vuln_db_status Get database status and statistics
vuln_db_lookup Look up CVE by ID
vuln_db_search Search vulnerabilities by criteria
trivy_scan_offline Scan using local database
vuln_db_annotate Annotate vulnerability status

Database Statistics

Metric Typical Value
Total CVEs 200,000+
Ecosystems npm, pypi, go, maven, etc.
Database Size ~500MB

Annotation Status Values

Status Description
active Requires attention
acknowledged Reviewed, scheduled for fix
false_positive Not applicable
mitigated Risk mitigated

Air-Gapped Workflow

Internet Zone:                 Air-Gapped Zone:
vuln_db_sync                   vuln_db_status
      |                              |
      v                              v
Export DB  ====== Transfer ======>  Import
                                     |
                                     v
                              trivy_scan_offline
                                     |
                                     v
                              vuln_db_annotate

14. Distributed Caching

Overview

Redis-backed distributed caching with automatic fallback to in-memory storage when Redis is unavailable. Configurable TTL per scan type enables optimal cache freshness for different data sources.

Tools (6 MCP Tools)

Tool Description
cache_init Initialize distributed caching with optional Redis backend
cache_status Get cache health and connection status
cache_stats Get hit/miss statistics by scan type
cache_clear Clear all cached data
cache_invalidate Invalidate cache entries by pattern
cache_config Get current cache configuration

Cache Architecture

+------------------+     +------------------+
|   Cache Request  |     |   Redis Server   |
|                  |---->|   (Optional)     |
+------------------+     +--------+---------+
                                  |
                         Connected?
                                  |
              +-------------------+-------------------+
              |                                       |
              v                                       v
    +------------------+                   +------------------+
    |  Redis Backend   |                   | Memory Backend   |
    |  (Distributed)   |                   | (In-Process)     |
    +------------------+                   +------------------+

Default TTL Configuration

Scan Type Default TTL Description
trivy 5 minutes Container/dependency scans
sonarqube 10 minutes Code quality analysis
dtrack 10 minutes SCA findings
registry 30 minutes Registry image lists

Environment Variables

Variable Description Default
REDIS_HOST Redis server hostname localhost
REDIS_PORT Redis server port 6379
REDIS_PASSWORD Redis authentication -
REDIS_DB Redis database number 0
REDIS_KEY_PREFIX Key namespace prefix cicd:
CACHE_TTL_TRIVY Trivy scan TTL (seconds) 300
CACHE_TTL_SONARQUBE SonarQube scan TTL 600
CACHE_TTL_DTRACK Dependency-Track TTL 600
CACHE_TTL_REGISTRY Registry scan TTL 1800

Example: Initialize with Redis

{
  "tool": "cache_init",
  "input": {
    "useRedis": true,
    "config": {
      "host": "redis.example.com",
      "port": 6379,
      "password": "secret",
      "keyPrefix": "prod:"
    }
  }
}

// Response
{
  "success": true,
  "mode": "redis",
  "connected": true
}

Example: Get Cache Statistics

{
  "tool": "cache_stats",
  "input": {}
}

// Response
{
  "trivy": { "hits": 150, "misses": 25, "hitRate": 0.857 },
  "sonarqube": { "hits": 80, "misses": 10, "hitRate": 0.889 },
  "dtrack": { "hits": 45, "misses": 5, "hitRate": 0.900 },
  "registry": { "hits": 200, "misses": 20, "hitRate": 0.909 }
}

Example: Invalidate by Pattern

{
  "tool": "cache_invalidate",
  "input": {
    "pattern": "trivy:production-*"
  }
}

// Response
{
  "invalidated": 15,
  "pattern": "trivy:production-*"
}

15. Architecture Overview

System Component Diagram

+============================================================================+
|                     CI/CD SECURITY SCANNING PLATFORM                        |
+============================================================================+
|                                                                             |
|  +----------------------------+       +----------------------------+        |
|  |      MCP Server            |       |       CICD Agent           |        |
|  |      (82 Tools)            |       |       (CLI)                |        |
|  |                            |       |                            |        |
|  | - Model Context Protocol   |       | - Anthropic SDK            |        |
|  | - Claude Code Integration  |       | - CLI Automation           |        |
|  | - JSON-RPC over stdio      |       | - GitHub Actions Ready     |        |
|  +-------------+--------------+       +-------------+--------------+        |
|                |                                    |                       |
|                +----------------+-------------------+                       |
|                                 |                                           |
|                                 v                                           |
|  +---------------------------------------------------------------------+   |
|  |                    @cicd/shared LIBRARY                              |   |
|  +---------------------------------------------------------------------+   |
|  |                                                                      |   |
|  | +----------------+ +----------------+ +----------------+             |   |
|  | | Trivy Engine   | | SonarQube      | | Dependency-    |             |   |
|  | | (11 tools)     | | Engine         | | Track Engine   |             |   |
|  | |                | | (4 tools)      | | (5 tools)      |             |   |
|  | +----------------+ +----------------+ +----------------+             |   |
|  |                                                                      |   |
|  | +----------------+ +----------------+ +----------------+             |   |
|  | | Registry       | | Scheduler      | | Compliance     |             |   |
|  | | Scanner        | | Engine         | | Engine         |             |   |
|  | | (10 tools)     | | (9 tools)      | | (7 tools)      |             |   |
|  | +----------------+ +----------------+ +----------------+             |   |
|  |                                                                      |   |
|  | +----------------+ +----------------+ +----------------+             |   |
|  | | OPA/Rego       | | Vuln Database  | | Remediation    |             |   |
|  | | Engine         | | Manager        | | Engine         |             |   |
|  | | (4 tools)      | | (6 tools)      | | (5 tools)      |             |   |
|  | +----------------+ +----------------+ +----------------+             |   |
|  |                                                                      |   |
|  | +----------------+ +----------------+ +----------------+             |   |
|  | | SARIF          | | Cache Manager  | | Core           |             |   |
|  | | Reporter       | | (6 tools)      | | Utilities      |             |   |
|  | | (2 tools)      | | - Redis        | | - Config       |             |   |
|  | |                | | - Memory       | | - Circuit      |             |   |
|  | +----------------+ | - Hybrid       | |   Breaker      |             |   |
|  |                    +----------------+ | - Rate Limiter |             |   |
|  |                                       | - Audit Logger |             |   |
|  |                                       +----------------+             |   |
|  +---------------------------------------------------------------------+   |
|                                                                             |
+============================================================================+
|                          EXTERNAL SERVICES                                  |
+============================================================================+
|                                                                             |
|  +----------+  +----------+  +-------------+  +----------+  +----------+   |
|  | Trivy    |  | SonarQube|  | Dependency- |  | Docker   |  | Cloud    |   |
|  | Server   |  | Server   |  | Track       |  | Registry |  | Registries|  |
|  +----------+  +----------+  +-------------+  +----------+  +----------+   |
|                                                                             |
|  +----------+  +----------+  +-------------+                               |
|  | Gitea    |  | Drone CI |  | GitHub      |                               |
|  | Server   |  | Server   |  | (SARIF)     |                               |
|  +----------+  +----------+  +-------------+                               |
|                                                                             |
+============================================================================+

Data Flow

User Request --> Tool Router --> Handler --> Cache --> External API
                     |                                      |
                     v                                      v
               Policy Engine                          Result Aggregator
                     |                                      |
                     v                                      v
            Compliance Mapper                        JSON Response

16. Integration Patterns

Pattern 1: CI/CD Pipeline Security Gate

# .drone.yml
pipeline:
  security-scan:
    - trivy_scan_image (container)
    - sonar_get_issues (code quality)
    - opa_evaluate_policy (policy gate)
    - compliance_check_status (compliance)
    - sarif_upload_github (reporting)
    - [GATE] Pass/Fail decision

Pattern 2: Scheduled Registry Monitoring

@daily (2AM)
    |
    v
schedule_trigger
    |
    v
registry_scan_multiple
    |
    +--> ECR
    +--> ACR
    +--> GHCR
    |
    v
compliance_trend_record
    |
    v
Webhook (Slack/Teams)

Pattern 3: Vulnerability Remediation Workflow

trivy_scan_image
    |
    v
generate_remediations
    |
    +--> get_high_priority_fixes
    +--> get_safe_fixes
    |
    v
get_remediation_markdown
    |
    v
PR with fixes --> Rescan --> Policy Gate

Pattern 4: Compliance Audit Preparation

Daily: trivy_scan + sonar_get_issues + dtrack_get_findings
            |
            v
    compliance_trend_record
            |
            v (90 days)
    compliance_generate_report (HTML)
            |
            v
    Audit-ready documentation

Pattern 5: Air-Gapped Deployment

Internet Zone          Transfer         Air-Gapped Zone
vuln_db_sync    -----> USB/DVD ----->   vuln_db_status
                                              |
                                              v
                                        trivy_scan_offline
                                              |
                                              v
                                        vuln_db_annotate
                                              |
                                              v
                                        compliance_generate_report

Benefits Summary

For Security Teams

  • 82 tools for comprehensive security automation
  • Unified view across all security sources
  • Policy-as-code for consistent enforcement
  • Historical trend analysis

For DevOps Teams

  • Automated scheduled scans
  • CI/CD pipeline integration
  • Fast feedback on violations
  • Offline capability for restricted environments

For Compliance Officers

  • Pre-built framework mappings (SOC2, HIPAA, PCI-DSS, CIS)
  • Audit-ready HTML reports
  • Trend tracking for continuous compliance
  • Evidence of remediation progress

For Architects

  • Extensible OPA/Rego policy engine
  • Modular architecture
  • API-first design
  • Multi-cloud registry support

Quick Links