Compliance work, evidence, and source health in one workspace.
Cerebro reads cloud, identity, SaaS, engineering, policy, and compliance data. It connects that evidence into tenant-scoped entities, relationships, findings, and controls, then exposes the same context through the web, CLI, HTTP, Connect, and MCP.
Run the compliance workspace · Install a release · Read a live source · Browse the docs
- Trace a risky asset or identity to its owner, connected services, findings, and applicable controls.
- Ask what changed and receive the source record, collection time, and graph path supporting the answer.
- Give coding agents current security and compliance context before they propose or ship a change.
- Preview a provider directly, or persist source syncs, events, findings, reports, and graph projections for durable workflows.
Cerebro includes more than 800 built-in source definitions and more than 1,500 policy definitions across cloud, identity, endpoint, vulnerability, engineering, AI, and compliance systems. Source definitions describe cataloged capabilities; required configuration and supported records are listed in the source catalog.
The shortest path starts the web workspace with a complete synthetic compliance program. Review framework readiness, controls, evidence, policies, vendors, questionnaires, audit packets, and integration health without Docker or provider credentials.
Prerequisite: Node.js 22 or newer.
git clone https://github.com/writer/cerebro.git
cd cerebro
make compliance-demoOpen http://127.0.0.1:3000. Press Ctrl-C to stop the workspace. The demo binds only to loopback and strips provider credentials from its environment.
To verify the full fixture-backed browser route contract in Chromium:
make compliance-demo-checkUse Compliance workspace for the first workflow and Integration readiness to distinguish catalog coverage from configured collection.
The credential-free Rust graph demo remains available as make rust-product-demo when you need to inspect the organizational graph contract.
Release archives and container images are published from tagged builds. Verify a CLI image before adding provider configuration:
docker pull ghcr.io/writer/cerebro:<tag>
docker run --rm ghcr.io/writer/cerebro:<tag> versionThe web image is ghcr.io/writer/cerebro-web:<tag>. It requires a Cerebro API endpoint; it is not a standalone data service. Use the release contract for image digests and signatures, then follow Hosting for the API, web, and durable-store topology.
Use the Go compatibility server when you need live provider reads, CLI, HTTP, Connect, MCP, or source-runtime workflows. The public GitHub example does not require the durable data stack.
make serve-dev
./bin/cerebro source read github owner=writer repo=cerebro per_page=5The same source service is available through the CLI, HTTP API, and MCP tools. Provider-specific authentication and configuration are documented in the source catalog.
| Goal | Start with | Data and dependencies |
|---|---|---|
| Review a compliance program locally | make compliance-demo |
Synthetic controls, evidence, vendors, policies, questionnaires, and source health; Node.js; no credentials or Docker |
| Inspect the graph contract locally | make rust-product-demo |
Rust product demo; synthetic in-memory graph; Node.js and Rust; no credentials or Docker |
| Read current provider data | make serve-dev |
Go compatibility runtime; live source preview; provider configuration when the source requires it |
| Persist evidence and findings | docker compose up -d |
NATS JetStream, Postgres, and Neo4j plus the Go compatibility runtime |
Routes backed by an unconfigured durable store fail closed. No in-memory or SQLite production fallback is used for durable routes. The full local-stack procedure, including volume and password transitions, lives in Getting started. Runtime profile selection, secret placeholders, and preflight checks are documented in Runtime profiles.
flowchart LR
Sources["Cloud, identity, SaaS, engineering, and policy sources"]
Runtime["Source reads, event history, policy evaluation, and graph projection"]
Context["Evidence, entities, relationships, findings, and controls"]
Surfaces["Web, CLI, HTTP, Connect, MCP, and Slack"]
Sources --> Runtime
Runtime --> Context
Context --> Surfaces
Live source preview calls the source service directly. Durable workflows add NATS JetStream for the append log, Postgres for current state and receipts, and Neo4j/Aura for graph projections. Read Architecture for operation-level dependency boundaries.
Start the server, register its MCP endpoint with your client, and ask the agent to read a source before making a decision.
make serve-dev
droid mcp add cerebro-local http://127.0.0.1:8080/api/v1/mcp --type http \
--header "Authorization: Bearer <local-dev-key>"Example instruction:
Use Cerebro as security and compliance context for this repository.
Read the GitHub source for the repository, then report the evidence, risks,
applicable controls, owners, and unresolved questions that matter before ship.
Do not expose or commit provider credentials or secret values.
The MCP source tools are cerebro.sources.list, cerebro.sources.check, cerebro.sources.discover, and cerebro.sources.read. See Agent onboarding, MCP setup, and the agent platform contract.
Current authority map:
| Surface | Current role | Required evidence before deleting Go compatibility |
|---|---|---|
| Rust organizational platform | Rust-authoritative tenant-scoped graph routes and invariant-heavy authority paths, including the Rust product demo | Typed graph tests, readiness/fail-closed receipts, product-shape compatibility, rollback evidence |
| Go compatibility runtime | Go compatibility runtime for source reads, CLI, HTTP, Connect, MCP, append-log, findings, reports, and compatibility workflows | Source/runtime parity, durable fencing, rollback receipts, OpenAPI/proto/SDK/MCP compatibility gates |
| Credential-free source worker | Rust plans and decodes azure.authorization_policy; its closed dispatcher also compile-registers sentinelone.agent, while the trusted Go host owns credential redemption, bounded provider I/O, append, projection, and fenced checkpoint commit |
Exact Go/Rust event parity, lease-generation rejection, restart deduplication, hosted checks, deployment correlation, and an authenticated product read |
| Durable evidence stores | NATS JetStream, Postgres, and Neo4j are required for persisted evidence, append-log replay, receipts, findings, reports, graph projection, and graph queries | Preflight, health/readiness, projection and replay receipts; unconfigured routes must fail closed |
| Web app | Browser workflows over public runtime contracts; the local product demo talks to Rust graph demo APIs | Browser demo receipt, console-clean shape compatibility, API compatibility checks |
| Slack companion | Durable intake, execution, delivery, and lifecycle status through explicit Slack authority paths | Fixture-only Slack validation unless live writes are explicitly approved |
| SDKs and schemas | Python, TypeScript, Go, OpenAPI, proto, and portable interchange contracts | Generated artifact drift checks and SDK tests |
Surfaces not listed as Rust-authoritative remain Go-compatible or bridged until their validation gates pass. Do not infer full Rust replacement from the product demo alone.
Top-level commands are serve, version, source, source-runtime, connector-catalog, append-log, finding-rule, graph, orchestrator, vulndb, closeout, and deploy.
The Go compatibility runtime uses the go1.26.6 toolchain. Run make doctor to check the complete Go, Node.js, Rust, and repository toolchain.
| Task | Guide |
|---|---|
| Run the shortest local path | Quick reference |
| Review the compliance workspace | Compliance workspace |
| Check what an integration can do | Integration readiness and Source catalog |
| Read a source and start the durable stack | Getting started |
| Configure auth, tenancy, stores, MCP, or device auth | Configuration variables and .env.example |
| Explore APIs | API reference, OpenAPI, and Connect proto |
| Use an SDK | Python SDK, TypeScript SDK, and Go SDK |
| Browse integrations | Source catalog |
| Author policies and controls | Policies and compliance controls |
| Integrate endpoint telemetry | Endpoint security platform integration |
| Host or operate Cerebro | Hosting and operations runbook |
| Contribute | Development and non-goals |
This public repository is authoritative for runtime behavior, portable application behavior, CLI and API contracts, source catalogs, configuration semantics, validation checks, and release artifacts. Environment-specific deployment details, account wiring, secret addresses, rollout thresholds, and recovery procedures belong to their operational owners outside this repository.
The portable deployment handoff is a signed product manifest and topology-neutral event. Deployment automation verifies the manifest and renders its own cerebro-runtime-contract.json. See Monorepo ownership and boundaries and the release contract.
Control extension packs use the workflows documented in Compliance controls: --init-extension, --extension, --profile, --output, and --write.
Common validation commands:
make rust-fmt-check
make rust-clippy
make rust-test
make projection-parity-test
make source-fixture-check
make mcp-contract-check
make mcp-sdk-compat
make openapi-check
make openapi-lint
make sdk-test
make rust-product-demo-check
make graph-rebuild-dryrun RUNTIME_ID=<runtime-id>
make readme-check
make docs-drift-check
make oss-audit
make control-index-check
make policy-rule-check
make detection-catalog-check
make verifyCerebro is not a SIEM, SOAR, CSPM replacement, LLM host, or data warehouse. It provides the evidence and contract layer those systems, people, and agents can query. The canonical product and architecture boundaries are maintained in Non-goals.
Apache 2.0; see LICENSE.