cloudg

cloudg (cloud graphing) maps AWS, Azure and GCP infrastructure into a graph,
runs security scanners over the same inventory, and turns the results into reports you can actually use.

One command collects assets from every configured provider in parallel, feeds them through a NetworkX graph for reachability and attack path analysis, fans out to Prowler, ScoutSuite, Checkov and Trivy, then merges and deduplicates all findings against 28 compliance frameworks. Out the other end come an interactive HTML report, GraphML, an RDF ontology, RAG chunks for LLM pipelines, and Terraform files that recreate the live infrastructure.

Need the map without the security tooling? cloudg map is a scanner-independent inventory mapper: it deep-collects everything deployed (or default) in an account, down to the network fabric, sweeps every service for the rest, and links it all into one asset map you can overlay with scanner findings later. See Inventory mapping.

Want an AI agent to work with all of it? cloudg mcp serve turns cloudg into an MCP server for Claude Desktop, Claude Code, Cursor or anything else that speaks the Model Context Protocol. See MCP server.

Full documentation: the rendered handbook lives at morpheuslord.github.io/cloudg, with the same content as markdown in the feature reference and release notes in the changelog. The inventory mapper has its own deep-dive documents: the inventory reference (every return structure and output file, field by field), the inventory catalog (all 156 asset types, their metadata and relationships) and the inventory internals (how it works and how to extend it). The MCP server is covered by the MCP guide, the tool reference and the privacy reference, and throttling by rate limits and throttling.

Sample report: to see what cloudg produces before running anything, open the sample report. It is the report.html of a synthetic AWS, Azure and GCP estate, so every ID in it is made up, and scripts/build_sample_report.py rebuilds it from the test fixtures.

Quick start

git clone https://github.com/morpheuslord/cloudg.git
cd cloudg

uv venv && source .venv/bin/activate
uv pip install -e ".[all,dev]"

# one provider, one region
cloudg run -p aws --regions us-east-1

# everything, everywhere
cloudg run -p all --regions all

# with Terraform recreation files
cloudg run -p aws --regions us-east-1 --terraform

Reports land in ./reports. Open report.html first.

Already ran the scanners yourself? Feed cloudg their native output files instead. No cloud credentials, no scanner binaries:

cloudg ingest --prowler ./prowler-output/ --checkov ./results_json.json --trivy ./trivy.json

Any combination of Prowler, ScoutSuite, Checkov and Trivy outputs works; cloudg normalises, deduplicates across scanners via the check-equivalence rulesets, maps compliance frameworks, and renders the reports.

In CI, cloudg gate fails the job on findings at or above a severity and writes SARIF for code scanning. On GitHub the repository doubles as an action that installs cloudg and the scanners, runs the pipeline and gates it:

permissions:
  contents: read
  id-token: write          # OIDC login to the cloud
  security-events: write   # SARIF upload

steps:
  - uses: aws-actions/configure-aws-credentials@v6
    with:
      role-to-assume: arn:aws:iam::123456789012:role/cloudg-github
      aws-region: us-east-1
  - uses: morpheuslord/[email protected]
    with:
      provider: aws
      fail-on: critical
      min-assets: "1"

The CI and automation guide has every input, Azure and GCP logins, GitLab CI and a plain shell version.

docker build -t cloudg:latest .
docker compose run --rm cloudg run -p aws --regions us-east-1

Inventory mapping

cloudg map answers a different question than cloudg run: what exists, and how is it wired together. Finding out what is wrong stays the scanners' job, and none of them runs here or even needs to be installed. What makes the map complete: