compliance

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

immudb - immutable database based on zero trust, SQL/Key-Value/Document model, tamperproof, data change history

Unified Policy as Code

Tfsec is now part of Trivy

AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Personal, Enterprise, Government and Military security levels | SLSA Level 3 Compliant for Secure Development and Build Process | Apps Available on MS Store✨

CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 150+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.

InSpec: Auditing and Testing Framework

The Enterprise Architecture Governance Harness — strategy, architecture, delivery, and assurance using AI coding assistants

A suite of tools to automate software compliance checks.

Appshark is a static taint analysis platform to scan vulnerabilities in an Android app.

Decision audit trail + persistent memory for AI trading agents. Outcome-weighted recall, tamper-evident SHA-256 chain with RFC 3161 anchoring, 20 MCP tools.

Linting tool for CloudFormation templates

Info about many of my Terraform, AWS, DevOps, and AI (tada!) projects.

Agent-ready DevOps, security, infrastructure, and compliance knowledge base with 80+ skills across Kubernetes, Terraform, AWS/Azure/GCP, AI platform operations, container hardening, SOC2/ISO27001, and incident response—plus ready-to-run scripts, templates, and playbooks for SRE, platform, and security teams.

Open-source reference implementations for AI-enabled payment security, blockchain fraud detection, and AML/CFT compliance reasoning.

Python and TypeScript SDKs for verifiable evidence of AI agent actions. Signed receipts, policy enforcement, audit trails. Works with LangChain, CrewAI, MCP.

Open-source Tax Guides for AI agents, reviewed by named CPAs/CAs/EAs. 1,000+ Guides across 190+ jurisdictions. MCP server included. Works with Claude, ChatGPT, Cursor.