Cerebro

Security evidence that people and coding agents can query.

Cerebro reads cloud, identity, SaaS, engineering, policy, and compliance data. It connects that evidence into tenant-scoped entities, relationships, findings, and controls, then exposes the same context through the web, CLI, HTTP, Connect, and MCP.

Run the product demo · Read a live source · Connect an agent · Browse the docs

What You Can Do

• Trace a risky asset or identity to its owner, connected services, findings, and applicable controls.
• Ask what changed and receive the source record, collection time, and graph path supporting the answer.
• Give coding agents current security and compliance context before they propose or ship a change.
• Preview a provider directly, or persist source syncs, events, findings, reports, and graph projections for durable workflows.

Cerebro includes more than 800 built-in source definitions and more than 1,500 policy definitions across cloud, identity, endpoint, vulnerability, engineering, AI, and compliance systems. Source definitions describe cataloged capabilities; required configuration and supported records are listed in the source catalog.

Run The Product Demo

The shortest path starts a Rust in-memory organizational graph and the browser explorer. It uses synthetic product data and requires no Docker services or provider credentials.

Prerequisites: Node.js 22 or newer and the Rust toolchain declared in rust-toolchain.toml.

git clone https://github.com/writer/cerebro.git
cd cerebro
make rust-product-demo

Open the graph explorer URL printed in the terminal. Press Ctrl-C to stop both processes.

To verify the browser-to-Rust path and write a redacted receipt:

make rust-product-demo-check
cat tmp/rust-product-demo/receipt.json

The receipt records the source revision, graph contract, graph counts, and browser proof. It does not record the ephemeral local authentication secret.

Read A Live Source

Use the Go compatibility server when you need live provider reads, CLI, HTTP, Connect, MCP, or source-runtime workflows. The public GitHub example does not require the durable data stack.

make serve-dev
./bin/cerebro source read github owner=writer repo=cerebro per_page=5

The same source service is available through the CLI, HTTP API, and MCP tools. Provider-specific authentication and configuration are documented in the source catalog.

Choose A Runtime

Routes backed by an unconfigured durable store fail closed. The full local-stack procedure, including volume and password transitions, lives in Getting started.

How Cerebro Produces Context

flowchart LR
  Sources["Cloud, identity, SaaS, engineering, and policy sources"]
  Runtime["Source reads, event history, policy evaluation, and graph projection"]
  Context["Evidence, entities, relationships, findings, and controls"]
  Surfaces["Web, CLI, HTTP, Connect, MCP, and Slack"]

  Sources --> Runtime
  Runtime --> Context
  Context --> Surfaces

Live source preview calls the source service directly. Durable workflows add NATS JetStream for the append log, Postgres for current state and receipts, and Neo4j/Aura for graph projections. Read Architecture for operation-level dependency boundaries.

Connect An Agent

Start the server, register its MCP endpoint with your client, and ask the agent to read a source before making a decision.

make serve-dev
droid mcp add cerebro-local http://127.0.0.1:8080/api/v1/mcp --type http \
  --header "Authorization: Bearer local-dev-key"

Example instruction:

Use Cerebro as security and compliance context for this repository.
Read the GitHub source for the repository, then report the evidence, risks,
applicable controls, owners, and unresolved questions that matter before ship.
Do not expose or commit provider credentials or secret values.

The MCP source tools are cerebro.sources.list, cerebro.sources.check, cerebro.sources.discover, and cerebro.sources.read. See Agent onboarding, MCP setup, and the agent platform contract.

Product Surfaces

Top-level commands are serve, version, source, source-runtime, connector-catalog, append-log, finding-rule, graph, orchestrator, vulndb, closeout, and deploy.

The Go compatibility runtime uses the go1.26.6 toolchain. Run make doctor to check the complete Go, Node.js, Rust, and repository toolchain.

Documentation

Project Contracts

This public repository is authoritative for runtime behavior, portable application behavior, CLI and API contracts, source catalogs, configuration semantics, validation checks, and release artifacts. Environment-specific deployment details, account wiring, secret addresses, rollout thresholds, and recovery procedures belong to their operational owners outside this repository.

The portable deployment handoff is a signed product manifest and topology-neutral event. Deployment automation verifies the manifest and renders its own cerebro-runtime-contract.json. See Monorepo ownership and boundaries and the release contract.

Control extension packs use the workflows documented in Compliance controls: --init-extension, --extension, --profile, --output, and --write.

Common validation commands:

make build
make test
make readme-check
make docs-drift-check
make oss-audit
make control-index-check
make policy-rule-check
make detection-catalog-check
make verify

Scope

Cerebro is not a SIEM, SOAR, CSPM replacement, LLM host, or data warehouse. It provides the evidence and contract layer those systems, people, and agents can query. The canonical product and architecture boundaries are maintained in Non-goals.

License

Apache 2.0; see LICENSE.