Bryan Frimin
190
README.md
190
README.md
@@ -1,136 +1,138 @@
|
|||||||
<div align="center">
|
# Probo
|
||||||
<h1>Probo - Open Source Compliance</h1>
|
|
||||||
|
|
||||||
|
[](LICENSE)
|
||||||
|
[](https://github.com/getprobo/probo/actions)
|
||||||
[](https://discord.gg/8qfdJYfvpY)
|
[](https://discord.gg/8qfdJYfvpY)
|
||||||
[](LICENSE)
|
|
||||||
|
|
||||||
|
|
||||||
</div>
|
**Open-source GRC platform for engineers.**
|
||||||
|
|
||||||
Probo is an open-source compliance platform built for startups that helps you
|
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. It covers the full GRC lifecycle: risk identification, control tracking, vendor risk, data privacy, access reviews, audit programs, and document approval workflows. Every entity is accessible through a web console, a CLI, a [Model Context Protocol (MCP)](https://modelcontextprotocol.io) API, and a GraphQL API, so you can automate compliance work from code, scripts, or any LLM agent.
|
||||||
achieve SOC-2 compliance quickly and efficiently. Unlike traditional solutions,
|
|
||||||
Probo is designed to be accessible, transparent, and community-driven.
|
|
||||||
|
|
||||||
## 🚀 Getting Started
|
## Why Probo?
|
||||||
📖 [Official Documentation](https://www.getprobo.com/docs)
|
|
||||||
### Prerequisites
|
|
||||||
|
|
||||||
- Go 1.21+
|
- **AI-native by design.** 270+ MCP tools expose every entity and operation. Any MCP-compatible LLM agent can read and write your GRC data, draft policies, run risk assessments, and generate evidence packs.
|
||||||
- Node.js 22+
|
- **Full GRC coverage.** Risk management, controls, vendor risk, data privacy (DPIA/TIA), access reviews, audit programs — not just SOC 2 checklists.
|
||||||
- Docker
|
- **Multiple interfaces.** Web console, `prb` CLI (44+ command groups), MCP API, GraphQL, and an n8n community node for no-code automation.
|
||||||
- mkcert
|
- **Open source and self-hostable.** ISC licensed. Run it on your own infrastructure with Docker.
|
||||||
|
- **Audit-ready.** Policy-based RBAC, immutable audit logs, electronic document sign-off workflows, and evidence chains.
|
||||||
|
|
||||||
### Quick Start
|
## Capabilities
|
||||||
|
|
||||||
1. Clone the repository:
|
| Domain | Features |
|
||||||
|
|--------|----------|
|
||||||
|
| **Risk Management** | Risk register, inherent/residual scoring, treatment strategies (mitigate, accept, avoid, transfer), threat-based risk assessments |
|
||||||
|
| **Controls & Frameworks** | Control library with maturity levels, custom framework import/export, Statement of Applicability (SoA) |
|
||||||
|
| **Vendor / Third-Party Risk** | Vendor inventory, automated website risk assessment, DPA/BAA tracking, subprocessor discovery |
|
||||||
|
| **Data Privacy** | DPIA, Transfer Impact Assessments, processing activity records, data inventory, rights requests (SAR/erasure) |
|
||||||
|
| **Access Reviews** | Campaign management, per-entry access decisions, integration with SaaS, cloud infra, and source code sources |
|
||||||
|
| **Audit Programs** | Audit scoping, control mapping, finding tracking, report generation |
|
||||||
|
| **Evidence & Measures** | Evidence collection (files and URLs), implementation state tracking, task assignment |
|
||||||
|
| **Document Management** | Versioned documents, approval quorums, electronic signatures, PDF export, bulk operations |
|
||||||
|
| **Compliance Page** | Public compliance portal, NDA management, certification publishing, custom domain support |
|
||||||
|
| **Cookie & Consent** | Cookie banner management, tracker detection, consent records |
|
||||||
|
|
||||||
```bash
|
## Interfaces
|
||||||
git clone --recurse-submodules https://github.com/getprobo/probo.git
|
|
||||||
cd probo
|
|
||||||
```
|
|
||||||
|
|
||||||
2. Install dependencies:
|
### Web console
|
||||||
|
|
||||||
```bash
|
The primary interface for day-to-day GRC work. Runs at `http://localhost:8080` in development.
|
||||||
# Install Go dependencies
|
|
||||||
go mod download
|
|
||||||
|
|
||||||
# Install Node.js dependencies
|
### CLI (`prb`)
|
||||||
npm ci
|
|
||||||
```
|
|
||||||
|
|
||||||
3. Start the development environment:
|
A fully-featured command-line client for scripting, automation, and CI/CD integration. Covers all 44+ resource types available in the web console.
|
||||||
|
|
||||||
```bash
|
```sh
|
||||||
# Start infrastructure services
|
# Authenticate
|
||||||
make stack-up
|
prb auth login
|
||||||
|
|
||||||
# Build the project
|
# List open risks
|
||||||
make build
|
prb risk list
|
||||||
|
|
||||||
# Generate the local dev config (writes cfg/dev.yaml)
|
# Create a measure and link evidence
|
||||||
make dev-config
|
prb measure create --name "MFA enforced on all production systems"
|
||||||
|
prb evidence create --measure <id> --file screenshot.png
|
||||||
|
|
||||||
# Start the application using development settings
|
# Manage vendor compliance
|
||||||
bin/probod -cfg-file cfg/dev.yaml
|
prb thirdpartymgmt vendor list
|
||||||
```
|
prb thirdpartymgmt risk-assessment create --vendor <id>
|
||||||
|
|
||||||
The application will be available at:
|
|
||||||
|
|
||||||
- Application: http://localhost:8080
|
|
||||||
|
|
||||||
### Testing Custom Domains
|
|
||||||
|
|
||||||
To test the custom domains feature locally, add the CNAME target to your hosts file:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Add this line to /etc/hosts (macOS/Linux) or C:\Windows\System32\drivers\etc\hosts (Windows)
|
|
||||||
127.0.0.1 custom.getprobo.com
|
|
||||||
```
|
```
|
||||||
|
|
||||||
This allows you to test custom trust center domains on your local machine. The generated `cfg/dev.yaml` sets the CNAME target via `custom-domains.cname-target`; change `CUSTOM_DOMAINS_CNAME_TARGET` before running `make dev-config` to override it.
|
Run `prb help` for the full command reference.
|
||||||
|
|
||||||
For detailed setup instructions, see our [Contributing Guide](CONTRIBUTING.md).
|
### MCP API
|
||||||
|
|
||||||
## 🏗️ Current Status
|
Probo exposes 270+ [MCP](https://modelcontextprotocol.io) tools covering every entity and operation in the platform. Any MCP-compatible LLM agent (Claude, Cursor, Continue, and others) can connect directly and interact with your compliance data.
|
||||||
|
|
||||||
Probo is in early development, focusing on building a solid foundation for
|
The full MCP specification is at [`pkg/server/api/mcp/v1/specification.yaml`](pkg/server/api/mcp/v1/specification.yaml).
|
||||||
compliance management.
|
|
||||||
|
|
||||||
## 🛠️ Tech Stack
|
### n8n node
|
||||||
|
|
||||||
### Backend
|
The [`@probo/n8n-nodes-probo`](packages/n8n-node/) community node brings Probo into n8n workflows for no-code automation of compliance tasks over the GraphQL API.
|
||||||
|
|
||||||
- [Go](https://go.dev/) - API server
|
## Quick Start
|
||||||
- [PostgreSQL](https://www.postgresql.org/) - Data storage
|
|
||||||
- [GraphQL](https://graphql.org/) - API layer
|
|
||||||
|
|
||||||
### Frontend
|
**Prerequisites**
|
||||||
|
|
||||||
- [React](https://react.dev/) with [TypeScript](https://www.typescriptlang.org/)
|
| Tool | Version |
|
||||||
- [Relay](https://relay.dev/) - Data fetching
|
|------|---------|
|
||||||
- [TailwindCSS](https://tailwindcss.com/) - Styling
|
| Go | 1.26+ |
|
||||||
|
| Node.js | 22+ |
|
||||||
|
| Docker | latest |
|
||||||
|
| mkcert | latest |
|
||||||
|
|
||||||
### Infrastructure
|
**Steps**
|
||||||
|
|
||||||
- [Docker](https://www.docker.com/) - Containerization
|
```sh
|
||||||
- [OpenTelemetry](https://opentelemetry.io/) - Observability
|
# 1. Clone with submodules
|
||||||
- [GitHub Actions](https://github.com/features/actions) - CI/CD
|
git clone --recurse-submodules https://github.com/getprobo/probo.git
|
||||||
|
cd probo
|
||||||
|
|
||||||
### Observability
|
# 2. Install dependencies
|
||||||
|
go mod download
|
||||||
|
npm ci
|
||||||
|
|
||||||
- Grafana - Metrics visualization
|
# 3. Start infrastructure services (PostgreSQL, object storage, etc.)
|
||||||
- Prometheus - Metrics collection
|
make stack-up
|
||||||
- Loki - Log aggregation
|
|
||||||
- Tempo - Distributed tracing
|
|
||||||
|
|
||||||
## 🤝 Contributing
|
# 4. Build
|
||||||
|
make build
|
||||||
|
|
||||||
We love contributions from our community! There are many ways to contribute:
|
# 5. Generate the local dev config
|
||||||
|
make dev-config
|
||||||
|
|
||||||
- 🌟 Star the repository to show your support
|
# 6. Run the server
|
||||||
- 🐛 [Report bugs](https://github.com/getprobo/probo/issues/new)
|
bin/probod -cfg-file cfg/dev.yaml
|
||||||
- 💡 [Request features](https://github.com/getprobo/probo/issues/new)
|
```
|
||||||
- 🔧 Submit pull requests
|
|
||||||
- 📖 Improve documentation
|
|
||||||
|
|
||||||
Please read our [Contributing Guide](CONTRIBUTING.md) before making a pull
|
The web console is available at `http://localhost:8080`.
|
||||||
request.
|
|
||||||
|
|
||||||
|
See [CONTRIBUTING.md](CONTRIBUTING.md) for the full development environment walkthrough, including the frontend dev server and code generation steps.
|
||||||
|
|
||||||
## 📚 Documentation
|
## Tech Stack
|
||||||
|
|
||||||
- 📖 [Official Documentation](https://www.getprobo.com/docs)
|
| Layer | Technologies |
|
||||||
- 💬 [Discord Community](https://discord.gg/8qfdJYfvpY)
|
|-------|-------------|
|
||||||
- 📝 [Blog](https://www.getprobo.com/blog)
|
| Backend | Go, PostgreSQL |
|
||||||
|
| API | GraphQL, MCP |
|
||||||
|
| Frontend | React, TypeScript, Relay, TailwindCSS |
|
||||||
|
| Infrastructure | Docker, GitHub Actions |
|
||||||
|
| Observability | OpenTelemetry, Grafana, Prometheus, Loki, Tempo |
|
||||||
|
|
||||||
## 🌐 Community & Support
|
## Contributing
|
||||||
|
|
||||||
- Join our [Discord community](https://discord.gg/8qfdJYfvpY)
|
Contributions are welcome. Read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request. All commits require a Developer Certificate of Origin (DCO) sign-off (`git commit -s`). No CLA required.
|
||||||
- Follow us on [Twitter](https://twitter.com/getprobo)
|
|
||||||
- Connect on [LinkedIn](https://www.linkedin.com/company/getprobo)
|
|
||||||
- Visit our [website](https://www.getprobo.com)
|
|
||||||
|
|
||||||
## 📄 License
|
To report a security vulnerability, email [security@getprobo.com](mailto:security@getprobo.com) rather than opening a public issue. See [SECURITY.md](SECURITY.md) for the full disclosure policy.
|
||||||
|
|
||||||
Probo is [MIT licensed](LICENSE).
|
## Community
|
||||||
|
|
||||||
|
- [Discord](https://discord.gg/8qfdJYfvpY) - Get help, share feedback, and talk to the team
|
||||||
|
- [Documentation](https://www.getprobo.com/docs)
|
||||||
|
- [Blog](https://www.getprobo.com/blog)
|
||||||
|
- [Twitter / X](https://twitter.com/getprobo)
|
||||||
|
- [LinkedIn](https://www.linkedin.com/company/getprobo)
|
||||||
|
- [Website](https://www.getprobo.com)
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
Probo is [ISC licensed](LICENSE).
|
||||||
|
|||||||
Reference in New Issue
Block a user