BespokeTracker Comply

Compliance gap analysis for any codebase. Scan any repository against 10 regulatory frameworks. Get evidence-backed compliance reports with specific file paths, control status, and remediation recommendations.

Regulatory deadlines: Colorado SB 24-205 (June 30, 2026) | EU AI Act (August 2, 2026)

Install

# Standalone (pip)
pip install bespoketracker-comply

# From source
pip install -e ./comply

# With semantic analysis support
pip install bespoketracker-comply[semantic]

Quick Start

# Scan a local repository
bespoketracker-comply scan /path/to/your/repo

# Scan a GitHub repository
bespoketracker-comply scan https://github.com/org/repo --framework eu-ai-act

# Multi-framework scan
bespoketracker-comply scan . --framework eu-ai-act,nist-ai-rmf,iso-42001

# Start the web dashboard
bespoketracker-comply serve
# Open http://localhost:8001

# Or run in background (returns to shell)
bespoketracker-comply serve --background

# Stop a background server
bespoketracker-comply stop

Docker

# Build and run
docker build -t comply .
docker run -p 8001:8001 -v comply-data:/root/.comply comply

# With docker-compose (includes optional gateway sidecar)
docker compose up

# With gateway for three-layer evidence
docker compose --profile with-gateway up

Supported Frameworks

Three-Layer Evidence

Comply evaluates compliance across three layers:

1. Layer 1 — Code: Static analysis of your codebase (logging, tests, docs, auth, monitoring)
2. Layer 2 — Process: Development process maturity (baselines, regression tracking, CI gates)
3. Layer 3 — Traffic: AI agent governance (audit logs, access control, policy enforcement)

Layer 1 runs automatically. Layer 2 builds as you set baselines and track regressions. Layer 3 requires connecting audit log adapters.

Audit Log Adapters

Connect external systems for Layer 3 evidence:

# ~/.comply/config.yaml
adapters:
  gateway:
    mode: sqlite
    db_path: ./gateway.db
  kong:
    admin_url: http://localhost:8001
  gravitee:
    management_url: http://localhost:8083/management
  file:
    paths:
      - ./audit-logs/*.jsonl

# List adapters
bespoketracker-comply adapters list

# Test connectivity
bespoketracker-comply adapters test gateway

# Ingest records
bespoketracker-comply adapters ingest gateway

CLI Reference

comply scan

bespoketracker-comply scan <target> [options]

Options:
  -f, --framework FRAMEWORK  Framework(s), comma-separated (default: eu-ai-act)
  -d, --depth DEPTH          structure | content | semantic (default: content)
  -o, --output DIR           Output directory for reports
  --llm-key KEY              LLM API key (required for semantic depth)
  --llm-provider PROVIDER    anthropic | openai | gemini | grok
  --format FORMAT            terminal | json | sarif | junit | markdown
  --fail-below N             Exit 1 if score < N (for CI/CD)
  --fail-on-regression       Exit 1 if new gaps vs baseline
  --no-cache                 Skip scan model cache

Other Commands

API Reference

CI/CD Integration

GitHub Actions

- uses: ./comply/ci/github-action.yml
  with:
    framework: eu-ai-act
    fail-below: '50'
    upload-sarif: true
    post-comment: true

GitLab CI

include:
  - local: comply/ci/gitlab-ci-template.yml

comply-scan:
  extends: .comply-scan
  variables:
    COMPLY_FRAMEWORK: "eu-ai-act"
    COMPLY_FAIL_BELOW: "50"

Generic CI

# Score gate
bespoketracker-comply scan . --fail-below 50

# SARIF for code scanning
bespoketracker-comply scan . --format sarif -o ./reports

# Regression detection
bespoketracker-comply baseline --auto
bespoketracker-comply scan . --fail-on-regression

Standalone vs Monorepo

Comply works in two modes:

• Standalone (pip install bespoketracker-comply): Uses a vendored pure-Python scanner. No Kuzu or monorepo dependencies.
• Monorepo: When run inside the BespokeTracker monorepo, uses the full Kuzu-based pipeline for richer analysis.

Auto-detected at runtime — no configuration needed.

Self-Hosted: All Features Included

Comply is source-available under the BSL 1.1 license. All features — every framework, every scan depth, every export format — are included with no feature gates.

Update Subscription ($29-99/mo): Subscribers get continuous improvements to evidence evaluation, new framework support, and priority fixes via a private update channel. Public releases happen on major versions.

Configuration stored in ~/.comply/config.yaml.

Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

Adding a New Framework

Framework definitions live in data/frameworks.yaml (CC-BY-4.0 licensed). To add a new framework:

1. Add the framework definition to data/frameworks.yaml
2. Map evidence functions in _vendor/compliance_eval.py _EVIDENCE_FN_MAP
3. Add tests in the test suite
4. Submit a PR

Adding an Evidence Function

Evidence functions detect compliance-relevant patterns in codebases. See existing functions in _vendor/compliance_eval.py for the pattern.

License

Business Source License 1.1. You may use Comply for any purpose including production, except offering a competing hosted compliance scanning service. Converts to Apache 2.0 on 2030-03-10. See LICENSE for details.

Framework definitions (data/frameworks.yaml) are licensed under CC-BY-4.0.