cloudg

Map the cloud. Scan it. Merge everything.

Read the documentation · Open the sample report

cloudg (cloud graphing) maps AWS, Azure and GCP infrastructure into a graph, runs security scanners over that inventory, and merges every finding into one deduplicated, compliance-mapped result set. It can also skip the scanning entirely and aggregate outputs you already have.

• Map. cloudg map collects everything deployed (or default) in an account, down to the network fabric, sweeps every service for the rest, and links it all into typed relationships: S3 INVOKES Lambda, function ASSUMES_ROLE role, WAF PROTECTS ALB. No scanner runs and none has to be installed.
• Scan. cloudg run fans out to Prowler, ScoutSuite, Checkov and Trivy against the same accounts, then normalises, deduplicates and maps every finding against 28 compliance frameworks.
• Merge. cloudg ingest does the same for scanner output produced elsewhere, with no cloud credentials and no scanner binaries.
• Gate. cloudg gate fails a CI job on findings at or above a severity and writes SARIF for code scanning. On GitHub, uses: morpheuslord/cloudg@v0.7.1 runs the whole pipeline and the gate as an action.
• Use it. The results leave as an interactive HTML report, JSON, GraphML, an RDF ontology, RAG chunks for LLM pipelines and Terraform files, and cloudg mcp serve turns all of it into an MCP server for AI assistants.

Install

pip install cloudg            # core: graph, ontology, normaliser, reports, cloudg ingest
pip install "cloudg[aws]"     # plus the AWS SDK
pip install "cloudg[all]"     # every provider SDK and the MCP SDK

Python 3.11 or newer. The scanners are separate programs, not Python dependencies: install whichever of Prowler, ScoutSuite, Checkov and Trivy you want, and cloudg skips the rest with a warning. The Docker image ghcr.io/morpheuslord/cloudg bundles Prowler, Checkov and Trivy. The installation guide has the details.

Quick start

From the command line:

# map one AWS account in every enabled region; no scanners involved
cloudg map -p aws --regions all

# collect, scan and report in one go
cloudg run -p aws --regions us-east-1

# already ran the scanners? merge their output, no credentials needed
cloudg ingest --prowler ./prowler-output/ --checkov ./results_json.json --trivy ./trivy.json

Reports land in ./reports. Open report.html first, or look at the sample report to see what one looks like.

From Python, the CLI is a thin layer over CloudGEngine:

from cloudg import CloudGConfig, CloudGEngine

engine = CloudGEngine(CloudGConfig())
result = engine.run_from_reports_sync(
    {"prowler": ["./prowler-output/"], "trivy": ["./trivy.json"]},
    output_dir="./reports",
)
print(result.total_findings, result.severity_breakdown)
print(result.report_paths)  # findings.json and report.html

from cloudg import CloudGConfig, CloudGEngine

config = CloudGConfig(providers=["aws"])
config.aws.regions = ["ALL"]
inventory = CloudGEngine(config).map_inventory_sync(output_dir="./reports")
print(inventory.summary["total_assets"], "assets,", inventory.summary["total_edges"], "edges")

Documentation

The documentation site is at morpheuslord.github.io/cloudg:

• Quickstart and the guides: authentication, inventory mapping, AWS Organizations, scanners, compliance, reports, Docker and CI.
• CLI reference: every command and flag, generated from the code.
• Python API: CloudGEngine, the inventory, graph and findings classes, and the exceptions.
• Examples: complete scripts with their output.
• MCP server: connecting Claude Desktop, Claude Code, Cursor or VS Code.
• config.yaml reference and the changelog.

The same reference material is kept as Markdown in the repository: the feature reference, the inventory reference, catalog and internals, the MCP guide, tool reference and privacy reference, and rate limits and throttling.

Credits

cloudg builds on other people's work, and some of it ships inside the package.

Prowler (Apache-2.0). The 22 framework files in cloudg/rules/frameworks/ are generated from Prowler's compliance JSON by scripts/import_prowler_compliance.py. That covers the control IDs, the control titles and descriptions, and the mapping from each control to Prowler check names. Every generated file says so in its header and in its source field. Prowler check names also appear in cloudg/rules/check_equivalence.yaml, and cloudg runs Prowler and parses its ASFF and OCSF output.

Scanners. Checkov (Apache-2.0), Trivy (Apache-2.0) and ScoutSuite (GPL-2.0) are run as separate programs, and their reports are parsed. Their check IDs (CKV_*, AVD-*) are used in the check-equivalence map. None of their code is part of cloudg. The Docker image installs Prowler, Checkov and Trivy, so their own licenses apply to those copies.

Cloud Custodian (Apache-2.0). The policy packs in cloudg/policies/ are written in Cloud Custodian's policy format and run with its custodian CLI.

parliament (BSD-3-Clause) from Duo Labs does the IAM policy linting.

Drawing engines. The estate map in report.html is drawn with the iso-kit from Anatomy (MIT, by Ryan), and its empty states use the kernel of Hairline 0.5.1 (MIT, by Lucas Marques). Both are copied into cloudg/templates/vendor/ and embedded in every report, so the map works offline. The iso-kit is wrapped so it can sit inside a script element, and cloudg/templates/vendor/NOTICE lists exactly what changed.

MITRE ATT&CK®. The mitre_attack_*.yaml files contain ATT&CK technique IDs and descriptions. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK is a registered trademark of The MITRE Corporation.

Standards. The hand-written rulesets in cloudg/rules/ reference public control numbering from the CIS Benchmarks for AWS, Azure and GCP, NIST SP 800-53, NIST CSF, PCI DSS, the AICPA SOC 2 Trust Services Criteria, the HIPAA Security Rule, GDPR, ISO/IEC 27001:2022 and the AWS Foundational Security Best Practices. The standards belong to their publishers. CIS Benchmarks is a trademark of the Center for Internet Security, and cloudg is not affiliated with or endorsed by CIS or any other publisher named here.

The Python libraries cloudg depends on (NetworkX, rdflib, pydantic, Click, Rich and the rest) are listed in pyproject.toml. The full list, with the JavaScript libraries the report embeds, is on the credits page.

License

MIT. See LICENSE.