Publish Python Package Documentation PyPI version Python 3.10+ License: Apache-2.0

ThothCTL

AI-Powered Infrastructure Lifecycle CLI for DevSecOps, Platform Engineering, and IaC governance.

ThothCTL

ThothCTL accelerates the adoption of Internal Developer Platforms by combining security scanning, inventory management, cost analysis, AI-driven code review, and organizational policy enforcement into a single CLI.

Quick Start

pip install --upgrade thothctl

# Scan for security issues
thothctl scan iac -t checkov -t trivy -t opa

# Create infrastructure inventory (SBOM)
thothctl inventory iac --check-versions

# Launch web dashboard
thothctl dashboard launch

# AI-powered security review
thothctl ai-review analyze -d ./terraform -p ollama

Key Features

🔒 Security Scanning

Multi-tool scanning with unified HTML reports and enforcement:

# All scanners with hard enforcement (fails pipeline on violations)
thothctl scan iac -t checkov -t trivy -t kics -t opa -t terraform-compliance --enforcement hard
  • 5 integrated tools: Checkov, Trivy, KICS, OPA/Conftest, Terraform-compliance
  • Unified HTML reports with severity badges, per-stack breakdown
  • Non-compliance findings table on enforcement failure
  • SARIF output for GitHub Code Scanning integration
  • Organization policy repos via THOTH_ORG_POLICY env var (HCL + CloudFormation)
  • Scan trend tracking with local SQLite history

📦 Infrastructure Inventory (SBOM)

CycloneDX 1.6 compliant Software Bill of Materials:

thothctl inventory iac --check-versions
  • Module & provider version tracking with staleness detection
  • CycloneDX 1.6 SBOM with formulation, evidence, standards, attestations, dependency graph, hashes, and licenses
  • Technical debt scoring with risk levels and recommendations
  • Schema compatibility analysis for safe upgrades
  • Professional HTML reports with collapsible stack groups

📊 Web Dashboard

Modern FastAPI-based dashboard with dark mode:

thothctl dashboard launch
  • Security findings viewer — filter by tool/severity/search, pagination, inline report iframe
  • SBOM details browser — CycloneDX metadata, dependency graph, formulation, attestations
  • Inventory explorer — collapsible stacks, module/provider tabs, version comparison
  • Cost analysis — service breakdown, monthly/annual projections
  • Drift detection — severity-classified drifted resources
  • AI usage tracking — token counts, costs per request

🤖 AI Agent for IaC Security

Multi-agent system for automated code review and PR decisions:

thothctl ai-review analyze -d ./terraform -p ollama
thothctl ai-review decide -d ./terraform --pr-number 42 --dry-run
  • 4 specialized agents: Security, Architecture, Fix, Decision
  • Multi-provider: OpenAI, AWS Bedrock, Azure OpenAI, Ollama (local)
  • Auto-decisions with confidence thresholds and safety controls
  • Adaptive memory: filesystem or S3 (auto-detects runtime)
  • MCP integration for AI assistant interoperability

💰 Cost Analysis & Risk Assessment

thothctl check iac -type cost-analysis --recursive
thothctl check iac -type blast-radius --recursive
thothctl check iac -type drift --recursive
  • 14 AWS services supported (EC2, RDS, S3, Lambda, EKS, etc.)
  • Blast radius with ITIL v4 risk classification
  • Drift detection with severity scoring and IaC coverage tracking

🔄 Template Engine & Project Management

thothctl project convert --make-template --template-project-type terraform
thothctl init project -p my-infra --project-type terraform
  • Bidirectional conversion between projects and reusable templates
  • Backstage integration for self-service consumption
  • Template upgrade workflow to keep projects in sync

All Commands

Command Description
scan iac Multi-tool security scanning with enforcement
inventory iac Infrastructure SBOM with version tracking
check iac Cost analysis, blast radius, drift detection, structure validation
ai-review AI-powered security analysis and PR decisions
dashboard launch Web dashboard for all reports
document iac Auto-generate documentation
project convert Template ↔ project conversion
init project Scaffold new IaC projects
mcp Model Context Protocol server
generate Generate IaC from rules and components

Installation

pip install --upgrade thothctl

Requirements: Python 3.10+ | Linux, macOS, or Windows (WSL)

Optional system packages:

# Linux/Debian
sudo apt install graphviz libgraph-easy-perl -y

# macOS
brew install graphviz graph-easy

Dev Container

A ready-to-use Dev Container is available with all tools pre-configured:

# Open in VS Code → "Reopen in Container"
# Or use the devcontainer CLI:
devcontainer up --workspace-folder .

Documentation

📖 Full docs: thothforge.github.io/thothctl

CI/CD Integration

# GitHub Actions
- name: Security scan
  run: thothctl scan iac -t checkov -t trivy -t opa --enforcement hard --post-to-pr

- name: Inventory check
  run: thothctl inventory iac --check-versions --report-type json

Roadmap

  • Multi-tool security scanning with unified reports
  • AI Agent for IaC Security (multi-agent, auto-decisions)
  • CycloneDX 1.6 SBOM with full supply chain metadata
  • Organization policy engine (OPA/Rego, HCL + CloudFormation)
  • Web Dashboard with findings viewer and SBOM browser
  • Intent-to-IaC generation (natural language → governed Terraform)
  • Composable workflow engine (declarative YAML DAG pipelines)
  • Graph-aware state visibility (tfstate → queryable resource graph)
  • Architecture diagram generation (Mermaid/Graphviz from IaC)
  • Strands Agents SDK integration

📖 Full Roadmap

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.

License

Apache-2.0

Project links

Data verified by PyPI on Aug 24, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.28.1)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for velez94 from gravatar.com velez94

Credits

Author: Alejandro Velez

GitHub Statistics

Data verified by PyPI on Aug 24, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache-2.0

Requires

Python >=3.8

Provides Extra

telemetry

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

thothctl-0.27.14.tar.gz (2.0 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

thothctl-0.27.14-py3-none-any.whl (843.2 kB view details)

Uploaded Python 3

File details

Details for the file thothctl-0.27.14.tar.gz.

File metadata

  • Download URL: thothctl-0.27.14.tar.gz
  • Upload date:
  • Size: 2.0 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for thothctl-0.27.14.tar.gz
Algorithm Hash digest
SHA256 a735c8f8a2dee95ececcb6239b7264f1738e4ef628d70c07768e053cd3eec626
MD5 430762a41035685008048f3beb4edb8c
BLAKE2b-256 f4b53502be260a669f59ea7136dacde15eabf2a37a0b19d7eeea94ba46305757

See more details on using hashes here.

Provenance

The following attestation bundles were made for thothctl-0.27.14.tar.gz:

Publisher: python-publish.yml on thothforge/thothctl

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file thothctl-0.27.14-py3-none-any.whl.

File metadata

  • Download URL: thothctl-0.27.14-py3-none-any.whl
  • Upload date:
  • Size: 843.2 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for thothctl-0.27.14-py3-none-any.whl
Algorithm Hash digest
SHA256 5db14d7b91188893a84ae3e6a953a4b867fb1909192ace89e466193a639a37c5
MD5 0d84965b09e1f224cdf11efc1ee65845
BLAKE2b-256 d69259187976db941263af3bbc1183a0ddbe9002fca945fcfe0d06bdf8803846

See more details on using hashes here.

Provenance

The following attestation bundles were made for thothctl-0.27.14-py3-none-any.whl:

Publisher: python-publish.yml on thothforge/thothctl

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.28.1

2 files

0.28.0

2 files

This release

0.27.14 This release

2 files

0.27.13

2 files

0.27.12

2 files

0.27.11

2 files

0.27.10

2 files

0.27.9

2 files

0.27.8

2 files

0.27.7

2 files

0.27.6

2 files

0.27.5

2 files

0.26.1

2 files

0.26.0

2 files

0.25.8

2 files

0.25.7

2 files

0.25.6

2 files

0.25.5

2 files

0.25.4

2 files

0.25.3

2 files

0.25.2

2 files

0.25.1

2 files

0.25.0

2 files

0.24.9

2 files

0.24.8

2 files

0.24.7

2 files

0.24.6

2 files

0.24.5

2 files

0.24.4

2 files

0.24.3

2 files

0.24.2

2 files

0.24.1

2 files

0.24.0

2 files

0.23.3

2 files

0.23.2

2 files

0.23.1

2 files

0.23.0

2 files

0.22.2

2 files

0.22.1

2 files

0.22.0

2 files

0.21.6

2 files

0.21.5

2 files

0.21.4

2 files

0.21.3

2 files

0.21.2

2 files

0.21.1

2 files

0.21.0

2 files

0.20.4

2 files

0.20.3

2 files

0.20.2

2 files

0.20.1

2 files

0.20.0

2 files

0.19.0

2 files

0.18.9

2 files

0.18.8

2 files

0.18.7

2 files

0.18.6

2 files

0.18.5

2 files

0.18.4

2 files

0.18.3

2 files

0.18.2

2 files

0.18.1

2 files

0.18.0

2 files

0.17.4

2 files

0.17.3

2 files

0.17.2

2 files

0.17.1

2 files

0.17.0

2 files

0.16.10

2 files

0.16.9

2 files

0.16.8

2 files

0.16.7

2 files

0.16.5

2 files

0.16.4

2 files

0.16.3

2 files

0.16.2

2 files

0.16.1

2 files

0.15.4

2 files

0.15.3

2 files

0.15.2

2 files

0.15.1

2 files

0.15.0

2 files

0.14.4

2 files

0.14.3

2 files

0.14.2

2 files

0.14.1

2 files

0.13.6

2 files

0.13.5

2 files

0.13.4

2 files

0.13.3

2 files

0.13.2

2 files

0.13.1

2 files

0.13.0

2 files

0.12.0

2 files

0.11.0

2 files

0.10.40

2 files

0.10.39

2 files

0.10.38

2 files

0.10.37

2 files

0.10.36

2 files

0.10.35

2 files

0.10.34

2 files

0.10.33

2 files

0.10.32

2 files

0.10.31

2 files

0.10.30

2 files

0.10.29

2 files

0.10.28

2 files

0.10.27

2 files

0.10.26

2 files

0.10.25

2 files

0.10.24

2 files

0.10.23

2 files

0.10.22

2 files

0.10.21

2 files

0.10.20

2 files

0.10.19

2 files

0.10.18

2 files

0.10.17

2 files

0.10.16

2 files

0.10.15

2 files

0.10.14

2 files

0.10.13

2 files

0.10.12

2 files

0.10.11

2 files

0.10.10

2 files

0.10.7

2 files

0.10.6

2 files

0.10.5

2 files

0.10.3

2 files

0.10.2

2 files

0.10.1

2 files

0.10.0

2 files

0.9.5

2 files

0.9.4

2 files

0.9.3

2 files

0.9.2

2 files

0.9.0

2 files

0.8.14

2 files

0.8.13

2 files

0.8.12

2 files

0.8.11

2 files

0.8.10

2 files

0.8.9

2 files

0.8.8

2 files

0.8.7

2 files

0.8.5

2 files

0.8.4

2 files

0.8.3

2 files

0.8.2

2 files

0.8.1

2 files

0.7.5

2 files

0.7.2

2 files

0.7.1

2 files

0.6.5

2 files

0.6.3

2 files

0.6.2

2 files

0.6.1

2 files

0.5.5

2 files

0.5.4

2 files

0.5.3

2 files

0.5.2

2 files

0.5.0

2 files

0.4.5

2 files

0.4.4

2 files

0.4.2

2 files

0.4.0

2 files

0.3.4

2 files

0.3.3

2 files

0.3.2

2 files

0.3.0

2 files

0.2.6

2 files

0.2.5

2 files

0.2.4

2 files

0.2.3

2 files

0.2.1

2 files

0.2.0

2 files

0.1.0

1 file

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page