bespoketracker-comply 1.0.2__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- bespoketracker_comply-1.0.2/LICENSE +85 -0
- bespoketracker_comply-1.0.2/PKG-INFO +291 -0
- bespoketracker_comply-1.0.2/README.md +251 -0
- bespoketracker_comply-1.0.2/__init__.py +2 -0
- bespoketracker_comply-1.0.2/__main__.py +1788 -0
- bespoketracker_comply-1.0.2/_vendor/__init__.py +1 -0
- bespoketracker_comply-1.0.2/_vendor/codebase_scanner.py +516 -0
- bespoketracker_comply-1.0.2/_vendor/compliance_eval.py +1910 -0
- bespoketracker_comply-1.0.2/_vendor/framework_loader.py +72 -0
- bespoketracker_comply-1.0.2/_vendor/graph_ranking.py +474 -0
- bespoketracker_comply-1.0.2/_vendor/llm_client.py +141 -0
- bespoketracker_comply-1.0.2/adapters/__init__.py +1 -0
- bespoketracker_comply-1.0.2/adapters/base.py +104 -0
- bespoketracker_comply-1.0.2/adapters/file_adapter.py +116 -0
- bespoketracker_comply-1.0.2/adapters/gateway_adapter.py +225 -0
- bespoketracker_comply-1.0.2/adapters/github_actions.py +315 -0
- bespoketracker_comply-1.0.2/adapters/gitlab_ci.py +274 -0
- bespoketracker_comply-1.0.2/adapters/gravitee_adapter.py +136 -0
- bespoketracker_comply-1.0.2/adapters/kong_adapter.py +121 -0
- bespoketracker_comply-1.0.2/adapters/registry.py +120 -0
- bespoketracker_comply-1.0.2/adapters/vanta_adapter.py +263 -0
- bespoketracker_comply-1.0.2/app.py +140 -0
- bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/PKG-INFO +291 -0
- bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/SOURCES.txt +213 -0
- bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/dependency_links.txt +1 -0
- bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/entry_points.txt +2 -0
- bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/requires.txt +19 -0
- bespoketracker_comply-1.0.2/bespoketracker_comply.egg-info/top_level.txt +1 -0
- bespoketracker_comply-1.0.2/billing.py +293 -0
- bespoketracker_comply-1.0.2/cache.py +170 -0
- bespoketracker_comply-1.0.2/causal_forecast.py +497 -0
- bespoketracker_comply-1.0.2/ci/README.md +197 -0
- bespoketracker_comply-1.0.2/ci/github-action.yml +319 -0
- bespoketracker_comply-1.0.2/ci/gitlab-ci-template.yml +73 -0
- bespoketracker_comply-1.0.2/dashboard/api.js +294 -0
- bespoketracker_comply-1.0.2/dashboard/app.js +472 -0
- bespoketracker_comply-1.0.2/dashboard/catalog/catalog_index.json +18 -0
- bespoketracker_comply-1.0.2/dashboard/catalog/eu_ai_act.json +948 -0
- bespoketracker_comply-1.0.2/dashboard/catalog/nist_ai_rmf.json +401 -0
- bespoketracker_comply-1.0.2/dashboard/catalog/soc2_ai.json +124 -0
- bespoketracker_comply-1.0.2/dashboard/codegen.js +1417 -0
- bespoketracker_comply-1.0.2/dashboard/components.js +1741 -0
- bespoketracker_comply-1.0.2/dashboard/crypto.js +124 -0
- bespoketracker_comply-1.0.2/dashboard/demo.css +3232 -0
- bespoketracker_comply-1.0.2/dashboard/index.html +83 -0
- bespoketracker_comply-1.0.2/dashboard/report.js +1042 -0
- bespoketracker_comply-1.0.2/dashboard/router.js +51 -0
- bespoketracker_comply-1.0.2/dashboard/scandb.js +107 -0
- bespoketracker_comply-1.0.2/dashboard/stores.js +601 -0
- bespoketracker_comply-1.0.2/dashboard/style.css +825 -0
- bespoketracker_comply-1.0.2/dashboard/views/adapters.js +153 -0
- bespoketracker_comply-1.0.2/dashboard/views/audit.js +215 -0
- bespoketracker_comply-1.0.2/dashboard/views/compare.js +394 -0
- bespoketracker_comply-1.0.2/dashboard/views/demo.js +392 -0
- bespoketracker_comply-1.0.2/dashboard/views/detail.js +1478 -0
- bespoketracker_comply-1.0.2/dashboard/views/diff.js +445 -0
- bespoketracker_comply-1.0.2/dashboard/views/forecast.js +321 -0
- bespoketracker_comply-1.0.2/dashboard/views/gate.js +172 -0
- bespoketracker_comply-1.0.2/dashboard/views/history.js +278 -0
- bespoketracker_comply-1.0.2/dashboard/views/home.js +179 -0
- bespoketracker_comply-1.0.2/dashboard/views/landing.js +1569 -0
- bespoketracker_comply-1.0.2/dashboard/views/mapping.js +163 -0
- bespoketracker_comply-1.0.2/dashboard/views/monitor.js +230 -0
- bespoketracker_comply-1.0.2/dashboard/views/overlap.js +134 -0
- bespoketracker_comply-1.0.2/dashboard/views/progress.js +281 -0
- bespoketracker_comply-1.0.2/dashboard/views/scan.js +122 -0
- bespoketracker_comply-1.0.2/dashboard/views/settings.js +120 -0
- bespoketracker_comply-1.0.2/dashboard/views/trends.js +107 -0
- bespoketracker_comply-1.0.2/data/__init__.py +1 -0
- bespoketracker_comply-1.0.2/data/cwe_control_mapping.yaml +1949 -0
- bespoketracker_comply-1.0.2/data/frameworks.yaml +1027 -0
- bespoketracker_comply-1.0.2/demo_repos.yaml +9 -0
- bespoketracker_comply-1.0.2/demo_security.py +110 -0
- bespoketracker_comply-1.0.2/diff_utils.py +58 -0
- bespoketracker_comply-1.0.2/docx_report.py +230 -0
- bespoketracker_comply-1.0.2/evidence_layers.py +778 -0
- bespoketracker_comply-1.0.2/export_catalog.py +138 -0
- bespoketracker_comply-1.0.2/finding_mapper.py +607 -0
- bespoketracker_comply-1.0.2/forecast.py +265 -0
- bespoketracker_comply-1.0.2/forecast_routes.py +31 -0
- bespoketracker_comply-1.0.2/formats.py +347 -0
- bespoketracker_comply-1.0.2/funded.py +343 -0
- bespoketracker_comply-1.0.2/gate.py +217 -0
- bespoketracker_comply-1.0.2/gate_routes.py +76 -0
- bespoketracker_comply-1.0.2/git_clone.py +57 -0
- bespoketracker_comply-1.0.2/incremental.py +340 -0
- bespoketracker_comply-1.0.2/junit_import.py +317 -0
- bespoketracker_comply-1.0.2/licensing.py +166 -0
- bespoketracker_comply-1.0.2/mapping.py +229 -0
- bespoketracker_comply-1.0.2/monitor.py +661 -0
- bespoketracker_comply-1.0.2/monitor_routes.py +145 -0
- bespoketracker_comply-1.0.2/narration.py +377 -0
- bespoketracker_comply-1.0.2/pyproject.toml +63 -0
- bespoketracker_comply-1.0.2/regression.py +161 -0
- bespoketracker_comply-1.0.2/remediation.py +606 -0
- bespoketracker_comply-1.0.2/report.py +557 -0
- bespoketracker_comply-1.0.2/routes.py +15 -0
- bespoketracker_comply-1.0.2/routes_billing.py +126 -0
- bespoketracker_comply-1.0.2/routes_demo.py +466 -0
- bespoketracker_comply-1.0.2/routes_forecast.py +305 -0
- bespoketracker_comply-1.0.2/routes_funded.py +283 -0
- bespoketracker_comply-1.0.2/routes_import.py +209 -0
- bespoketracker_comply-1.0.2/routes_posture.py +417 -0
- bespoketracker_comply-1.0.2/routes_scan.py +548 -0
- bespoketracker_comply-1.0.2/sarif_import.py +337 -0
- bespoketracker_comply-1.0.2/sbom_import.py +397 -0
- bespoketracker_comply-1.0.2/scan_state.py +77 -0
- bespoketracker_comply-1.0.2/scanner.py +796 -0
- bespoketracker_comply-1.0.2/setup.cfg +4 -0
- bespoketracker_comply-1.0.2/store.py +873 -0
- bespoketracker_comply-1.0.2/tiers.py +150 -0
- bespoketracker_comply-1.0.2/url_normalize.py +43 -0
- bespoketracker_comply-1.0.2/watcher.py +228 -0
|
@@ -0,0 +1,85 @@
|
|
|
1
|
+
Business Source License 1.1
|
|
2
|
+
|
|
3
|
+
Licensor: BespokeAgile (Nicholas Salzman)
|
|
4
|
+
Licensed Work: BespokeTracker Comply v1.0.2
|
|
5
|
+
Additional Use Grant: You may use the Licensed Work for any purpose,
|
|
6
|
+
including production use, except for offering a competing hosted
|
|
7
|
+
compliance scanning service.
|
|
8
|
+
Change Date: 2030-03-10
|
|
9
|
+
Change License: Apache License, Version 2.0
|
|
10
|
+
|
|
11
|
+
License text copyright © 2024 MariaDB plc, All Rights Reserved.
|
|
12
|
+
"Business Source License" is a trademark of MariaDB plc.
|
|
13
|
+
|
|
14
|
+
Terms
|
|
15
|
+
|
|
16
|
+
The Licensor hereby grants you the right to copy, modify, create derivative
|
|
17
|
+
works, redistribute, and make non-production use of the Licensed Work. The
|
|
18
|
+
Licensor may make an Additional Use Grant, above, permitting limited
|
|
19
|
+
production use.
|
|
20
|
+
|
|
21
|
+
Effective on the Change Date, or the fourth anniversary of the first publicly
|
|
22
|
+
available distribution of a specific version of the Licensed Work under this
|
|
23
|
+
License, whichever comes first, the Licensor hereby grants you rights under
|
|
24
|
+
the terms of the Change License, and the rights granted in the paragraph
|
|
25
|
+
above terminate.
|
|
26
|
+
|
|
27
|
+
If your use of the Licensed Work does not comply with the requirements
|
|
28
|
+
currently in effect as described in this License, you must purchase a
|
|
29
|
+
commercial license from the Licensor, its affiliated entities, or authorized
|
|
30
|
+
resellers, or you must refrain from using the Licensed Work.
|
|
31
|
+
|
|
32
|
+
All copies of the original and modified Licensed Work, and derivative works
|
|
33
|
+
of the Licensed Work, are subject to this License. This License applies
|
|
34
|
+
separately for each version of the Licensed Work and the Change Date may vary
|
|
35
|
+
for each version of the Licensed Work released by Licensor.
|
|
36
|
+
|
|
37
|
+
You must conspicuously display this License on each original or modified copy
|
|
38
|
+
of the Licensed Work. If you receive the Licensed Work in original or
|
|
39
|
+
modified form from a third party, the terms and conditions set forth in this
|
|
40
|
+
License apply to your use of that work.
|
|
41
|
+
|
|
42
|
+
Any use of the Licensed Work in violation of this License will automatically
|
|
43
|
+
terminate your rights under this License for the current and all other
|
|
44
|
+
versions of the Licensed Work.
|
|
45
|
+
|
|
46
|
+
This License does not grant you any right in any trademark or logo of
|
|
47
|
+
Licensor or its affiliates (provided that you may use a trademark or logo of
|
|
48
|
+
Licensor as expressly required by this License).
|
|
49
|
+
|
|
50
|
+
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
|
|
51
|
+
AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
|
|
52
|
+
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
|
|
53
|
+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
|
|
54
|
+
TITLE.
|
|
55
|
+
|
|
56
|
+
MariaDB hereby grants you permission to use this License's text to license
|
|
57
|
+
your works, and to refer to it using the trademark "Business Source License",
|
|
58
|
+
as long as you comply with the Covenants of Licensor below.
|
|
59
|
+
|
|
60
|
+
Covenants of Licensor
|
|
61
|
+
|
|
62
|
+
In consideration of the right to use this License's text and the "Business
|
|
63
|
+
Source License" name and trademark, Licensor covenants to MariaDB, and to all
|
|
64
|
+
other recipients of the licensed work to be provided by Licensor:
|
|
65
|
+
|
|
66
|
+
To specify as the Change License the GPL Version 2.0 or any later version, or
|
|
67
|
+
a license that is compatible with GPL Version 2.0 or a later version, where
|
|
68
|
+
"compatible" means that software provided under the Change License can be
|
|
69
|
+
included in a program with software provided under GPL Version 2.0 or a later
|
|
70
|
+
version. Licensor may specify additional Change Licenses without limitation.
|
|
71
|
+
|
|
72
|
+
To either: (a) specify an additional grant of rights to use that does not
|
|
73
|
+
impose any additional restriction on the right granted in this License, as the
|
|
74
|
+
Additional Use Grant; or (b) insert the text "None" to specify a Change Date.
|
|
75
|
+
Not to modify this License in any other way.
|
|
76
|
+
|
|
77
|
+
Notice
|
|
78
|
+
|
|
79
|
+
The Business Source License (this document, or the "License") is not an Open
|
|
80
|
+
Source license. However, the Licensed Work will eventually be made available
|
|
81
|
+
under an Open Source License, as stated in this License.
|
|
82
|
+
|
|
83
|
+
---
|
|
84
|
+
|
|
85
|
+
Framework definitions (data/frameworks.yaml) are licensed under CC-BY-4.0.
|
|
@@ -0,0 +1,291 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: bespoketracker-comply
|
|
3
|
+
Version: 1.0.2
|
|
4
|
+
Summary: Compliance gap analysis for any codebase — standalone scanner, CI/CD integration, and web dashboard
|
|
5
|
+
Author: BespokeTracker
|
|
6
|
+
License: BSL-1.1
|
|
7
|
+
Project-URL: Homepage, https://bespokeagile.com/comply/
|
|
8
|
+
Project-URL: Documentation, https://bespokeagile.com/comply/docs/
|
|
9
|
+
Project-URL: Demo, https://comply-demo.bespokeagile.com/
|
|
10
|
+
Project-URL: Repository, https://github.com/bespokeagile/comply
|
|
11
|
+
Project-URL: Bug Tracker, https://github.com/bespokeagile/comply/issues
|
|
12
|
+
Keywords: compliance,ai-act,governance,scanner,ci-cd
|
|
13
|
+
Classifier: Development Status :: 4 - Beta
|
|
14
|
+
Classifier: Intended Audience :: Developers
|
|
15
|
+
Classifier: Topic :: Software Development :: Quality Assurance
|
|
16
|
+
Classifier: Programming Language :: Python :: 3
|
|
17
|
+
Classifier: Programming Language :: Python :: 3.9
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
21
|
+
Requires-Python: >=3.9
|
|
22
|
+
Description-Content-Type: text/markdown
|
|
23
|
+
License-File: LICENSE
|
|
24
|
+
Requires-Dist: fastapi>=0.100.0
|
|
25
|
+
Requires-Dist: uvicorn[standard]>=0.20.0
|
|
26
|
+
Requires-Dist: pydantic>=2.0
|
|
27
|
+
Requires-Dist: pyyaml>=6.0
|
|
28
|
+
Requires-Dist: httpx>=0.24.0
|
|
29
|
+
Requires-Dist: slowapi>=0.1.9
|
|
30
|
+
Provides-Extra: semantic
|
|
31
|
+
Requires-Dist: anthropic>=0.18.0; extra == "semantic"
|
|
32
|
+
Requires-Dist: openai>=1.0.0; extra == "semantic"
|
|
33
|
+
Provides-Extra: docx
|
|
34
|
+
Requires-Dist: python-docx>=0.8.11; extra == "docx"
|
|
35
|
+
Provides-Extra: billing
|
|
36
|
+
Requires-Dist: stripe>=5.0.0; extra == "billing"
|
|
37
|
+
Provides-Extra: all
|
|
38
|
+
Requires-Dist: bespoketracker-comply[billing,docx,semantic]; extra == "all"
|
|
39
|
+
Dynamic: license-file
|
|
40
|
+
|
|
41
|
+
# BespokeTracker Comply
|
|
42
|
+
|
|
43
|
+
**Compliance gap analysis for any codebase.** Scan any repository against 10 regulatory frameworks. Get evidence-backed compliance reports with specific file paths, control status, and remediation recommendations.
|
|
44
|
+
|
|
45
|
+
**Regulatory deadlines:** Colorado SB 24-205 (June 30, 2026) | EU AI Act (August 2, 2026)
|
|
46
|
+
|
|
47
|
+
[](https://pypi.org/project/bespoketracker-comply/)
|
|
48
|
+
[](LICENSE)
|
|
49
|
+
[](https://www.python.org/downloads/)
|
|
50
|
+
|
|
51
|
+
## Install
|
|
52
|
+
|
|
53
|
+
```bash
|
|
54
|
+
# Standalone (pip)
|
|
55
|
+
pip install bespoketracker-comply
|
|
56
|
+
|
|
57
|
+
# From source
|
|
58
|
+
pip install -e ./comply
|
|
59
|
+
|
|
60
|
+
# With semantic analysis support
|
|
61
|
+
pip install bespoketracker-comply[semantic]
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
## Quick Start
|
|
65
|
+
|
|
66
|
+
```bash
|
|
67
|
+
# Scan a local repository
|
|
68
|
+
bespoketracker-comply scan /path/to/your/repo
|
|
69
|
+
|
|
70
|
+
# Scan a GitHub repository
|
|
71
|
+
bespoketracker-comply scan https://github.com/org/repo --framework eu-ai-act
|
|
72
|
+
|
|
73
|
+
# Multi-framework scan
|
|
74
|
+
bespoketracker-comply scan . --framework eu-ai-act,nist-ai-rmf,iso-42001
|
|
75
|
+
|
|
76
|
+
# Start the web dashboard
|
|
77
|
+
bespoketracker-comply serve
|
|
78
|
+
# Open http://localhost:8001
|
|
79
|
+
```
|
|
80
|
+
|
|
81
|
+
## Docker
|
|
82
|
+
|
|
83
|
+
```bash
|
|
84
|
+
# Build and run
|
|
85
|
+
docker build -t comply .
|
|
86
|
+
docker run -p 8001:8001 -v comply-data:/root/.comply comply
|
|
87
|
+
|
|
88
|
+
# With docker-compose (includes optional gateway sidecar)
|
|
89
|
+
docker compose up
|
|
90
|
+
|
|
91
|
+
# With gateway for three-layer evidence
|
|
92
|
+
docker compose --profile with-gateway up
|
|
93
|
+
```
|
|
94
|
+
|
|
95
|
+
## Supported Frameworks
|
|
96
|
+
|
|
97
|
+
| Framework | Controls | Description |
|
|
98
|
+
|-----------|----------|-------------|
|
|
99
|
+
| `eu-ai-act` | 8 | EU AI Act 2024/1689 (Articles 9-14) |
|
|
100
|
+
| `nist-ai-rmf` | 12 | NIST AI Risk Management Framework 1.0 |
|
|
101
|
+
| `iso-42001` | 10 | ISO/IEC 42001:2023 AI Management System |
|
|
102
|
+
| `california-ab-2013` | 3 | California AB 2013 AI Transparency Act |
|
|
103
|
+
| `california-sb-942` | 4 | California SB 942 AI Transparency |
|
|
104
|
+
| `colorado-sb-24-205` | 5 | Colorado SB 24-205 Consumer Protections |
|
|
105
|
+
| `soc2-ai` | 6 | SOC 2 AI Trust Services Criteria |
|
|
106
|
+
| `insurance-attestation` | 5 | Insurance AI Attestation (NAIC) |
|
|
107
|
+
| `owasp-llm-top10` | 10 | OWASP Top 10 for LLM Applications |
|
|
108
|
+
| `owasp-agentic-top10` | 10 | OWASP Agentic AI Top 10 |
|
|
109
|
+
|
|
110
|
+
## Three-Layer Evidence
|
|
111
|
+
|
|
112
|
+
Comply evaluates compliance across three layers:
|
|
113
|
+
|
|
114
|
+
1. **Layer 1 — Code**: Static analysis of your codebase (logging, tests, docs, auth, monitoring)
|
|
115
|
+
2. **Layer 2 — Process**: Development process maturity (baselines, regression tracking, CI gates)
|
|
116
|
+
3. **Layer 3 — Traffic**: AI agent governance (audit logs, access control, policy enforcement)
|
|
117
|
+
|
|
118
|
+
Layer 1 runs automatically. Layer 2 builds as you set baselines and track regressions. Layer 3 requires connecting audit log adapters.
|
|
119
|
+
|
|
120
|
+
### Audit Log Adapters
|
|
121
|
+
|
|
122
|
+
Connect external systems for Layer 3 evidence:
|
|
123
|
+
|
|
124
|
+
```yaml
|
|
125
|
+
# ~/.comply/config.yaml
|
|
126
|
+
adapters:
|
|
127
|
+
gateway:
|
|
128
|
+
mode: sqlite
|
|
129
|
+
db_path: ./gateway.db
|
|
130
|
+
kong:
|
|
131
|
+
admin_url: http://localhost:8001
|
|
132
|
+
gravitee:
|
|
133
|
+
management_url: http://localhost:8083/management
|
|
134
|
+
file:
|
|
135
|
+
paths:
|
|
136
|
+
- ./audit-logs/*.jsonl
|
|
137
|
+
```
|
|
138
|
+
|
|
139
|
+
```bash
|
|
140
|
+
# List adapters
|
|
141
|
+
bespoketracker-comply adapters list
|
|
142
|
+
|
|
143
|
+
# Test connectivity
|
|
144
|
+
bespoketracker-comply adapters test gateway
|
|
145
|
+
|
|
146
|
+
# Ingest records
|
|
147
|
+
bespoketracker-comply adapters ingest gateway
|
|
148
|
+
```
|
|
149
|
+
|
|
150
|
+
## CLI Reference
|
|
151
|
+
|
|
152
|
+
### `comply scan`
|
|
153
|
+
|
|
154
|
+
```
|
|
155
|
+
bespoketracker-comply scan <target> [options]
|
|
156
|
+
|
|
157
|
+
Options:
|
|
158
|
+
-f, --framework FRAMEWORK Framework(s), comma-separated (default: eu-ai-act)
|
|
159
|
+
-d, --depth DEPTH structure | content | semantic (default: content)
|
|
160
|
+
-o, --output DIR Output directory for reports
|
|
161
|
+
--llm-key KEY LLM API key (required for semantic depth)
|
|
162
|
+
--llm-provider PROVIDER anthropic | openai | gemini | grok
|
|
163
|
+
--format FORMAT terminal | json | sarif | junit | markdown
|
|
164
|
+
--fail-below N Exit 1 if score < N (for CI/CD)
|
|
165
|
+
--fail-on-regression Exit 1 if new gaps vs baseline
|
|
166
|
+
--no-cache Skip scan model cache
|
|
167
|
+
```
|
|
168
|
+
|
|
169
|
+
### Other Commands
|
|
170
|
+
|
|
171
|
+
| Command | Description |
|
|
172
|
+
|---------|-------------|
|
|
173
|
+
| `serve [--port 8001]` | Start the web dashboard |
|
|
174
|
+
| `config show` | Show current configuration |
|
|
175
|
+
| `config set KEY VALUE` | Set a config value (e.g. `llm_api_key`, `llm_provider`) |
|
|
176
|
+
| `config path` | Print config file path |
|
|
177
|
+
| `frameworks` | List supported frameworks |
|
|
178
|
+
| `history [--repo PATH]` | Browse past scans |
|
|
179
|
+
| `diff SCAN1 SCAN2` | Compare two scans |
|
|
180
|
+
| `baseline --set ID` | Set compliance baseline |
|
|
181
|
+
| `cache stats\|clear` | Manage scan cache |
|
|
182
|
+
| `adapters list\|test\|ingest` | Manage audit log adapters |
|
|
183
|
+
| `activate KEY` | Activate Pro/Enterprise license |
|
|
184
|
+
| `deactivate` | Revert to free tier |
|
|
185
|
+
| `license` | Show current license status |
|
|
186
|
+
|
|
187
|
+
## API Reference
|
|
188
|
+
|
|
189
|
+
| Method | Endpoint | Description |
|
|
190
|
+
|--------|----------|-------------|
|
|
191
|
+
| `POST` | `/scan` | Start a scan |
|
|
192
|
+
| `GET` | `/scan/{id}` | Poll scan status |
|
|
193
|
+
| `GET` | `/scan/{id}/report` | Get report JSON |
|
|
194
|
+
| `GET` | `/scan/{id}/download?fmt=` | Download (json/sarif/junit/markdown/docx/zip) |
|
|
195
|
+
| `GET` | `/scan/{id}/regression` | Regression check |
|
|
196
|
+
| `GET` | `/scan/{id}/progress` | Progress polling |
|
|
197
|
+
| `GET` | `/history` | Scan history |
|
|
198
|
+
| `GET` | `/diff?scan1=&scan2=` | Diff two scans |
|
|
199
|
+
| `GET` | `/adapters` | List adapters |
|
|
200
|
+
| `POST` | `/adapters/{name}/test` | Test adapter |
|
|
201
|
+
| `POST` | `/adapters/{name}/ingest` | Ingest records |
|
|
202
|
+
| `GET` | `/adapters/{name}/records` | Query records |
|
|
203
|
+
| `GET` | `/posture` | All-framework posture |
|
|
204
|
+
| `GET` | `/posture/{framework}` | Three-layer posture |
|
|
205
|
+
| `POST` | `/baseline/{id}` | Set baseline |
|
|
206
|
+
| `GET` | `/frameworks` | List frameworks |
|
|
207
|
+
| `POST` | `/audit` | Predicate gap audit (free) |
|
|
208
|
+
| `GET` | `/matrix?frameworks=` | Cross-framework matrix |
|
|
209
|
+
| `GET` | `/license` | License status |
|
|
210
|
+
| `POST` | `/license/activate` | Activate license key |
|
|
211
|
+
| `GET` | `/health` | Health + version |
|
|
212
|
+
|
|
213
|
+
## CI/CD Integration
|
|
214
|
+
|
|
215
|
+
### GitHub Actions
|
|
216
|
+
|
|
217
|
+
```yaml
|
|
218
|
+
- uses: ./comply/ci/github-action.yml
|
|
219
|
+
with:
|
|
220
|
+
framework: eu-ai-act
|
|
221
|
+
fail-below: '50'
|
|
222
|
+
upload-sarif: true
|
|
223
|
+
post-comment: true
|
|
224
|
+
```
|
|
225
|
+
|
|
226
|
+
### GitLab CI
|
|
227
|
+
|
|
228
|
+
```yaml
|
|
229
|
+
include:
|
|
230
|
+
- local: comply/ci/gitlab-ci-template.yml
|
|
231
|
+
|
|
232
|
+
comply-scan:
|
|
233
|
+
extends: .comply-scan
|
|
234
|
+
variables:
|
|
235
|
+
COMPLY_FRAMEWORK: "eu-ai-act"
|
|
236
|
+
COMPLY_FAIL_BELOW: "50"
|
|
237
|
+
```
|
|
238
|
+
|
|
239
|
+
### Generic CI
|
|
240
|
+
|
|
241
|
+
```bash
|
|
242
|
+
# Score gate
|
|
243
|
+
bespoketracker-comply scan . --fail-below 50
|
|
244
|
+
|
|
245
|
+
# SARIF for code scanning
|
|
246
|
+
bespoketracker-comply scan . --format sarif -o ./reports
|
|
247
|
+
|
|
248
|
+
# Regression detection
|
|
249
|
+
bespoketracker-comply baseline --auto
|
|
250
|
+
bespoketracker-comply scan . --fail-on-regression
|
|
251
|
+
```
|
|
252
|
+
|
|
253
|
+
## Standalone vs Monorepo
|
|
254
|
+
|
|
255
|
+
Comply works in two modes:
|
|
256
|
+
|
|
257
|
+
- **Standalone** (`pip install bespoketracker-comply`): Uses a vendored pure-Python scanner. No Kuzu or monorepo dependencies.
|
|
258
|
+
- **Monorepo**: When run inside the BespokeTracker monorepo, uses the full Kuzu-based pipeline for richer analysis.
|
|
259
|
+
|
|
260
|
+
Auto-detected at runtime — no configuration needed.
|
|
261
|
+
|
|
262
|
+
## Self-Hosted: All Features Included
|
|
263
|
+
|
|
264
|
+
Comply is source-available under the BSL 1.1 license. All features — every framework, every scan depth, every export format — are included with no feature gates.
|
|
265
|
+
|
|
266
|
+
**Update Subscription** ($29-99/mo): Subscribers get continuous improvements to evidence evaluation, new framework support, and priority fixes via a private update channel. Public releases happen on major versions.
|
|
267
|
+
|
|
268
|
+
Configuration stored in `~/.comply/config.yaml`.
|
|
269
|
+
|
|
270
|
+
## Contributing
|
|
271
|
+
|
|
272
|
+
We welcome contributions! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
|
|
273
|
+
|
|
274
|
+
### Adding a New Framework
|
|
275
|
+
|
|
276
|
+
Framework definitions live in `data/frameworks.yaml` (CC-BY-4.0 licensed). To add a new framework:
|
|
277
|
+
|
|
278
|
+
1. Add the framework definition to `data/frameworks.yaml`
|
|
279
|
+
2. Map evidence functions in `_vendor/compliance_eval.py` `_EVIDENCE_FN_MAP`
|
|
280
|
+
3. Add tests in the test suite
|
|
281
|
+
4. Submit a PR
|
|
282
|
+
|
|
283
|
+
### Adding an Evidence Function
|
|
284
|
+
|
|
285
|
+
Evidence functions detect compliance-relevant patterns in codebases. See existing functions in `_vendor/compliance_eval.py` for the pattern.
|
|
286
|
+
|
|
287
|
+
## License
|
|
288
|
+
|
|
289
|
+
Business Source License 1.1. You may use Comply for any purpose including production, except offering a competing hosted compliance scanning service. Converts to Apache 2.0 on 2030-03-10. See [LICENSE](LICENSE) for details.
|
|
290
|
+
|
|
291
|
+
Framework definitions (`data/frameworks.yaml`) are licensed under CC-BY-4.0.
|
|
@@ -0,0 +1,251 @@
|
|
|
1
|
+
# BespokeTracker Comply
|
|
2
|
+
|
|
3
|
+
**Compliance gap analysis for any codebase.** Scan any repository against 10 regulatory frameworks. Get evidence-backed compliance reports with specific file paths, control status, and remediation recommendations.
|
|
4
|
+
|
|
5
|
+
**Regulatory deadlines:** Colorado SB 24-205 (June 30, 2026) | EU AI Act (August 2, 2026)
|
|
6
|
+
|
|
7
|
+
[](https://pypi.org/project/bespoketracker-comply/)
|
|
8
|
+
[](LICENSE)
|
|
9
|
+
[](https://www.python.org/downloads/)
|
|
10
|
+
|
|
11
|
+
## Install
|
|
12
|
+
|
|
13
|
+
```bash
|
|
14
|
+
# Standalone (pip)
|
|
15
|
+
pip install bespoketracker-comply
|
|
16
|
+
|
|
17
|
+
# From source
|
|
18
|
+
pip install -e ./comply
|
|
19
|
+
|
|
20
|
+
# With semantic analysis support
|
|
21
|
+
pip install bespoketracker-comply[semantic]
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
## Quick Start
|
|
25
|
+
|
|
26
|
+
```bash
|
|
27
|
+
# Scan a local repository
|
|
28
|
+
bespoketracker-comply scan /path/to/your/repo
|
|
29
|
+
|
|
30
|
+
# Scan a GitHub repository
|
|
31
|
+
bespoketracker-comply scan https://github.com/org/repo --framework eu-ai-act
|
|
32
|
+
|
|
33
|
+
# Multi-framework scan
|
|
34
|
+
bespoketracker-comply scan . --framework eu-ai-act,nist-ai-rmf,iso-42001
|
|
35
|
+
|
|
36
|
+
# Start the web dashboard
|
|
37
|
+
bespoketracker-comply serve
|
|
38
|
+
# Open http://localhost:8001
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
## Docker
|
|
42
|
+
|
|
43
|
+
```bash
|
|
44
|
+
# Build and run
|
|
45
|
+
docker build -t comply .
|
|
46
|
+
docker run -p 8001:8001 -v comply-data:/root/.comply comply
|
|
47
|
+
|
|
48
|
+
# With docker-compose (includes optional gateway sidecar)
|
|
49
|
+
docker compose up
|
|
50
|
+
|
|
51
|
+
# With gateway for three-layer evidence
|
|
52
|
+
docker compose --profile with-gateway up
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
## Supported Frameworks
|
|
56
|
+
|
|
57
|
+
| Framework | Controls | Description |
|
|
58
|
+
|-----------|----------|-------------|
|
|
59
|
+
| `eu-ai-act` | 8 | EU AI Act 2024/1689 (Articles 9-14) |
|
|
60
|
+
| `nist-ai-rmf` | 12 | NIST AI Risk Management Framework 1.0 |
|
|
61
|
+
| `iso-42001` | 10 | ISO/IEC 42001:2023 AI Management System |
|
|
62
|
+
| `california-ab-2013` | 3 | California AB 2013 AI Transparency Act |
|
|
63
|
+
| `california-sb-942` | 4 | California SB 942 AI Transparency |
|
|
64
|
+
| `colorado-sb-24-205` | 5 | Colorado SB 24-205 Consumer Protections |
|
|
65
|
+
| `soc2-ai` | 6 | SOC 2 AI Trust Services Criteria |
|
|
66
|
+
| `insurance-attestation` | 5 | Insurance AI Attestation (NAIC) |
|
|
67
|
+
| `owasp-llm-top10` | 10 | OWASP Top 10 for LLM Applications |
|
|
68
|
+
| `owasp-agentic-top10` | 10 | OWASP Agentic AI Top 10 |
|
|
69
|
+
|
|
70
|
+
## Three-Layer Evidence
|
|
71
|
+
|
|
72
|
+
Comply evaluates compliance across three layers:
|
|
73
|
+
|
|
74
|
+
1. **Layer 1 — Code**: Static analysis of your codebase (logging, tests, docs, auth, monitoring)
|
|
75
|
+
2. **Layer 2 — Process**: Development process maturity (baselines, regression tracking, CI gates)
|
|
76
|
+
3. **Layer 3 — Traffic**: AI agent governance (audit logs, access control, policy enforcement)
|
|
77
|
+
|
|
78
|
+
Layer 1 runs automatically. Layer 2 builds as you set baselines and track regressions. Layer 3 requires connecting audit log adapters.
|
|
79
|
+
|
|
80
|
+
### Audit Log Adapters
|
|
81
|
+
|
|
82
|
+
Connect external systems for Layer 3 evidence:
|
|
83
|
+
|
|
84
|
+
```yaml
|
|
85
|
+
# ~/.comply/config.yaml
|
|
86
|
+
adapters:
|
|
87
|
+
gateway:
|
|
88
|
+
mode: sqlite
|
|
89
|
+
db_path: ./gateway.db
|
|
90
|
+
kong:
|
|
91
|
+
admin_url: http://localhost:8001
|
|
92
|
+
gravitee:
|
|
93
|
+
management_url: http://localhost:8083/management
|
|
94
|
+
file:
|
|
95
|
+
paths:
|
|
96
|
+
- ./audit-logs/*.jsonl
|
|
97
|
+
```
|
|
98
|
+
|
|
99
|
+
```bash
|
|
100
|
+
# List adapters
|
|
101
|
+
bespoketracker-comply adapters list
|
|
102
|
+
|
|
103
|
+
# Test connectivity
|
|
104
|
+
bespoketracker-comply adapters test gateway
|
|
105
|
+
|
|
106
|
+
# Ingest records
|
|
107
|
+
bespoketracker-comply adapters ingest gateway
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
## CLI Reference
|
|
111
|
+
|
|
112
|
+
### `comply scan`
|
|
113
|
+
|
|
114
|
+
```
|
|
115
|
+
bespoketracker-comply scan <target> [options]
|
|
116
|
+
|
|
117
|
+
Options:
|
|
118
|
+
-f, --framework FRAMEWORK Framework(s), comma-separated (default: eu-ai-act)
|
|
119
|
+
-d, --depth DEPTH structure | content | semantic (default: content)
|
|
120
|
+
-o, --output DIR Output directory for reports
|
|
121
|
+
--llm-key KEY LLM API key (required for semantic depth)
|
|
122
|
+
--llm-provider PROVIDER anthropic | openai | gemini | grok
|
|
123
|
+
--format FORMAT terminal | json | sarif | junit | markdown
|
|
124
|
+
--fail-below N Exit 1 if score < N (for CI/CD)
|
|
125
|
+
--fail-on-regression Exit 1 if new gaps vs baseline
|
|
126
|
+
--no-cache Skip scan model cache
|
|
127
|
+
```
|
|
128
|
+
|
|
129
|
+
### Other Commands
|
|
130
|
+
|
|
131
|
+
| Command | Description |
|
|
132
|
+
|---------|-------------|
|
|
133
|
+
| `serve [--port 8001]` | Start the web dashboard |
|
|
134
|
+
| `config show` | Show current configuration |
|
|
135
|
+
| `config set KEY VALUE` | Set a config value (e.g. `llm_api_key`, `llm_provider`) |
|
|
136
|
+
| `config path` | Print config file path |
|
|
137
|
+
| `frameworks` | List supported frameworks |
|
|
138
|
+
| `history [--repo PATH]` | Browse past scans |
|
|
139
|
+
| `diff SCAN1 SCAN2` | Compare two scans |
|
|
140
|
+
| `baseline --set ID` | Set compliance baseline |
|
|
141
|
+
| `cache stats\|clear` | Manage scan cache |
|
|
142
|
+
| `adapters list\|test\|ingest` | Manage audit log adapters |
|
|
143
|
+
| `activate KEY` | Activate Pro/Enterprise license |
|
|
144
|
+
| `deactivate` | Revert to free tier |
|
|
145
|
+
| `license` | Show current license status |
|
|
146
|
+
|
|
147
|
+
## API Reference
|
|
148
|
+
|
|
149
|
+
| Method | Endpoint | Description |
|
|
150
|
+
|--------|----------|-------------|
|
|
151
|
+
| `POST` | `/scan` | Start a scan |
|
|
152
|
+
| `GET` | `/scan/{id}` | Poll scan status |
|
|
153
|
+
| `GET` | `/scan/{id}/report` | Get report JSON |
|
|
154
|
+
| `GET` | `/scan/{id}/download?fmt=` | Download (json/sarif/junit/markdown/docx/zip) |
|
|
155
|
+
| `GET` | `/scan/{id}/regression` | Regression check |
|
|
156
|
+
| `GET` | `/scan/{id}/progress` | Progress polling |
|
|
157
|
+
| `GET` | `/history` | Scan history |
|
|
158
|
+
| `GET` | `/diff?scan1=&scan2=` | Diff two scans |
|
|
159
|
+
| `GET` | `/adapters` | List adapters |
|
|
160
|
+
| `POST` | `/adapters/{name}/test` | Test adapter |
|
|
161
|
+
| `POST` | `/adapters/{name}/ingest` | Ingest records |
|
|
162
|
+
| `GET` | `/adapters/{name}/records` | Query records |
|
|
163
|
+
| `GET` | `/posture` | All-framework posture |
|
|
164
|
+
| `GET` | `/posture/{framework}` | Three-layer posture |
|
|
165
|
+
| `POST` | `/baseline/{id}` | Set baseline |
|
|
166
|
+
| `GET` | `/frameworks` | List frameworks |
|
|
167
|
+
| `POST` | `/audit` | Predicate gap audit (free) |
|
|
168
|
+
| `GET` | `/matrix?frameworks=` | Cross-framework matrix |
|
|
169
|
+
| `GET` | `/license` | License status |
|
|
170
|
+
| `POST` | `/license/activate` | Activate license key |
|
|
171
|
+
| `GET` | `/health` | Health + version |
|
|
172
|
+
|
|
173
|
+
## CI/CD Integration
|
|
174
|
+
|
|
175
|
+
### GitHub Actions
|
|
176
|
+
|
|
177
|
+
```yaml
|
|
178
|
+
- uses: ./comply/ci/github-action.yml
|
|
179
|
+
with:
|
|
180
|
+
framework: eu-ai-act
|
|
181
|
+
fail-below: '50'
|
|
182
|
+
upload-sarif: true
|
|
183
|
+
post-comment: true
|
|
184
|
+
```
|
|
185
|
+
|
|
186
|
+
### GitLab CI
|
|
187
|
+
|
|
188
|
+
```yaml
|
|
189
|
+
include:
|
|
190
|
+
- local: comply/ci/gitlab-ci-template.yml
|
|
191
|
+
|
|
192
|
+
comply-scan:
|
|
193
|
+
extends: .comply-scan
|
|
194
|
+
variables:
|
|
195
|
+
COMPLY_FRAMEWORK: "eu-ai-act"
|
|
196
|
+
COMPLY_FAIL_BELOW: "50"
|
|
197
|
+
```
|
|
198
|
+
|
|
199
|
+
### Generic CI
|
|
200
|
+
|
|
201
|
+
```bash
|
|
202
|
+
# Score gate
|
|
203
|
+
bespoketracker-comply scan . --fail-below 50
|
|
204
|
+
|
|
205
|
+
# SARIF for code scanning
|
|
206
|
+
bespoketracker-comply scan . --format sarif -o ./reports
|
|
207
|
+
|
|
208
|
+
# Regression detection
|
|
209
|
+
bespoketracker-comply baseline --auto
|
|
210
|
+
bespoketracker-comply scan . --fail-on-regression
|
|
211
|
+
```
|
|
212
|
+
|
|
213
|
+
## Standalone vs Monorepo
|
|
214
|
+
|
|
215
|
+
Comply works in two modes:
|
|
216
|
+
|
|
217
|
+
- **Standalone** (`pip install bespoketracker-comply`): Uses a vendored pure-Python scanner. No Kuzu or monorepo dependencies.
|
|
218
|
+
- **Monorepo**: When run inside the BespokeTracker monorepo, uses the full Kuzu-based pipeline for richer analysis.
|
|
219
|
+
|
|
220
|
+
Auto-detected at runtime — no configuration needed.
|
|
221
|
+
|
|
222
|
+
## Self-Hosted: All Features Included
|
|
223
|
+
|
|
224
|
+
Comply is source-available under the BSL 1.1 license. All features — every framework, every scan depth, every export format — are included with no feature gates.
|
|
225
|
+
|
|
226
|
+
**Update Subscription** ($29-99/mo): Subscribers get continuous improvements to evidence evaluation, new framework support, and priority fixes via a private update channel. Public releases happen on major versions.
|
|
227
|
+
|
|
228
|
+
Configuration stored in `~/.comply/config.yaml`.
|
|
229
|
+
|
|
230
|
+
## Contributing
|
|
231
|
+
|
|
232
|
+
We welcome contributions! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
|
|
233
|
+
|
|
234
|
+
### Adding a New Framework
|
|
235
|
+
|
|
236
|
+
Framework definitions live in `data/frameworks.yaml` (CC-BY-4.0 licensed). To add a new framework:
|
|
237
|
+
|
|
238
|
+
1. Add the framework definition to `data/frameworks.yaml`
|
|
239
|
+
2. Map evidence functions in `_vendor/compliance_eval.py` `_EVIDENCE_FN_MAP`
|
|
240
|
+
3. Add tests in the test suite
|
|
241
|
+
4. Submit a PR
|
|
242
|
+
|
|
243
|
+
### Adding an Evidence Function
|
|
244
|
+
|
|
245
|
+
Evidence functions detect compliance-relevant patterns in codebases. See existing functions in `_vendor/compliance_eval.py` for the pattern.
|
|
246
|
+
|
|
247
|
+
## License
|
|
248
|
+
|
|
249
|
+
Business Source License 1.1. You may use Comply for any purpose including production, except offering a competing hosted compliance scanning service. Converts to Apache 2.0 on 2030-03-10. See [LICENSE](LICENSE) for details.
|
|
250
|
+
|
|
251
|
+
Framework definitions (`data/frameworks.yaml`) are licensed under CC-BY-4.0.
|