CRAne

Compliance evidence and audit workflow platform. It tracks which products and components exist, how they relate, who owns them, whether they are in scope under each definition, and whether their evidence holds up.

Install For AI agents

---

It exists to answer questions that are usually spread across several systems and several spreadsheets: how many products there are, how many components, which components ship in more than one product, which pipelines build what, which products are in scope under whose definition, which have an SBOM, whether that SBOM is any good, and where the whole effort actually stands.

Sixty seconds

You need Docker. Nothing else, and no checkout of anything.

mkdir -p crane/data && cd crane

# The directory has to be writable by the container's user, so hand it your own uid.
docker run --rm -v "$PWD/data:/data" --user "$(id -u):$(id -g)" \
    ghcr.io/oscarvalenzuelab/crane:latest init

# Eight invented products, chosen to show the situations this exists for.
docker run --rm -v "$PWD/data:/data" --user "$(id -u):$(id -g)" \
    ghcr.io/oscarvalenzuelab/crane:latest demo

docker run --rm -p 127.0.0.1:8000:8000 -v "$PWD/data:/data" \
    --user "$(id -u):$(id -g)" -e CRANE_ALLOW_UNAUTHENTICATED_BIND=1 \
    ghcr.io/oscarvalenzuelab/crane:latest serve --host 0.0.0.0 --port 8000 --worker

Open http://127.0.0.1:8000. Everything after this is the same tool with your data in it instead of the invented portfolio, which Populate covers.

The database is a single SQLite file at data/crane.db. Open it with any SQLite browser. That is deliberate: nothing here is locked inside a format only this tool can read.

The overview is the consolidated pane: every obligation at once. Every other page works one obligation at a time, chosen in the header and carried in the URL, so a filtered view is a link you can send someone.

Why it is shaped this way

Nothing is a tree. A component ships in many products. A product is bundled inside another product. A component has several pipelines, or none. One pipeline feeds several components. The model is a graph with typed, provenance carrying edges, and fan in and fan out are the same mechanism read in opposite directions.

Several organizations disagree about what a product is. The ship room, legal, the commercial catalog, and the regulatory reading each have their own definition, and they are not going to be reconciled before the inventory has to exist. Each is a lens. A product can be in scope under one and out of scope under another, and both statements are kept. Every reported number names the lens it used.

Obligations are plural. The CRA is the first policy, not the shape of the system. FedRAMP and the NTIA minimum elements ship alongside it, each with its own checks, weights and reporting lens. Adding another obligation is a policy row and a profile file, not a code change.

A source fact is not a decision. Everything imported lands as an observation needing review. Approving something is a separate, recorded act with an authority and a rationale. A lower authority claim never silently overwrites a higher authority one, and conflicts are retained and surfaced rather than merged away.

It stands on its own

CRAne assumes nothing about which build system, product catalog or ownership directory you use. A fresh install has no adapter and no imported data. It is populated through crane import data, which takes CSV or JSON, and it works that way permanently if that is all you need. crane import spec --json prints the contract, so whatever is producing the files, a person or an agent, can read the format rather than guess it.

Connecting a source system is optional and additive, and published images deliberately carry no adapters at all: each one describes somebody else’s system. See Adapters.

Where to go

You want to	Page
Get it running	Install
See it working before feeding it anything	First run
Put your own portfolio in	Populate
Validate, score, report, schedule	Operate
Environment variables, authentication, exposure	Configure
Drive it from Copilot or another agent	For AI agents
Every command, route and column	Data contract, Interface contract
Something is broken	Troubleshooting
Report a vulnerability, or harden a real deployment	Security

Licence

Apache-2.0. The full text and the attribution notice travel inside the image, at /app/LICENSE and /app/NOTICE.