Topics / #compliance

Compliance projects on GitHub

Security compliance auditing and policy enforcement tools for infrastructure.

As of , the most-starred Compliance projects on GitHub are Anthropic-Cybersecurity-Skills (34.6K stars), analytics (29.5K stars) and iFixAi (29.2K stars). GitHub.Locker tracks 31 Compliance repositories with 279.7K stars combined. The fastest-growing on October 17 was iFixAi, with +380 stars in a day.

31Projects
279.7KStars in total
+636Stars in a day
Browse in the catalog →github.com/topics/compliance ↗

Hot right now

Most stars gained in a day · Oct 17

+380

iFixAi

ifixai-ai/iFixAi · ★ 29.2K

iFixAi is an independent auditing tool for AI agents: it runs a diagnostic suite against your agent and answers the core question — is the agent doing the job it is supposed to do — with an A-F grade in under 120 seconds.

+49

legal-templates

General-Legal/legal-templates · ★ 3.2K

A free collection of attorney-drafted legal templates for startups and tech companies, covering contracts like NDAs, MSAs, privacy policies, and offer letters.

+43

Anthropic-Cybersecurity-Skills

mukul975/Anthropic-Cybersecurity-Skills · ★ 34.6K

An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.

+30

analytics

plausible/analytics · ★ 29.5K

Plausible Analytics is an open source, privacy-first web analytics tool — a lightweight, cookie-free Google Analytics alternative, offered as a managed cloud or a self-hosted Community Edition.

The all-time top

31 projects · by stars

  1. #1 · mukul975/Anthropic-Cybersecurity-Skills

    Anthropic-Cybersecurity-Skills

    An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.

    34.6K
  2. #2 · plausible/analytics

    analytics

    Plausible Analytics is an open source, privacy-first web analytics tool — a lightweight, cookie-free Google Analytics alternative, offered as a managed cloud or a self-hosted Community Edition.

    29.5K
  3. #3 · ifixai-ai/iFixAi

    iFixAi

    iFixAi is an independent auditing tool for AI agents: it runs a diagnostic suite against your agent and answers the core question — is the agent doing the job it is supposed to do — with an A-F grade in under 120 seconds.

    29.2K
  1. 4

    parlant

    18.3Kemcie-co/parlant · Python

    An open-source interaction control harness for building customer-facing AI agents that behave consistently, compliantly, and traceably — support, sales, onboarding — positioned as an open-source alternative to Ada, Decagon, or Sierra.

  2. 5

    wazuh

    17.3Kwazuh/wazuh · C++

    Wazuh is a free, open source security platform (XDR and SIEM) for threat prevention, detection and response across on-premises, virtualized, containerized and cloud workloads.

  3. 6

    lynis

    16.5KCISOfy/lynis · Shell

    Lynis is a security auditing and hardening tool for Linux, macOS, BSD, and other Unix-like systems. It scans the host it runs on for vulnerable software, misconfigurations, and weak settings, and gives hardening tips while also assisting with compliance testing (HIPAA, ISO27001, PCI DSS).

  4. 7

    prowler

    15.1Kprowler-cloud/prowler · Python

    Prowler is an open-source cloud security platform that automates security and compliance checks across AWS, Azure, GCP, Kubernetes, M365, GitHub, and many other providers.

  5. 8

    bytebase

    14.6Kbytebase/bytebase · Go

    Bytebase is an open-source database governance platform that acts as a control plane between users (humans and AI agents) and databases, governing change management, access control, and compliance so every change and query is reviewed, controlled, and recorded.

  6. 9

    QuestPDF

    14.2KQuestPDF/QuestPDF · C#

    QuestPDF is a modern C# library for generating PDF documents — reports, invoices, exports — by writing strongly-typed, fluent C# code instead of fighting with HTML-to-PDF conversion.

  7. 10

    opa

    12.4Kopen-policy-agent/opa · Go

    OPA (Open Policy Agent) is an open source, general-purpose policy engine that lets you enforce policies — like 'can user X do Y on resource Z?' — consistently across your whole stack via a declarative policy language called Rego.

  8. 11

    kubescape

    11.8Kkubescape/kubescape · Go

    Kubescape is an open-source Kubernetes security platform that scans clusters, YAML files, Helm charts, and container images for misconfigurations and vulnerabilities, covering the whole lifecycle from development to runtime.

  9. 12

    presidio

    11.4Kdata-privacy-stack/presidio · Python

    An open-source framework (SDK) that detects, redacts, masks and anonymizes sensitive data (PII) — names, credit card numbers, SSNs, phone numbers — in text, images and structured data.

  10. 13

    the-practical-linux-hardening-guide

    10.9Ktrimstray/the-practical-linux-hardening-guide

    A free, practical guide to hardening GNU/Linux servers for production. It offers step-by-step instructions built on industry standards (CIS, STIG, NIST) and OpenSCAP baselines.

  11. 14

    claude-for-legal

    9.7Kanthropics/claude-for-legal · Python

    Claude for Legal is Anthropic's suite of Claude plugins — reference agents, skills, and data connectors — for common legal workflows across in-house, firm, and legal-education practice areas such as commercial, privacy, product, corporate, employment, litigation, regulatory, AI governance, and IP.

  12. 15

    utopia

    8.4Kdeeplethe/utopia · Rust

    Utopia is an open-source enterprise world model from DeepLethe: a self-hosted knowledge system that turns documents into a bitemporal knowledge graph you can search, chat with and reason over, running entirely on hardware you control.

  13. 16

    chinese-buy-us-stock-guide

    7.7Kzgwl/chinese-buy-us-stock-guide

    It's a guide written for mainland Chinese investors explaining how to buy US stocks: opening bank and broker accounts, understanding tax rules, staying compliant, picking a broker, and moving money in and out of the US.

  14. 17

    agent-governance-toolkit

    6.4Kmicrosoft/agent-governance-toolkit · Python

    A toolkit from Microsoft that governs autonomous AI agents in production: it enforces policies on tool calls, verifies agent identity, sandboxes execution, and provides SRE controls like kill switches and SLO monitoring. It covers all 10 of the OWASP Agentic Top 10 risks.

  15. 18

    cli

    5.2Kentireio/cli · Go

    Entire is a CLI that hooks into your Git workflow to capture AI coding agent sessions (prompts, responses, files touched) and indexes them alongside your commits, creating a searchable record of how code was written.

  16. 19

    legal-templates

    3.2KGeneral-Legal/legal-templates · Python

    A free collection of attorney-drafted legal templates for startups and tech companies, covering contracts like NDAs, MSAs, privacy policies, and offer letters.

  17. 20

    gitagent

    717open-gitagent/gitagent · Rust

    Gitagent is a git-native AI agent framework where an agent's identity, rules, memory, tools, and skills all live as version-controlled files inside a git repository, so you can fork an agent, branch its personality, and diff its rules like any other repo.

  18. 21

    agent-safe-pipeline

    688decionis/agent-safe-pipeline · TypeScript

    Agent-Safe Pipeline is a reference implementation of an 'Execution Authority' architecture that sits between AI agents or APIs and consequential HTTP actions: it intercepts the action, asks Decionis whether it is authorized, and only forwards it if a single-use grant is issued, otherwise holding it for a human or refusing it, with every decision leaving tamper-evident evidence.

  19. 22

    Trenova

    330emoss08/Trenova · Go

    Trenova is an open-source (Fair Source) Transportation Management System for small and mid-sized US trucking carriers, covering the full order-to-cash cycle: shipment entry, dispatch, rating, billing, accounting, EDI, and FMCSA compliance.

  20. 23

    awesome-agent-skills-security

    262LLMSecurity/awesome-agent-skills-security

    A curated, awesome-list style collection of research papers, standards, frameworks, and benchmarks about securing AI agent tool use and the emerging 'agent skills' ecosystem — covering attacks like prompt injection and tool poisoning as well as defenses like sandboxing and permission control.

  21. 24

    vps-security-enhancement-scripts

    2390x10debug/vps-security-enhancement-scripts · Shell

    It is a security-first interactive bash script for hardening a fresh VPS or cloud server, bundled with a scenario-driven handbook and printable cheatsheets that explain why each fix matters, not just how to run it.

  22. 25

    Claude-AD

    212ADScanPro/Claude-AD

    Claude-AD is a Claude Code plugin that gives Claude the methodology for an internal Active Directory penetration test: skills, agents and slash commands covering Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay and delegation abuse, each with OPSEC and telemetry notes.

  23. 26

    CodeMason

    176mufengyuan6/CodeMason · Python

    CodeMason (编舟) is an autonomous coding agent in the same class as Claude Code or Cline: it understands a requirement, plans, edits code, verifies the result and delivers it, running the whole loop on its own. It is built around the idea that state is never saved — everything is derived from an append-only event log, so every change can be replayed, rolled back or audited.

  24. 27

    software-certificate-skill

    164IvanCodesDev/software-certificate-skill · Python

    A Skill that automatically generates the materials needed to register a Chinese software copyright (软件著作权): an application form, user manual, technical documentation, and code material, built from real analysis of your project and delivered as checked DOCX and PDF files.

  25. 28

    ZizkaDB

    145ZIZKA-AI-SL/ZizkaDB · Python

    ZizkaDB is an audit trail database built for AI agents. It logs every agent decision with a SHA-256 checksum and a causal link back to what caused it, so you can replay sessions and time-travel to see exactly what the agent knew at any past moment, supporting EU AI Act Article 12 record-keeping.

  26. 29

    GrantDecay

    127rojiloro/GrantDecay · Python

    GrantDecay is a CLI that compares what each principal was granted against what it actually used over an observation window, and reports unused permissions, narrowable roles, dormant principals, and ungranted use.

  27. 30

    datamimic

    116rapiddweller/datamimic · Python

    DATAMIMIC CE is an open-source, MIT-licensed Python engine that generates deterministic synthetic test data from declarative models — no source data required — and can also pseudonymize real staging or QA exports. It is the free core of the commercial DATAMIMIC Enterprise Platform, aimed at regulated industries.

  28. 31

    transition-state-zero-trust-toolkit

    114theycallmehassan1/transition-state-zero-trust-toolkit

    A set of open, vendor-neutral worksheets, checklists, test records and pilot artifacts for governing the messy middle period of a zero trust migration, built to complement NIST SP 1800-35.

Often tagged together