probo

Probo is an open-source governance, risk, and compliance (GRC) platform aimed at engineering and security teams. It is self-hostable and MIT licensed, and it covers the GRC lifecycle from risk identification through control tracking, vendor risk, data privacy, access reviews, audit programs, and document approval workflows. Every entity in the platform is reachable through several interfaces: a web console, a `prb` CLI with 44+ command groups, a Model Context Protocol (MCP) API, and a GraphQL API. The project describes itself as AI-native, exposing 270+ MCP tools so that MCP-compatible LLM agents can read and write GRC data, draft policies, run risk assessments, and generate evidence packs. An n8n community node (`@probo/n8n-nodes-probo`) allows no-code automation over the GraphQL API. Capability areas listed in the README include: - Risk management: risk register, inherent/residual scoring, treatment strategies (mitigate, accept, avoid, transfer), threat-based assessments. - Controls and frameworks: control library with maturity levels, custom framework import/export, Statement of Applicability. - Vendor / third-party risk: vendor inventory, automated website risk assessment, DPA/BAA tracking, subprocessor discovery. - Data privacy: DPIA, Transfer Impact Assessments, processing activity records, data inventory, rights requests (SAR/erasure). - Access reviews: campaign management, per-entry decisions, integration with SaaS, cloud infrastructure, and source code sources. - Audit programs: scoping, control mapping, finding tracking, report generation. - Evidence and measures: evidence collection from files and URLs, implementation state tracking, task assignment. - Document management: versioned documents, approval quorums, electronic signatures, PDF export, bulk operations. - Compliance page: public portal, NDA management, certification publishing, custom domain support. - Cookie and consent: cookie banner management, tracker detection, consent records. The README also mentions audit-oriented features such as policy-based RBAC, immutable audit logs, electronic document sign-off workflows, and evidence chains. Quick start requires Go 1.27+, Node.js 24.15+, npm 12.0.2+, Docker, and mkcert. Setup involves cloning with submodules, downloading Go modules and npm dependencies, starting infrastructure services with `make stack-up`, building with `make build`, generating a dev config, and running `bin/probod -cfg-file cfg/dev.yaml`. The web console then runs at `http://localhost:8080`. The tech stack is Go and PostgreSQL on the backend, GraphQL and MCP for APIs, React/TypeScript/Relay/TailwindCSS on the frontend, Docker and GitHub Actions for infrastructure, and OpenTelemetry, Grafana, Prometheus, Loki, and Tempo for observability. Contributions are accepted with DCO sign-off and no CLA; security issues should be reported by email rather than public issues. Community channels include Discord, documentation, blog, Twitter/X, and LinkedIn.