GRC Lake

Turn security evidence into traceable control assessments and reviewable audit workpapers. Open-source and self-hosted: read evidence from the systems and security lakes you already run, evaluate versioned control tests, and retain evidence and recorded review decisions alongside the results.

• Traceable: follow results to source records and rule versions, and inspect the recorded mapping decisions; snapshots form a hash-chained ledger you can re-verify.
• Works with what you have: connect cloud, identity, endpoint, and code systems directly, or query OCSF tables already in your lake.
• One control, many frameworks: reusable safeguards map to SOC 2, ISO 27001, NIST, and more, with reviewed and proposed mappings kept apart.

[Open the live demo →](https://koda-ai-studio.github.io/grc-lake/) Click through the console on recorded synthetic data. The hosted demo is read-only; it does not connect to your systems or establish live-provider coverage. Nothing to install.

Quick start · Product tour · Connect evidence · Already on OCSF? · Frameworks · Performance · Self-host · Docs

Quick start

Python 3.11+ and uv:

uvx --from "grc-lake[server]" grc-lake demo

This loads a synthetic company into a temporary lake, serves the console on localhost:8787 without authentication, and opens your browser. Ctrl+C stops it and deletes the lake. With pip: pip install "grc-lake[server]", then grc-lake demo.

First task: find a failing control, inspect its evidence and mapping, and export the frozen result: follow the sample-data tutorial, then the auditor workpaper example. Their CLI steps need the lake to outlive the demo, so start it with grc-lake demo --lake ./lake.

Exploring AI assets? The AI discovery walkthrough in 0.3.21 opens a synthetic model-and-agent inventory with one command, then follows recorded evidence into the graph and assessment.

For a real evaluation, follow the bounded pilot guide: one source, one independently checked result, then a repeat collection and review.

Use it in CI. From v0.3.24, one step posts a framework readiness table to the job summary and can gate the merge (CI gate).

- uses: koda-ai-studio/grc-lake@v0.3.26

with: grc-lake-url: ${{ secrets.GRC_LAKE_URL }} api-token: ${{ secrets.GRC_LAKE_API_TOKEN }}

Keep a lake, Docker, source development, or MCP

Keep a lake between runs:

grc-lake fixtures load --company golden --out ./lake --rebase-times

grc-lake serve --server --allow-insecure-no-auth --lake ./lake

Docker (public image, no registry login):

git clone --branch v0.3.26 --depth 1 https://github.com/koda-ai-studio/grc-lake.git

cd grc-lake && docker compose up

Current source, with uv and Node 22+:

git clone https://github.com/koda-ai-studio/grc-lake.git

cd grc-lake && uv sync --frozen --extra dev --extra server && make demo-local

MCP over stdio (headless GRC covers agent credentials):

pip install "grc-lake[server,mcp]"

GRC_LAKE_LAKE=./lake grc-lake-mcp

Release notes: changelog · verified release records.

Product tour

Collect → Evaluate → Resolve → Export. These console captures use the bundled synthetic company, refreshed for the 0.3.24 release candidate. They illustrate source behavior; see the release records for published-package verification.

Start with the assessment overview

Assessed coverage, open findings, evidence freshness, and priority actions in one view.

Explore framework coverage

Catalogued, mapped, reviewed, and assessed requirements stay separate measures per framework.

Inspect control results and evidence

Filter by result, owner, or framework; open a control for its evidence, findings, freshness, and confidence.

Navigate control families and the CCF

The Common Control Framework (CCF) organizes safeguards as category → family → safeguard. For example, Identity and access management (IAM) contains the Access review family, whose SG-IDENTITY-002 safeguard covers access review and recertification. Safeguards connect to framework requirements through a crosswalk. Proposed mappings are not attestable. The SG-… IDs are stable GRC Lake identifiers, not official framework control numbers or a substitute for the current family name. How common safeguards work.

Trace a finding through the evidence graph

Follow exact records between controls, safeguards, evidence, repositories, and assets; drill in or roll up through a bounded neighborhood. Inspect control-test results, evidence freshness, and linked findings with their owners and next actions. Recorded links and mapping review states stay distinct; a passing control test does not establish framework attestation.

For node labels and inspector details, open the full-size graph: light theme · dark theme.

Review AI assets and their next actions

Models and agents with owners, environments, governance signals, and next actions. Recorded lineage is evidence presence, not a passing control (AI inventory semantics).

Five-minute console tour · How evidence investigation works

Architecture

Read-only collection feeds deterministic evaluation; console, REST API, CLI, and MCP share one evidence and assessment model.

flowchart LR

Sources["Cloud · identity · code · existing lakes"] --> Collect["Read-only collection"] Collect --> Evaluate["Version-pinned control tests"] Evaluate --> Assessments["Assessment generations"] Assessments --> Review["Console · API · CLI · MCP"] Assessments --> Export["Snapshots · workpapers · OSCAL"]

Exports: portable CCF/OSCAL bundles, framework coverage reports, and verifiable auditor workpapers. Recovery behavior and API limits: architecture guide and assessment contract.

Connect evidence

Use direct connectors or read an existing lake. Both are read-only and keep assessment evidence in storage you operate.

Supported sources

Stages, permissions, and live receipts: connector catalog · qualification matrix. Missing a source? Request a connector or build one.

Already on OCSF?

If your telemetry is already normalized to OCSF, for example in Amazon Security Lake or OCSF tables on Databricks or Snowflake, point GRC Lake at those tables. K