Probo

Open-source GRC platform for engineers.

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. It covers the full GRC lifecycle: risk identification, control tracking, vendor risk, data privacy, access reviews, audit programs, and document approval workflows. Every entity is accessible through a web console, a CLI, a Model Context Protocol (MCP) API, and a GraphQL API, so you can automate compliance work from code, scripts, or any LLM agent.

📖 Documentation: probo.com/docs

Why Probo?

• AI-native by design. 270+ MCP tools expose every entity and operation. Any MCP-compatible LLM agent can read and write your GRC data, draft policies, run risk assessments, and generate evidence packs.
• Full GRC coverage. Risk management, controls, vendor risk, data privacy (DPIA/TIA), access reviews, audit programs.
• Multiple interfaces. Web console, prb CLI (44+ command groups), MCP API, GraphQL, and an n8n community node for no-code automation.
• Open source and self-hostable. MIT licensed. Run it on your own infrastructure with Docker.
• Audit-ready. Policy-based RBAC, immutable audit logs, electronic document sign-off workflows, and evidence chains.

Capabilities

Interfaces

Web console

The primary interface for day-to-day GRC work. Runs at http://localhost:8080 in development.

CLI (prb)

A fully-featured command-line client for scripting, automation, and CI/CD integration. Covers all 44+ resource types available in the web console.

# Authenticate
prb auth login

# List open risks
prb risk list

# Create an internal control and link evidence
prb internal-control create --name "MFA enforced on all production systems" --category "Security"
prb evidence upload ./screenshot.png --internal-control 

# Manage vendor compliance
prb thirdpartymgmt vendor list
prb thirdpartymgmt risk-assessment create --vendor 

Run prb help or see the CLI documentation for the full command reference.

MCP API

Probo exposes 270+ MCP tools covering every entity and operation in the platform. Any MCP-compatible LLM agent (Claude, Cursor, Continue, and others) can connect directly and interact with your compliance data.

See the MCP documentation for setup guides per client. The full MCP specification is at pkg/server/api/mcp/v1/specification.yaml.

n8n node

The @probo/n8n-nodes-probo community node brings Probo into n8n workflows for no-code automation of compliance tasks over the GraphQL API. See the n8n documentation.

Quick Start

To run Probo in production, follow the self-hosting guide (Docker Compose or Kubernetes). The steps below set up a local development environment.

Prerequisites

Steps

# 1. Clone with submodules
git clone --recurse-submodules https://github.com/getprobo/probo.git
cd probo

# 2. Install dependencies
go mod download
npm ci

# 3. Start infrastructure services (PostgreSQL, object storage, etc.)
make stack-up

# 4. Build
make build

# 5. Generate the local dev config
make dev-config

# 6. Run the server
bin/probod -cfg-file cfg/dev.yaml

The web console is available at http://localhost:8080.

See CONTRIBUTING.md for the full development environment walkthrough, including the frontend dev server and code generation steps.

Tech Stack

Contributing

Contributions are welcome. Read CONTRIBUTING.md before opening a pull request. All commits require a Developer Certificate of Origin (DCO) sign-off (git commit -s). No CLA required.

To report a security vulnerability, email [email protected] rather than opening a public issue. See SECURITY.md for the full disclosure policy.

Community

• Documentation - Product guides, self-hosting, CLI, MCP, and API reference
• Discord - Get help, share feedback, and talk to the team
• Blog
• Twitter / X
• LinkedIn
• Website

Thanks

The local Go cache actions use the cache strategy from CloudX. See Scaling Golang CI by Replacing actions/setup-go and cloudx-io/setup-go. Thank you to Lukas Schwab, Peter Downs, and the CloudX team.

The local stack runs fakecloud so AWS workload identity can be tried without an AWS account. See faiscadev/fakecloud. Thank you to the fakecloud team.

License

Probo is MIT licensed.