Security graph, drawn and queryable
Postgres · 20 typed edgesA seeded multi-cloud estate — resources, identities, relationships — rendered as an interactive canvas. Columns are accounts; every edge is a way risk travels.
Find the paths that
actually reach your data.
CloudLoom weaves resources, identities and findings into one security graph, then shows which combinations an attacker could walk. Today it runs as a fully working console on a realistic simulated cloud — built to explore, learn from, and extend toward live clouds.
Honest scope: no live AWS/Azure/GCP connections yet — connectors are roadmap item #1.
quickstartbash — 80×24
$ git clone https://github.com/aryamthecodebreaker/CloudLoom.git
$ cd CloudLoom && cp .env.example .env
$ npm install
$ npm run db:push && npm run db:seed # schema + demo estate
$ npm run dev
✓ ready in under two minutes
→ http://localhost:3000/consoleNo signup. No cloud credentials. Seeded data only.
What ships today.
Four things, working right now in this repo. No vaporware list — each one is backed by tables you can open and inspect.
Triage that survives a refresh
Controls → issues · persistedRules evaluate against the graph into prioritized issues. Move one through OPEN, IN_PROGRESS, RESOLVED or REJECTED and it stays moved — the database is the source of truth.
Attack paths, hop by hop
Toxic combinationsInternet exposure plus a flaw plus an over-scoped role plus sensitive data is one walkable path. CloudLoom draws the hops and names the one that breaks the chain.
The paperwork views
Inventory · CVEs · complianceResource catalog across five modeled providers, exploited-in-the-wild CVE view, and framework posture computed from the same tables you can open yourself.
CL-1042 · break any single hop and the path collapses — the console names which one to cut first.
Then the road to live clouds.
We won't pretend the rest exists. This is the build order — each step lands against schema headroom that already exists.
Claim an issue →- 01
Live cloud connectors
Read-only AWS / Azure / GCP ingestion via the Go agent
- 02
Real IAM & resource graphs
Your estate, not the seed
- 03
Telemetry-driven attack paths
Live network and identity edges
- 04
CVE scanning
Actual package detection against workloads
- 05
Runtime monitoring
eBPF sensor signals
- 06
Multi-tenancy & RBAC
Teams, projects, scoped access
- 07
Red · Blue · Green agents
Simulation, investigation, remediation
The datasheet.
- License
- Apache-2.0 — every line yours
- Stack
- Next.js 14 · TypeScript strict · Prisma v5
- Database
- Any Postgres (Supabase-ready)
- Demo estate
- 22 resources · 5 providers · 20 edges
- Connectors
- Go agent scaffolded — roadmap #1
- Cost
- $0. No tier, no gate, no telemetry home.
The uncomfortable questions.
Is CloudLoom connected to my cloud?+
No — and it never touches a real account in its current form. The console ships with a richly seeded simulated environment so every screen is explorable without credentials, risk, or setup.
So what exactly is it today?+
A working open-source blueprint of a CNAPP: the data model, the security-graph queries, the triage workflow, and the visual language — implemented end to end against Postgres and ready to be pointed at real telemetry.
Why start with simulation instead of scanners?+
Because the hard problem in cloud security tooling isn't reading data — it's turning findings into decisions. Building the decision layer first means connectors, when they land, plug into something already worth using.
Is it really 100% free?+
Yes. Apache-2.0 licensed, no gated features, no paid tier, no telemetry home. Clone it, run it anywhere Node runs, own every byte.
Walk the graph yourself.
A fully seeded environment is waiting — attack paths, triage, compliance. No signup, no credentials, no risk.