Audit-ready compliance evidence from one read-only scan — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2, mapped from a single pass across AWS, Azure and GCP. 56 plugins, built on an open-source core. Runs entirely on your infrastructure — zero data exfiltration by architecture. Now the cloud inventories an Enterprise scan could not read in full — GCP instances, Azure virtual machines, the AWS EC2 feed of the CIS hardened-image census — are evidence gaps, not empty projects or subscriptions.
The cloud-audit + compliance engine shown above is NSAuditor AI Enterprise · Community Edition is free forever, MIT licensed
Runs entirely on your machine. No cloud. No telemetry. License validation is offline. We can't see your data because we never touch it.
Findings are risk-scored and ranked so you fix what matters first. Suppress accepted-risk or false-positive findings with the operator workflow — your triage decisions persist across scans.
OpenAI, Claude, or Ollama (fully local). Compliance reports, remediation guidance, risk prioritization. Your API keys, your data.
27 CE plugins: Ports, SSH, HTTP, TLS, DNS, SNMP, SMB, RPC, mDNS, UPnP, and more. 29 EE plugins, of which 28 are cloud auditors: AWS S3, GCP, Azure, IAM Deep Auditor, CloudTrail, API Gateway, DynamoDB, KMS, Lambda, Secrets+SSM, CodePipeline, IAM Decrypt-Path, S3 Lifecycle, AWS Backup, RDS, SES, VPC/PrivateLink, EC2 SG, ElastiCache, Inspector2/GuardDuty, plus dedicated Azure Storage / NSG perimeter / Key Vault deep auditors, and more. The 29th, Zero Trust Assessment, is not a cloud auditor — it scores zero-trust posture from a network-host scan and calls no cloud API.
SOC 2 (AICPA TSC 2017), HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, GDPR Article 32 (Security of Processing), and NIST SP 800-171 Rev 2 — all from one scan. Sub-requirement-level mapping for QSA RoC workflow. Customized Approach eligibility read from each requirement's own objective cell, identifiers derived from the standard. CHD Scope operator-attested. ISO 27001 Statement of Applicability discipline. CIS Implementation Group cumulative discipline (IG1 cyber-insurance baseline). GDPR Article 32 is an infrastructure substrate for Art. 32 only (4 covered + 5 partial + 2 OOS across 11 sub-measure units) — NOT GDPR compliance. Auditor-ready evidence packs with SHA-256 chain-of-custody. No BAA with Nsasoft required.
The MCP server ships free in the Community Edition — drive NSAuditor from Claude Desktop, Claude Code, Cursor, or any MCP-aware agent. Run nsauditor-ai mcp install-key and paste the mcpServers block it prints into your claude_desktop_config.json (it names node and the server script by absolute path), or in Claude Code: claude mcp add nsauditor-ai --env NSA_MCP_AUTH_KEY=<from: nsauditor-ai mcp install-key> -- nsauditor-ai-mcp. Then install the optional agent skill so the assistant knows NSAuditor's tools, schemas, and audit workflows — in Claude Desktop: Skills → Create skill → Upload a skill (upload SKILL.md). Then just ask: "audit my AWS account."
A scan that could not read part of your cloud should not read as clean. Node.js 24.22.1 or newer is the supported runtime — the October 2026 Node.js security release for the 24 line. The cloud inventories the scan could not read in full — GCP instances, Azure virtual machines, the AWS EC2 feed of the CIS hardened-image census — are evidence gaps, not empty projects or subscriptions, and a listed AWS region the account has not enabled is skipped and recorded as not enabled, not reported as missing trails or as a permission to grant, wherever the account’s enabled regions can be read. Through the MCP server (Community 1.1.0), a host scan stops at a total time limit by default and names the plugins it did not run, a response saved with NSA_MCP_RESPONSE_DIR keeps its request beside it for verify-call, and a CRITICAL, HIGH or evidence-gap title in scan_cloud says when its finding holds more than it shows. See Enterprise →
Node.js 24.22.1. Of the ten CVEs the October 2026 Node.js advisory lists, eight name the 24.x line, four of them high, among them a Brotli decoder out-of-bounds write (CVE-2026-111497). Below 24.22.1 a scanned host that answers with crafted Brotli reaches that decoder, because Community’s web-application detector, its UPnP device-description fetch and plugin 050 read a target’s HTTP bodies through Node’s fetch. Reachable is not exploited. Unread inventories are evidence gaps (Enterprise). When the GCP security audit (1021), the Azure security audit (1022) or the EC2 instance auditor (1210) could not read its instance or VM inventory in full, the CIS hardened-image census used to read as complete; each now records one evidence gap that fails CIS v8 Safeguards 4.1, 4.2 and 4.6, with its cause as a class, never error text, and the CIS report names which cloud’s inventory is short and why. Regions the account has not enabled. Wherever ec2:DescribeRegions can be read, an all-regions AWS scan walks the regions the account has enabled, for every AWS plugin; a listed region the account has not enabled is not called but recorded as not enabled, an evidence gap, instead of an access-denied finding that told the operator to grant the audit role, and CloudTrail no longer reports, at CRITICAL, no trails visible in a region it never read. No subscription or project? The scan says why. An Azure scan with no subscription id reports its four plugins down with the cause, so Azure no longer reads as audited; a GCP scan with no project or no loadable credentials reports the GCP security audit down with its cause, so its controls fail closed as not measured. The MCP server (Community 1.1.0): scan_host stops at a total time limit (SCAN_HOST_WALL_MS, 50 seconds by default) and names the plugins it did not run. With NSA_MCP_RESPONSE_DIR set, each saved response keeps its request beside it, and nsauditor-ai mcp verify-call checks both. A scan_cloud CRITICAL, HIGH or evidence-gap title ends (+N more via get_findings) when its finding holds more entries than the title shows, and a get_findings category filter that matches nothing returns the categories the scan does hold. Lost measurement per scanner (Enterprise, the drift file): a control is named as having lost measurement from each scanner that stopped measuring it, with the scanners named in sources, so a second gap on a control that already carried one is no longer silent. Current SDKs: the 31 AWS SDK clients are locked at one version, and the Google Cloud and Azure SDKs move to their current majors.
Where it stops, stated: when ec2:DescribeRegions is denied, the enabled set is unknown, so a listed region is scanned as before. While a census gap from 1021, 1022 or 1210 stands, Community’s report --since sets aside that plugin’s rows, so a new CRITICAL from the same plugin does not read as new in that comparison. A GRC push sends a census gap as a failed control, and scan_cloud lists the new gaps without their cause, which is in the compliance pack only. Lost measurement is judged per scanner, not per scope: a scanner whose gap on a control widens does not lose measurement there again. The two measured limits stated since Enterprise 1.3.0 still hold: a scan made before 1.3.0 could not record a plugin left out of it, and a scan that found its ports with the Nmap plugin (024) alone has no port oracle, so include the port scanner (003) in the scans you compare.
Upgrade both packages together: Enterprise 2.1.0 runs on Node.js 24.22.1 or newer and still requires Community 1.0.0 or newer; install Community 1.1.0 with it for the MCP changes — npm i -g nsauditor-ai@1.1.0 @nsasoft/nsauditor-ai-ee@2.1.0. Install Node.js 24.22.1 or newer first: on an older runtime npm prints an EBADENGINE warning and installs anyway, and the air-gap install.sh refuses. Enterprise 2.1.0, like 2.0.0, imports a name that first ships in Community 1.0.0; below it Enterprise’s core does not load while its plugins still do — on Community 0.2.57 as on 0.2.56 — so the scan skips its intelligence, analysis-agent and compliance stages. Do not name an older Community in the same npm install -g command as Enterprise: npm then nests a second Community under Enterprise, and Enterprise’s stages are skipped with no message and no compliance report. Install the paired versions together, or Community first. Compared across the upgrade, a GCP evidence gap from 2.0.0 reads resolved and a new one opened, once: its sentence no longer carries the error text. Coverage: all eight coverage matrices unchanged since EE 2.0.0. 29 Enterprise auditors (28 cloud auditors + 1 non-cloud), 56 plugins overall; floor CE ≥ 1.0.0. Release notes live in the package CHANGELOG.md.
report --from <dir> --format executive → self-contained executive HTML, or --format jira → a Jira-importer CSV