Audit-ready compliance evidence from one read-only scan — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2, mapped from a single pass across AWS, Azure and GCP. 56 plugins, built on an open-source core. Runs entirely on your infrastructure — zero data exfiltration by architecture. Enterprise 2.1.1: the GCP Cloud Storage and IAM auditors report themselves down, with the cause, when no project is set or no usable credential loads; Community 1.1.1 moves to openai 7 with one zod and says when an AI assessment covers only part of the scan.
The cloud-audit + compliance engine shown above is NSAuditor AI Enterprise · Community Edition is free forever, MIT licensed
Runs entirely on your machine. No cloud. No telemetry. License validation is offline. We can't see your data because we never touch it.
Findings are risk-scored and ranked so you fix what matters first. Suppress accepted-risk or false-positive findings with the operator workflow — your triage decisions persist across scans.
OpenAI, Claude, or Ollama (fully local). Compliance reports, remediation guidance, risk prioritization. Your API keys, your data.
27 CE plugins: Ports, SSH, HTTP, TLS, DNS, SNMP, SMB, RPC, mDNS, UPnP, and more. 29 EE plugins, of which 28 are cloud auditors: AWS S3, GCP, Azure, IAM Deep Auditor, CloudTrail, API Gateway, DynamoDB, KMS, Lambda, Secrets+SSM, CodePipeline, IAM Decrypt-Path, S3 Lifecycle, AWS Backup, RDS, SES, VPC/PrivateLink, EC2 SG, ElastiCache, Inspector2/GuardDuty, plus dedicated Azure Storage / NSG perimeter / Key Vault deep auditors, and more. The 29th, Zero Trust Assessment, is not a cloud auditor — it scores zero-trust posture from a network-host scan and calls no cloud API.
SOC 2 (AICPA TSC 2017), HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, GDPR Article 32 (Security of Processing), and NIST SP 800-171 Rev 2 — all from one scan. Sub-requirement-level mapping for QSA RoC workflow. Customized Approach eligibility read from each requirement's own objective cell, identifiers derived from the standard. CHD Scope operator-attested. ISO 27001 Statement of Applicability discipline. CIS Implementation Group cumulative discipline (IG1 cyber-insurance baseline). GDPR Article 32 is an infrastructure substrate for Art. 32 only (4 covered + 5 partial + 2 OOS across 11 sub-measure units) — NOT GDPR compliance. Auditor-ready evidence packs with SHA-256 chain-of-custody. No BAA with Nsasoft required.
The MCP server ships free in the Community Edition — drive NSAuditor from Claude Desktop, Claude Code, Cursor, or any MCP-aware agent. Run nsauditor-ai mcp install-key and paste the mcpServers block it prints into your claude_desktop_config.json (it names node and the server script by absolute path), or in Claude Code: claude mcp add nsauditor-ai --env NSA_MCP_AUTH_KEY=<from: nsauditor-ai mcp install-key> -- nsauditor-ai-mcp. Then install the optional agent skill so the assistant knows NSAuditor's tools, schemas, and audit workflows — in Claude Desktop: Skills → Create skill → Upload a skill (upload SKILL.md). Then just ask: "audit my AWS account."
The GCP Cloud Storage (1024) and IAM (1025) auditors report themselves down, with the cause, when no GCP project is set or no usable credential loads, as the GCP security audit (1021) does. Community 1.1.1 moves its OpenAI client to openai 7, so a project that depends on it holds one zod at 4.6.6 or later, with no overrides; its AI stage says at the head of the assessment when the provider reports reading less than half of the input, by the stage’s own estimate; a tier denial names the tools the caller can use now; and nsauditor-ai license with an unknown subcommand, or none, exits 2. Enterprise 2.1.1 is a patch release: no plugin added or removed, and no coverage-matrix, peer-floor or Node.js runtime change. See Enterprise →
GCP plugins that report themselves down (Enterprise). With no GCP project set, or no usable credential, 1024 and 1025 return up: false with the cause 1021 gives, and call no API. In 2.1.0 they reported themselves up, and with credentials but no project named, 1024 could audit whatever project Google’s client library found on its own. The controls they map fail closed as not measured. openai 7 and one zod (Community 1.1.1). A project that depends on Community holds one zod at 4.6.6 or later, with no overrides, and no node-domexception from Community. The AI stage was run end to end on openai 7 against OpenAI and a local Ollama model before the release. A partial AI read is stated (Community 1.1.1). When the provider reports reading less than half of the input, by the CLI’s own estimate, the assessment files open with one line saying the assessment covers part of the scan, and the JSON response and the run record carry both numbers. A local Ollama model with default settings read about a tenth of a host scan. Tier denials name what you can use (Community 1.1.1). compliance_matrix without the Enterprise package names the licence it needs instead of an install command that fails, and nsauditor-ai license with an unknown subcommand, or none, exits 2. The 2.1.1 air-gap carrier ships Enterprise 2.1.1 with Community 1.1.1; replace a 2.1.0 carrier with it. The agent skill 1.1.2 teaches the release.
Where it stops, stated: without impersonation, resolving a GCP credential fetches no token: a key file that loads but is revoked, or a principal without the IAM permission, still fails at the first call and stays a LOW evidence gap with up: true. The partial-read check estimates input as characters ÷ 4 for every provider, and the threshold was not measured on the Claude provider. With Community 1.1.0, which Enterprise 2.1.1 still accepts, a project root still holds zod 3.25.76: install Community 1.1.1 with it. The two measured limits stated since Enterprise 1.3.0 still hold: a scan made before 1.3.0 could not record a plugin left out of it, and a scan that found its ports with the Nmap plugin (024) alone has no port oracle, so include the port scanner (003) in the scans you compare.
Upgrade both packages together: Enterprise 2.1.1 runs on Node.js 24.22.1 or newer and still requires Community 1.0.0 or newer; install Community 1.1.1 with it — npm i -g nsauditor-ai@1.1.1 @nsasoft/nsauditor-ai-ee@2.1.1. Install Node.js 24.22.1 or newer first: on an older runtime npm prints an EBADENGINE warning and installs anyway, and the air-gap install.sh refuses. Enterprise 2.1.1, like 2.1.0 and 2.0.0, imports a name that first ships in Community 1.0.0; below it Enterprise’s core does not load while its plugins still do — on Community 0.2.57 as on 0.2.56 — so the scan skips its intelligence, analysis-agent and compliance stages. Do not name a Community older than 1.0.0 in the same npm install -g command as Enterprise: npm then nests a second Community under Enterprise, and Enterprise’s stages are skipped with no message and no compliance report (measured on 2.1.0). Install the paired versions together, or Community first. An estate scanned with 2.1.0 and then with 2.1.1 with no GCP project or no usable credential: the earlier scan’s 1024 and 1025 violations are withheld from MTTR closure, and the drift file lists them as could not measure, never as cleared. Coverage: all eight coverage matrices unchanged since EE 2.1.0. 29 Enterprise auditors (28 cloud auditors + 1 non-cloud), 56 plugins overall; floor CE ≥ 1.0.0. Release notes live in the package CHANGELOG.md.
report --from <dir> --format executive → self-contained executive HTML, or --format jira → a Jira-importer CSV