Audit-ready compliance evidence from one read-only scan — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2, mapped from a single pass across AWS, Azure and GCP. 56 plugins, built on an open-source core. Runs entirely on your infrastructure — zero data exfiltration by architecture. Now every one-shot Enterprise compliance scan writes what changed since the previous one — and can notify your webhook, Slack or Teams when a control goes to fail or loses measurement.
The cloud-audit + compliance engine shown above is NSAuditor AI Enterprise · Community Edition is free forever, MIT licensed
Runs entirely on your machine. No cloud. No telemetry. License validation is offline. We can't see your data because we never touch it.
Findings are risk-scored and ranked so you fix what matters first. Suppress accepted-risk or false-positive findings with the operator workflow — your triage decisions persist across scans.
OpenAI, Claude, or Ollama (fully local). Compliance reports, remediation guidance, risk prioritization. Your API keys, your data.
27 CE plugins: Ports, SSH, HTTP, TLS, DNS, SNMP, SMB, RPC, mDNS, UPnP, and more. 29 EE plugins, of which 28 are cloud auditors: AWS S3, GCP, Azure, IAM Deep Auditor, CloudTrail, API Gateway, DynamoDB, KMS, Lambda, Secrets+SSM, CodePipeline, IAM Decrypt-Path, S3 Lifecycle, AWS Backup, RDS, SES, VPC/PrivateLink, EC2 SG, ElastiCache, Inspector2/GuardDuty, plus dedicated Azure Storage / NSG perimeter / Key Vault deep auditors, and more. The 29th, Zero Trust Assessment, is not a cloud auditor — it scores zero-trust posture from a network-host scan and calls no cloud API.
SOC 2 (AICPA TSC 2017), HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, GDPR Article 32 (Security of Processing), and NIST SP 800-171 Rev 2 — all from one scan. Sub-requirement-level mapping for QSA RoC workflow. Customized Approach eligibility read from each requirement's own objective cell, identifiers derived from the standard. CHD Scope operator-attested. ISO 27001 Statement of Applicability discipline. CIS Implementation Group cumulative discipline (IG1 cyber-insurance baseline). GDPR Article 32 is an infrastructure substrate for Art. 32 only (4 covered + 5 partial + 2 OOS across 11 sub-measure units) — NOT GDPR compliance. Auditor-ready evidence packs with SHA-256 chain-of-custody. No BAA with Nsasoft required.
The MCP server ships free in the Community Edition — drive NSAuditor from Claude Desktop, Claude Code, Cursor, or any MCP-aware agent. Run nsauditor-ai mcp install-key and paste the mcpServers block it prints into your claude_desktop_config.json (it names node and the server script by absolute path), or in Claude Code: claude mcp add nsauditor-ai --env NSA_MCP_AUTH_KEY=<from: nsauditor-ai mcp install-key> -- nsauditor-ai-mcp. Then install the optional agent skill so the assistant knows NSAuditor's tools, schemas, and audit workflows — in Claude Desktop: Skills → Create skill → Upload a skill (upload SKILL.md). Then just ask: "audit my AWS account."
Your compliance posture moves between audits — Enterprise 2.0.0 shows you what moved. Node.js 24 is the supported runtime. Every one-shot compliance scan writes what changed since the previous scan beside its pack — controls to fail or to pass, controls that lost measurement, violations new or cleared, and what could not be measured, never read as cleared — and can notify a webhook, Slack or Teams when a control goes to fail or loses measurement, when a new violation reaches a severity you set, or when the drift could not be compared. A scan connects only to the addresses its host check resolved (Community 1.0.0), the AI payload carries no AWS account ID, and plugin 040’s weak-key and weak-signature findings fail the certificate control in six of the eight frameworks. See Enterprise →
The drift file (Enterprise, one-shot compliance scan). scan_drift_<fw>.json sits beside each compliance pack. A violation is cleared only when this scan looked for it and it was gone; one whose scanner did not run or reported itself down, or whose port or region was not measured, is listed as could-not-measure with its reason. The notification is opt-in: --notify-webhook (public https only), --notify-format generic|slack|teams and --notify-severity send the drift when it crosses the trigger, and a drift that could not be compared with a previous run always notifies, but the first scan, with no previous run, is the baseline and sends nothing. The payload is minimal by default. CLI only — not --watch, not the MCP server. The resolved-address pin (Community 1.0.0): the host check resolves the target and checks every answer; the scan then connects only to those answers — on the CLI and through the MCP server, for the target and each redirect hop. An AI payload without AWS account IDs (Community 1.0.0): an account ID in an ARN or an AWS URL becomes [ACCOUNT_ID] everywhere it occurs, and any other 12-digit number [REDACTED_ID]; the system prompt is written beside the payload before the request, so the two files are what left the machine. Certificate strength in six frameworks (Enterprise compliance): plugin 040’s weak-key and weak-signature findings now fail the certificate control in SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022 and CIS v8; GDPR Article 32 and NIST SP 800-171 stay held for review. Fewer phantom services (Community 1.0.0): on TCP, a row from a port’s authoritative probe that did not identify its service is evidence with a reason, not a service row, so the CSV, SARIF, the Markdown report and the AI payload no longer list it.
Where it stops, stated: a notification retried after a timeout or a server error can arrive twice, and a hanging endpoint can cost about 32 seconds per framework. A scan that found its ports with the Nmap plugin (024) alone has no port oracle, so a violation on a port that scan did not measure can be listed as cleared; include the port scanner (003) in the scans you compare. The pin does not hold through an HTTP proxy set with NODE_USE_ENV_PROXY, which resolves the name itself, or over an idle connection opened earlier to the same name, for as long as the target keeps it open. UDP non-answers stay in the service list: a UDP silence is open-or-filtered, and the delta reads those rows. A probe with no adapter of its own can still list a port it did not identify, with a status other than open: on a router scan, the SUN RPC plugin listed port 111, which the port scanner had measured closed.
Upgrade both packages together: Enterprise 2.0.0 runs on Node.js 24 and requires Community 1.0.0 — npm i -g nsauditor-ai@1.0.0 @nsasoft/nsauditor-ai-ee@2.0.0. Enterprise 2.0.0 imports a name that first ships in Community 1.0.0; below it Enterprise’s core does not load while its plugins still do — on Community 0.2.57 as on 0.2.56 — so the scan skips its intelligence, analysis-agent and compliance stages: Community 0.2.56 and later name that on stderr, and 0.2.55 or older says nothing. Rotate a webhook URL a logged --watch run printed: --watch printed the full --webhook-url to stdout, and now prints the host. A weak certificate under a trusted CA now reads as the weak-key or weak-signature finding alone, not also as an untrusted chain; a weak certificate under an untrusted CA still reads untrusted. Compared across the upgrade, the phantom rows’ disappearance reads as not measured, never as fixed. Coverage: all eight coverage matrices unchanged since EE 1.3.0. 29 Enterprise auditors (28 cloud auditors + 1 non-cloud), 56 plugins overall; floor CE ≥ 1.0.0. Release notes live in the package CHANGELOG.md.
report --from <dir> --format executive → self-contained executive HTML, or --format jira → a Jira-importer CSV