disco-cli
the part that reaches into your cloud is the part you can read.
disco-cli is the scanner engine, open source under the mit license. It runs on your machine, uses the credentials you already have, and writes what it finds into a single file. There is no account to create and nothing to send us — so you can answer "does it actually find what we run" from your own cloud rather than from this page.
what it does that the hosted product does not
The two halves are not the same tool with different hosting. These six are the scanner's, and they stay the scanner's — they answer questions against the file it wrote, on the machine that wrote it.
- Shortest-path queries between any two resources
- Scan-to-scan diff reporting what appeared and what went stale
- Orphan detection for resources with no inbound edges
- Per-key tag-coverage reporting, including zero-coverage keys
- OPA/Rego policy evaluation with SARIF output and exit-code gating
- Byte-identical JSON output for committing and diffing
what the hosted product adds
Hosting we run and isolate per organization, guided connection for aws, azure and google cloud, scans that run on our infrastructure instead of a laptop, the web interface, single sign-on, webhooks, the audit log, and cost allocation.
What is not open source is the web application, the guided connection flows, and the control plane. The split is deliberate and it is this way round on purpose: the part you are being asked to trust with access to your infrastructure is the part you can read. More on the trust page.