vcarto

Agentic GCP security remediation tool. Continuously scans your Google Cloud project for misconfigurations, triages findings with an AI agent, and applies fixes -- with human approval where needed.

Architecture

• Server -- Express API + background agent loops. Deployed to Railway (or any Node.js host).
• CLI -- Ink-based terminal UI. Published to npm as vcarto. Connects to the server over HTTPS.

Quick start

1. Deploy the server

Or manually:

git clone <repo-url> && cd veracarto-cli
cp .env.example .env        # fill in ENCRYPTION_KEY + ANTHROPIC_API_KEY
npm install
npm run build:server
npm start

See DEPLOY.md for full Railway deployment instructions.

2. Install the CLI

npm install -g vcarto
veracarto

The CLI walks you through connecting GCP, GitHub, and Slack.

Environment variables

| Variable | Required | Description | |---|---|---| | ENCRYPTION_KEY | Yes | 64-char hex string for encrypting GCP keys at rest | | ANTHROPIC_API_KEY | Yes | Claude API key for the AI agent | | PORT | No | Server port (default: 3000) | | DATABASE_PATH | No | SQLite path (default: ./data/veracarto.db) | | GITHUB_APP_ID | No | GitHub App for Dependabot ingestion | | SLACK_CLIENT_ID | No | Slack App for approval workflows |

See .env.example for the full list.

Development

# Terminal 1 -- server
cp .env.example .env   # fill in values
npm install
npm run dev:server

# Terminal 2 -- CLI (watch mode)
npm run dev:cli
node dist/cli/index.js

Scripts

| Script | Description | |---|---| | npm run dev:server | Start server with hot reload | | npm run dev:cli | Build CLI in watch mode | | npm run build | Build both server and CLI | | npm run build:cli | Build CLI only | | npm run build:server | Build server only | | npm start | Start the production server |

License

MIT