README

Probo






Open-source GRC platform for engineers.

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. It covers the full GRC lifecycle: risk identification, control tracking, vendor risk, data privacy, access reviews, audit programs, and document approval workflows. Every entity is accessible through a web console, a CLI, a Model Context Protocol (MCP) API, and a GraphQL API, so you can automate compliance work from code, scripts, or any LLM agent.

📖 Documentation: probo.com/docs

 Why Probo?

- AI-native by design. 270+ MCP tools expose every entity and operation. Any MCP-compatible LLM agent can read and write your GRC data, draft policies, run risk assessments, and generate evidence packs.
- Full GRC coverage. Risk management, controls, vendor risk, data privacy (DPIA/TIA), access reviews, audit programs.
- Multiple interfaces. Web console, prb CLI (44+ command groups), MCP API, GraphQL, and an n8n community node for no-code automation.
- Open source and self-hostable. MIT licensed. Run it on your own infrastructure with Docker.
- Audit-ready. Policy-based RBAC, immutable audit logs, electronic document sign-off workflows, and evidence chains.

 Capabilities

| Domain | Features |
|--------|----------|
| Risk Management | Risk register, inherent/residual scoring, treatment strategies (mitigate, accept, avoid, transfer), threat-based risk assessments |
| Controls & Frameworks | Control library with maturity levels, custom framework import/export, Statement of Applicability (SoA) |
| Vendor / Third-Party Risk | Vendor inventory, automated website risk assessment, DPA/BAA tracking, subprocessor discovery |
| Data Privacy | DPIA, Transfer Impact Assessments, processing activity records, data inventory, rights requests (SAR/erasure) |
| Access Reviews | Campaign management, per-entry access decisions, integration with SaaS, cloud infra, and source code sources |
| Audit Programs | Audit scoping, control mapping, finding tracking, report generation |
| Evidence & Measures | Evidence collection (files and URLs), implementation state tracking, task assignment |
| Document Management | Versioned documents, approval quorums, electronic signatures, PDF export, bulk operations |
| Compliance Page | Public compliance portal, NDA management, certification publishing, custom domain support |
| Cookie & Consent | Cookie banner management, tracker detection, consent records |

 Interfaces

 Web console

The primary interface for day-to-day GRC work. Runs at http://localhost:8080 in development.

 CLI (prb)

A fully-featured command-line client for scripting, automation, and CI/CD integration. Covers all 44+ resource types available in the web console.

sh
 Authenticate
prb auth login

 List open risks
prb risk list

 Create an internal control and link evidence
prb internal-control create --name "MFA enforced on all production systems" --category "Security"
prb evidence upload ./screenshot.png