Talk it throughGitHub
Open core · Apache-2.0

The free part is the point

Everything that makes a single box safe is Apache-2.0 and published in the open. No email wall, no account, no telemetry, no licence check, and no upsell in the output.

If you run your own metal, take it and never get in touch — that is the intended outcome, not a lead-gen funnel with a longer fuse.

Browse the codeSee the catalogue
aegis — representative run
Apache-2.0
$ aegis --json aegis-2026-08.json
> mounting filesystem read-only … ok
> network calls: 0 — by design
listening serviceseach one accounted for
ssh daemonkey-only · root login off
SENTINEL exportersbound to loopback
NIGHTWATCH agentenrolled · ruleset current
SENTRY front doorMFA enforced
CHECKPOINT egressdefault-deny verified
secrets in env filesflagged — see report
> report written — diff it against next month's
any box you ownphones nobody
AEGIS · Audit toolingNot published yetA representative run on a box that is not perfect — the one notice is the tool being honest about it. No real hosts, no invented findings, and no client data appears on this site.
The commons · 3 things

What’s free

Status is marked honestly. Where something says it has not published yet, that means exactly that — there is no hidden download behind an email form, and nothing on this page asks you for an address before it hands anything over.

  • AEGIS

    Not published yet

    Audit tooling

    FreeApache-2.0

    Any box you own

    One command tells you what's actually exposed on a box. Runs on your machine, reports to you, phones nobody. Not published yet.

    • Read-only. Mounts your filesystem ro and makes zero network calls
    • Writes a report you can read and a JSON file you can diff next month
    • No account, no telemetry, no license check, no upsell in the output
    • Runs air-gapped — busybox and jq, nothing exotic

  • BASELINE

    Not published yet

    Public repositories

    FreeApache-2.0

    1 host, 1 tenant

    The self-hosted stack, one component per repository, publishing as each clears review. Monitoring, detection, identity, perimeter — Apache-2.0, no email wall.

    • Metrics, logs, dashboards, SIEM, single sign-on, DNS filtering, TLS
    • Hardening roles and the runbooks that actually operate it
    • MFA, secrets handling, least privilege, egress default-deny, documented backup and restore procedure
    • Written down properly — including the parts we got wrong first

  • COURIER

    Not published yet

    Weekly dispatch

    Free

    Email, weekly

    What broke this week, what it means for a stack like yours, and what to actually do about it. No fear-mongering, no vendor press releases. Not running yet — issue one has not gone out.

    • Advisories that affect the baseline, with the fix
    • Field notes from deployments, failures included
    • New build plans as they land
    • Unsubscribe link that works on the first click
Never gated · 7 controls

Never behind the paywall

Security controls that keep a box safe are not an upsell. These are in the free repositories permanently, and moving one of them behind a price would be the point at which this stops being open core.

  • 01MFA enforcement
  • 02TLS 1.2+ only
  • 03Secrets handling
  • 04Audit logging
  • 05Least privilege
  • 06Egress default-deny
  • 07Tested backup
baseline — public repository
Apache-2.0
baseline/
sentinel/Observability — SENTINEL
nightwatch/Security event intelligence — NIGHTWATCH
sentry/Identity & access gateway — SENTRY
checkpoint/Perimeter & traffic control — CHECKPOINT
darkroom/Media vault — DARKROOM · baseline-only
hardening/Roles — MFA, least privilege, egress default-deny
runbooks/Operate it — backup & restore, written down

Everyone. This is the commons, and it stays free

1 host, 1 tenantNot published yet
BASELINE · Public repositoriesNot published yetThe directory listing is derived from the catalogue, so it cannot show a component that is not published. The components go public one repository at a time as each clears review; the assembled single-box baseline does not exist yet.
Where the line is

So what costs money

Not the safe part — the fleet part. High availability, long retention, a restore that has actually been run, and somebody keeping up with upstream across a dozen environments so you do not spend your weekends on it.

A fork gets you the files. It does not get you next month. If that trade is worth paying for, the prices are published in full — no call required.

See the prices