GUAC aggregates and normalizes software security metadata into a high fidelity graph database to enable comprehensive supply chain transparency and risk management.
GUAC aggregates software security metadata into a high fidelity graph database.
GUAC is used by security teams, auditors, and developers to aggregate diverse software supply chain metadata into a unified graph, enabling risk assessment, compliance auditing, and security automation. It helps organizations query and analyze software artifact relationships to improve governance, risk management, and compliance efforts.
GUAC is under active development and may encounter ingestion errors due to incomplete or inconsistent metadata identifiers; users are encouraged to report data quality issues. The tool supports multiple backends transparently via GraphQL, allowing flexibility in deployment. Familiarity with software supply chain standards and GraphQL querying will enhance effective use.
Visit https://docs.guac.sh/ for detailed documentation
Start GUAC services using the docker compose quickstart available at https://docs.guac.sh/setup/
Refer to the contributor guide (CONTRIBUTING.md) for development setupdocker compose up
Starts the GUAC services using the provided Docker Compose configuration