<p align="center" <img src="assets/cairn-banner.png" alt="Cairn — local-first IaC auditor" width="760" </p

<p align="center" <a href="https://pypi.org/project/cairn-iac/"<img src="https://img.shields.io/pypi/v/cairn-iac.svg" alt="PyPI"</a <a href="https://github.com/cairn-oss/cairn/actions/workflows/ci.yml"<img src="https://github.com/cairn-oss/cairn/actions/workflows/ci.yml/badge.svg" alt="CI"</a <a href="LICENSE"<img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="MIT"</a <img src="https://img.shields.io/badge/python-3.10%2B-blue.svg" alt="Python 3.10+" </p

<p align="center"<strongCairn</strong</p <p align="center"<emThe local-first, cloud-agnostic IaC auditor that fuses cost + security in a single pass — across AWS, Azure, GCP, Kubernetes and on-prem — and writes the fix, not just the flag.</em</p <p align="center" <a href="#installation"Install</a · <a href="#quick-start"Quick start</a · <a href="docs/rules.md"Rules</a · <a href="docs/architecture.md"Architecture</a · <a href="CONTRIBUTING.md"Contribute</a </p

---

Cairn scans your Terraform on your machine, applies security, cost, reliability and governance rules in one pass, reconciles the trade-offs between them, and proposes concrete, ready-to-apply fixes.

$ cairn scan examples/vulnerable

Cairn found 25 issue(s) in examples/vulnerable (6 cost, 6 governance, 3 reliability, 10 security):

1. [CRITICAL/SECURITY] aws_security_group.web  (SEC001)
   at:      examples/vulnerable/main.tf:4
   problem: Ingress on port 22 is open to the entire internet (0.0.0.0/0) and covers SSH/RDP.
   fix:     Restrict cidr_blocks to known ranges (office/VPN CIDRs), or front the service with a load balancer or SSM Session Manager instead of exposing it directly.
   patch:
     cidr_blocks = ["10.0.0.0/8"]  # replace with your trusted CIDR

   ...   (23 findings elided; each carries its own patch)

[MEDIUM/COST] awsinstance.batch (COST001)

at: examples/vulnerable/main.tf:28 problem: Instance type 'm5.4xlarge' is very large (~$561/month on-demand) and likely over-provisioned. fix: Verify utilization (CloudWatch CPU/memory over 2+ weeks); a smaller type such as m5.xlarge often carries the load at a fraction of the cost. If sustained load is real, consider a savings plan instead of on-demand. saves: ~$420.48/month (estimate) patch: instancetype = "m5.xlarge"

Trade-offs (cost x risk on the same resource): ⚖ awsdbinstance.main [COST + GOVERNANCE + RELIABILITY + SECURITY] Cost and security findings touch this resource. Sequence the security fix first, then right-size — resizing an exposed resource first just makes the breach cheaper to run.

Estimated recoverable spend: ~$1,717.53/month 9 resource(s), 1 file(s), 0.71s. Local-only scan; nothing left this machine.


## Why Cairn

Cost lives in one tool (Infracost, Kubecost), security in another (Checkov, Trivy), and nobody reconciles them at the moment of the decision. A change that saves money can widen your attack surface — and no scanner tells you that. Cairn is different by design:

- **Fuses cost + security.** One pass, one ranked report, explicit trade-offs when both hit the same resource, with estimated dollars next to every cost finding.
- **Fixes, not just flags.** Every finding carries plain-English remediation and, where safe, a ready-to-apply HCL patch.
- **Local-first, by architecture.** No SaaS, no upload, no telemetry. Your code, secrets and infrastructure data never leave your machine. LLM explanations are strictly opt-in and bring-your-own-key (or fully local via Ollama).
- **Policy-as-code around the scanner.** Encode your org's standards — required tags, severity gates, grandfathered ignores — in a reviewable `.cairn.yaml`.
- **Built to operate, eventually.** Every action is governed by the [Trust Ladder](docs/architecture.md#the-trust-ladder): today read-only with an audit trail; auto-fix PRs and policy-gated remediation come only after trust is earned.

## Installation

Requires Python 3.10+.

pip install cairn-iac

Or run from source:

git clone https://github.com/cairn-oss/cairn && cd cairn
pip install -e .

Or via Docker:

docker build -t cairn . && docker run --rm -v "$PWD:/scan" cairn scan /scan

Installation

README.md

Quick start

Related tools