someengineering

fixinventory: Find and Triage Cloud Security Risks

Fix Inventory collects and normalizes cloud infrastructure data, then helps teams find security risks through policies and graph queries. It targets cloud and security engineers working across providers and Kubernetes.

QuietPythonApache-2.0SecurityCloud NativeCybersecurity
View on GitHub Compare
Stars
2.1k
Forks
140
Stars, last 30 days
+11
Last commit
7 months ago
Contributors
31

Our take

Quietno commits in the last 90 days and no release in a year

Health score

31/100

How it is scored
Activity
19
Community
64
Issues
21
Pull requests
20

+11 stars in the last 30 days

Fix Inventory offers a broad, graph-based approach to multi-cloud security analysis, but its current quiet maintenance signals warrant checking project activity before relying on it for new deployments.

Good fit if

  • You need agentless inventory and security queries across the providers and platforms it supports.
  • Your team wants to inspect access and dependency paths, or write policies against a shared cloud resource model.
  • You can evaluate and operate a Python project whose recent activity is quiet, despite contributions from multiple people rather than dependence on one contributor.

Look elsewhere if

  • You need evidence of recent releases or active issue resolution before adopting a security tool. There has been no release in over a year, and no issues were closed in the measured recent period.
  • You need a provider or resource collector that is not supported and do not plan to build one; the README points users to an example collector for adding support.
  • You require the hosted Fix Security SaaS product rather than running the open-source inventory project yourself.
All health signals
Last commit2026-03-28 (7 months ago)
Commits, last 90 days0
Releases, last 12 months0 (latest 4.2.0, 2024-12-05)
Contributors31 (top contributor: 46% of commits)
Issues closed, last 90 days0
Pull requests merged, last 90 days0
Project age6 years

Checked on 2026-10-13 with the GitHub API.

Project history

Daily GitHub snapshots since Oct 7, 2026. History covers stars and forks; health signals are not tracked historically.

Selected snapshot

Stars

2,088

Forks

140

Change since Nov 13, 2026: 0 stars·0 forks

Overview

Fix Inventory is a Python-based security and asset inventory tool for cloud and Kubernetes environments. It queries provider APIs without installing agents, normalizes the results into a shared resource model, and helps teams identify misconfigurations, compliance gaps, and risky access paths.

Its graph model connects resources and permissions across supported providers, so teams can investigate relationships as well as isolated findings. It is intended for cloud and security engineers who want to run inventory and policy checks themselves, or build alerting and remediation workflows from the collected data.

Key Features

  • Collects inventory from AWS, GCP, Azure, DigitalOcean, Hetzner, Kubernetes, and GitHub.
  • Normalizes provider-specific resource data into a shared model for cross-cloud searches and policies.
  • Stores dependency and access relationships in a graph that can be queried to investigate risk paths.
  • Provides a human-readable CLI query language, including full-text search and graph traversal.
  • Supports custom policies and includes compliance benchmarks such as CIS, ISO 27001, and NIS-2.
  • Tracks inventory snapshots and resource changes over time.
  • Exports collected data for integration with alerting and remediation workflows.

Use Cases

  • Cloud security teams can search multiple provider accounts for misconfigurations, such as unencrypted volumes, and turn those searches into policies.
  • Identity teams can investigate whether users or service accounts have access paths to sensitive resources.
  • Compliance teams can run supported benchmark reports across cloud environments.
  • Platform teams can build a unified asset inventory and track resource configuration changes over time.
  • Kubernetes operators can relate cluster objects to workloads and underlying cloud infrastructure during security investigations.

What you need

Detected in the repository

  • Python (from requirements.txt)
  • A Compose file to run it with its related services
  • Automated checks on GitHub Actions

License in plain words

Apache-2.0permissive

  • Commercial use: yes
  • Modify and redistribute: yes
  • You must keep: the license, the NOTICE file and a note of your changes
  • Share your changes: no
  • Includes an explicit patent grant from the contributors:

A summary, not legal advice: the LICENSE file is what applies.

Getting Started

Start with the Quick Start Guide. For installation, configuration, and usage details, see the repository README.

Considerations

The project is marked quiet in the supplied health data: it has no commits in the measured recent period and no release in over a year. The repository has multiple contributors and is not flagged as concentrated around one person, but the measured period also shows no recent issue closures or merged pull requests. Teams should verify that current provider APIs, supported resource types, and compliance needs match their requirements before depending on it.

The README describes an example collector for unsupported resources, so coverage is not universal. The repository uses Python and includes Compose configuration; the supplied requirements data does not report Docker as a requirement. The project is Apache-2.0 licensed, so adopters should review the license terms and preserve required notices when redistributing it.

Found this useful?

Share it with someone who would like fixinventory.