How trycompai/comp works
Comp AI is an open-source compliance platform for achieving and maintaining framework readiness. The principal workflow is to connect cloud accounts and gather security findings, organize remediation and evidence against controls, then review progress toward audit readiness. The API also supports policy and framework management, billing, administration, and ISMS management reviews; the MCP server exposes selected API operations to tool clients. The README describes broad evidence collection and policy automation, but sampled source is limited, so links between those product stages are not inferred.
Main entry points: app.module.ts API service · cloud-security.service.ts Cloud findings · cloud-security-query.service.ts Findings query · billing.service.ts Billing
Components 23
Compliance workspace
- Task management
apps/api/src - Evidence forms
apps/api/src/evidence-forms - Evidence attachments
apps/api/src/attachments - Framework editor
apps/api/src/framework-editor - Controls
apps/api/src/controls - Policy management
apps/api/src/framework-editor/policy-template - ISMS reviews
apps/api/src/isms/isms-management-review.service.ts
Cloud security
- Cloud findings
apps/api/src/cloud-security/cloud-security.service.ts - Findings query
apps/api/src/cloud-security/cloud-security-query.service.ts - Cloud provider adapters
apps/api/src/cloud-security/providers - Finding exceptions
apps/api/src/cloud-security/finding-exceptions.ts - Remediation
apps/api/src/cloud-security/remediation.service.ts
API platform
- API service
apps/api/src/app.module.ts - Authentication
apps/api/src/auth/auth.module.ts - Application data
apps/api/prisma/index.ts - Billing
apps/api/src/billing/billing.service.ts - Organization admin
apps/api/src/admin-organizations/admin-organizations.service.ts
API clients
- Web workspace
apps/app/src/app/(app)/[orgId]/tasks/hooks/useTasks.ts - MCP tools
apps/mcp-server/src/mcp-server/tools/evidenceFormsEvidenceFormsControllerReviewSubmissionV1.ts
Other components
- Compliance user
- API consumer
- Cloud accounts
- Stripe
Connections 23
- Compliance user → Web workspace: uses
- Web workspace → API service: calls API
- API consumer → API service: requests
- API service → Authentication: authenticates
- API service → Task management: dispatches
- API service → Evidence forms: dispatches
- API service → Evidence attachments: dispatches
- API service → Framework editor: dispatches
- API service → Controls: dispatches
- API service → Policy management: dispatches
- API service → ISMS reviews: dispatches
- API service → Cloud findings: dispatches
- API service → Billing: dispatches
- API service → Organization admin: dispatches
- API service → Application data: uses
- Cloud findings → Findings query: queries
- Findings query → Cloud provider adapters: loads manifests
- Findings query → Finding exceptions: loads exceptions
- Cloud findings → Cloud accounts: scans
- Cloud findings → Remediation: requests remediation
- Billing → Stripe: integrates
- API consumer → MCP tools: uses tools
- MCP tools → API service: calls operations