# cartography-cncf/cartography

Cartography is a Python tool that pulls infrastructure assets and their relationships into a Neo4j graph database.

Repository: https://github.com/cartography-cncf/cartography
Canonical: https://ross.abutalabs.com/products/cartography-cncf-cartography
Homepage: https://docs.cartography.dev/
Language: Python
License: Apache-2.0
License Family: permissive
Last push: 2026-08-26T22:40:57+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 97, longevity 100
- inputs: {"age_days": 2745, "days_push": 7, "days_rel": 22, "gap_med": 9.0, "n_releases_24m": 55}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4028, forks 558 (observed 2026-08-28T04:08:32.686489+00:00)

## What it is
Cartography is a Python CLI tool that ingests infrastructure assets and their relationships from 30+ platforms (AWS, GCP, Azure, Kubernetes, GitHub, Okta, and more) into a Neo4j graph database. It enables security and infrastructure teams to query cross-provider relationships like identity access, network exposure, and vulnerability impact using Cypher.

## Use cases
- map cloud infrastructure assets into a graph database
- find which identities have access to which datastores across cloud providers
- detect internet-exposed compute instances
- analyze IAM privilege escalation paths in AWS
- track vulnerabilities and compromised packages across my environment
- visualize network paths in and out of my cloud environment
- inventory AI agents running in production and their permissions
- run drift detection on cloud resources

## When to choose
- you need a unified asset inventory across multiple cloud providers and SaaS platforms
- you want to answer cross-account or cross-provider security questions with graph queries
- you're building custom security tooling on top of an infrastructure graph
- you need attack-path analysis combining identities, compute, and network data

## When to avoid
- you need a turnkey commercial CSPM with dashboards and alerts out of the box
- you don't want to operate a Neo4j database
- you only need monitoring of a single cloud provider with simple built-in reports
- you need real-time streaming ingestion rather than periodic syncs

## Facets
- artifact type: cli-tool
- maturity: active
- function: database, security, monitoring, cli, etl
- domain: security, cloud-computing, infrastructure-as-code, databases, developer-tools
- platform: python, cli, cross-platform
- tags: neo4j, cloud-security, asset-inventory, graph-database, cspm, infrastructure-mapping, aws, gcp, azure, kubernetes, attack-path-analysis, graph-processing, devops, docker

## Member repositories
- cartography-cncf/cartography (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:32.686489+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:23:51.980269+00:00, confidence not recorded.
  - readme: https://github.com/cartography-cncf/cartography (fetched 2026-08-28T04:08:32.686489+00:00, sha 266ba383ac80)
  - homepage: https://docs.cartography.dev/ (fetched 2026-08-29T09:16:33.243795+00:00, sha 460946091f25)
  - site_page: https://docs.cartography.dev/install.html (fetched 2026-08-29T09:16:33.253136+00:00, sha 5771cd71392e)
  - site_page: https://docs.cartography.dev/dev/index.html (fetched 2026-08-29T09:16:33.255350+00:00, sha 9eb785d636ec)
  - registry_pypi: https://pypi.org/pypi/cartography/json (fetched 2026-08-29T09:16:33.257251+00:00, sha e85e1eb844df)
- Data as of 2026-08-30T08:39:29.467469+00:00.