R.A.D.O.N. (Risk Analysis & Detection Orchestration Node) is an air-gapped, self-hosted scanner that runs 50+ checks across IAM, Cloud Storage, Compute Engine, and Cloud Run, then turns raw findings into plain-English risk assessments with a locally hosted LLM.
Managed platforms carry enterprise pricing and process your configuration data in their own clouds, while free scanners stop at raw findings: a wall of JSON that still needs a human to interpret.
The interpretation layer means shipping your GCP configuration, every vulnerability and misconfiguration, to a third party. A single breach at that vendor exposes your entire cloud posture.
Run the scan yourself and get the interpretation too, generated by a local LLM on your own hardware. Deploy the container inside your own cloud and it is fully air-gapped. Your security data never leaves your machine.
Every finding is scored against recognized industry standards and explained in language your team can act on, generated on-device, never in someone else's cloud.
IAM, Cloud Storage, Compute Engine, and Cloud Run: the misconfigurations that cause real incidents, audited via the GCP API.
llama.cpp running LFM 2.5 1.2B (swappable to 8B and 26B) turns raw findings into plain-English risk assessments with remediation steps. Nothing leaves your environment.
Scored with CVSS v4.0, mapped to CIS GCP Foundations Benchmarks and MITRE ATT&CK, not an in-house scale. Falls back to NIST SP 800-53 where CIS doesn't cover.
Findings, scan history, and remediation state stored in MongoDB, or in-memory for quick trials with no database.
Findings, trends, a 0–100 posture score, AI chat, and remediation tracking in a dependency-free vanilla JavaScript frontend.
A deliberately misconfigured fake GCP project ships with the stack, so you can run a scan immediately, with no live GCP account needed.
One Docker Compose stack, fully self-hosted. Deploy it inside your own cloud and your security data never leaves.
Collects GCP configuration over HTTP and runs the 50+ checks across IAM, Storage, Compute Engine, and Cloud Run.
Turns each finding into a plain-English assessment with severity and remediation, generated on-device.
Stores findings, scan history, and remediation state, or runs in-memory for quick trials.
Serves findings, the 0–100 posture score, AI chat, and remediation tracking.
A fake, deliberately misconfigured GCP project for offline testing, with no live account required.
IAM: public roles, overprivileged and dormant service accounts, unrotated and orphaned keys.
Cloud Storage: public buckets and objects, missing uniform bucket-level access, disabled versioning, unencrypted buckets.
Compute Engine: public IPs, open firewall rules, default service accounts, disabled shielded VMs, serial port access.
Cloud Run: unauthenticated services, open ingress, secrets in env vars, missing resource limits and VPC connectors.
The repository is the free, self-hosted core, licensed Apache 2.0. Metal Origami maintains a commercial version on top of it, with no forced migration and no lock-in.
The interactive demo walks through the open-source capabilities, with no GCP credentials required. When you're ready, clone the repo and run it against your own environment in one command.
Questions about R.A.D.O.N., early access to the commercial tier, or just want to talk cloud security?
Contact us at contact@metal-origami.com