valqore

Valqore

One scan. One score. One verdict.

---

Valqore is an infrastructure governance engine that scans Kubernetes manifests, Terraform configurations, and cloud resources — then returns a score (0-100) and a verdict (PASS, PASS_WITH_MONITORING, or BLOCK).

1,431 built-in rules across security, cost, carbon/sustainability (GreenOps), compliance, and AI governance, organised into 19 compliance packs (including OWASP Top 10 for Agentic Applications 2026, EU AI Act Annex III, CRA, DORA, SOC2, HIPAA, FedRAMP, SR 11-7, and PQC Migration / CNSA 2.0). No configuration needed. Runs anywhere Docker runs.

---

Quickstart (60 seconds)

1. Pull the image (free, public, no signup):

docker pull ghcr.io/valqore/engine:latest

2. Scan a file:

docker run --rm -v "$PWD:/work" -w /work \
  ghcr.io/valqore/engine:latest valqore evaluate deploy.yaml --score

3. Make it short. That docker run … prefix repeats a lot, so alias it once and every command below becomes just valqore <cmd>:

# bash / zsh (macOS, Linux)
alias valqore='docker run --rm -v "$PWD:/work" -w /work ghcr.io/valqore/engine:latest valqore'

# PowerShell (Windows)
function valqore { docker run --rm -v "${PWD}:/work" -w /work ghcr.io/valqore/engine:latest valqore @args }

Now you can run everything against files in your current directory with clean, relative paths:

valqore evaluate deploy.yaml --score      # one file
valqore evaluate ./k8s/ --score           # a whole folder
valqore agent-audit ./k8s/                 # who governs your AI agents?

Every example in this README uses the valqore alias. Without it, just put the docker run --rm -v "$PWD:/work" -w /work ghcr.io/valqore/engine:latest prefix back in front.

Five ways to run Valqore

Surface Install Best for CLI / Docker docker run ghcr.io/valqore/engine:latest valqore evaluate manifest.yaml --score Local checks, CI pipelines K8s admission control helm install the valqore-stack chart Cluster-wide enforcement via native ValidatingAdmissionPolicy VS Code extension valqore-vscode .vsix Real-time CodeLens + hover + quick-fix in YAML / Terraform / Helm Freelens K8s IDE freelens-valqore extension Resource-detail panels + cluster overview + right-click policy checks MCP for Claude / Cursor valqore mcp 137 governance tools your AI assistant can call

30-second cluster install (Kubernetes-native)

# Install the operator stack from the public OCI chart (Go controller-runtime,
# ~30 MB image). The CRDs ship with the chart and install automatically.
helm install valqore oci://ghcr.io/valqore/charts/valqore-stack \
  --namespace valqore-system --create-namespace \
  --set 'policies[0].name=enforce-owasp-agentic' \
  --set 'policies[0].pack=owasp_agentic' \
  --set 'policies[0].action=Warn'

Within 30 seconds, 8 native ValidatingAdmissionPolicy objects materialise on the cluster — the K8s API server enforces them. Valqore is not in the data path.

kubectl get valqorepolicy enforce-owasp-agentic
# NAME                    PACK            ACTION   READYVAPS
# enforce-owasp-agentic   owasp_agentic   Warn     8

Flip action: Warn → action: Deny when you're confident, then watch the API server reject unannotated agent workloads at admission time.

Key differentiators:

• GreenOps built-in — CO2e emissions per workload, greener region suggestions, carbon budgets, GPU emissions tracking. 77 cloud regions with grid carbon intensity data.
• AI Scan — one command runs evaluate + drift detection + AI-powered explanation. The AI image includes a fine-tuned model that runs fully offline — your code never leaves the container.
• Interactive chat — ask Valqore questions about your scan results in natural language. Get remediation advice, compliance mapping, and cost optimization tips through a conversational interface.
• AI Governance — detect ungoverned AI/ML workloads, enforce EU AI Act compliance, and gate model promotions to production.
• AI agent fleet governance — agent-audit discovers the AI agents already running in your manifests, cluster, or cloud and scores each one's governance posture across five dimensions, then rolls up to a GOVERNED / PARTIAL / UNGOVERNED fleet verdict and exports it as auditor-ready OSCAL. The answer to "who governs the agents now governing your infra?"

---

Images & licensing

The only requirement is Docker (Linux, macOS, or Windows). No key, no signup for the deterministic core — it's free and runs tokenless. The public image is compiled (native code, no readable source), multi-arch (linux/amd64 + linux/arm64), and cosign-signed with an SBOM.

Image Distribution What's included ghcr.io/valqore/engine:latest Free, public, tokenless All 1,431 rules, scoring, drift, billing, compliance, MCP, agent-gate ghcr.io/valqore/engine-ai:1.13.6 Licensed (request access) Everything above + embedded offline AI model (AI scan, chat)

Only the AI features need a license. To activate the AI image, create a persistent volume once, then activate:

docker volume create valqore-data
docker run --rm -v valqore-data:/app/data ghcr.io/valqore/engine-ai:1.13.6 valqore activate YOUR_LICENSE_KEY

---

Verify image authenticity (supply chain)

Every published image is cryptographically signed and carries an SPDX SBOM, so you can prove exactly what you're running. Install cosign, then:

Public image (ghcr.io/valqore/engine:1.19.0) — keyless-signed in CI via Sigstore (GitHub OIDC + Rekor):

cosign verify ghcr.io/valqore/engine:1.19.0 \
  --certificate-identity-regexp 'https://github.com/valqore/valqore-engine/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation ghcr.io/valqore/engine:1.19.0 --type spdxjson \
  --certificate-identity-regexp 'https://github.com/valqore/valqore-engine/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

AI image (ghcr.io/valqore/engine-ai:1.13.6) — signed with Valqore's release key (cosign.pub):

cosign verify --key cosign.pub --insecure-ignore-tlog ghcr.io/valqore/engine-ai:1.13.6

Both checks confirm the image hasn't been tampered with since publish. The SBOM (SPDX) enumerates every component in the image for vulnerability scanning and audit.

---

Security & trust

• TRUST.md — how the deterministic engine decides, what Valqore does (and doesn't) do with your data, self-hosted/no-egress posture, supply-chain integrity, and an honest in-place-vs-planned status.
• SECURITY.md — coordinated vulnerability disclosure policy, private reporting channels, response targets, and safe harbor.
• SECURITY-FAQ.md — vendor security & due-diligence FAQ: SIG / CAIQ-style answers on data handling, subprocessors, encryption, supply chain, AI, and compliance posture, for security/procurement reviews.

---

What You Can Do

These use the valqore alias from Quickstart. Commands that read live cloud accounts also need credentials passed to the container — those are shown in full docker run form with the -e flags, since an alias can't carry your environment.

Scan manifests, Terraform, or a whole directory

valqore evaluate deploy.yaml --score        # a single Kubernetes manifest
valqore evaluate main.tf --score            # a Terraform file
valqore evaluate ./ --score                 # everything in the current folder

Valqore Score: 84/100 (Grade: B)
  Security: 78 | Reliability: 77 | Cost: 90 | Carbon: 97 | Compliance: 100
Cost estimate: $19.53/mo (aws, us-east-1)
Verdict: BLOCK   ·   Total: 495 | Pass: 383 | Warn: 84 | Fail: 28

Simulate a change before you make it

valqore what-if deploy.yaml --graviton       # migrate to ARM/Graviton
valqore what-if deploy.yaml --spot-ratio 70  # move 70% to spot instances

=== What-If: Migrate to Graviton (ARM) ===
  Cost:    $19/mo -> $15/mo (-20%)
  Carbon:  0.29 kg -> 0.09 kg (-69.5%)

Govern your AI agents — the flagship

Who governs the agents now governing your infra? agent-audit discovers every AI agent in your manifests/cluster/cloud and scores its posture across five dimensions; agent-gate stops an agent's proposed change before it touches anything.

valqore agent-audit ./                        # score the whole agent fleet

=== AI Agent Governance Posture ===
  Fleet: 2 agent(s) -- PARTIAL -- 1 governed / 1 with gaps

  Agent             Score  Identity  Guardrails  Boundary  Oversight  Supply Chain
  ops-agent          95     ok        ok          ok        ok         ok
  research-agent     46     gap       gap          --        gap        ok

Add --format oscal -o agentgov.json for an auditor-ready evidence pack where each dimension maps to a control.

# Gate a Terraform plan an agent wants to apply — block anything above a blast-radius cap
valqore agent-gate run --tf-plan plan.json --agent sre-bot --max-blast-radius medium

Agent action: BLOCK (BLOCKED)
sre-bot: infrastructure change
source: tf_plan · change: replace · blast radius: high
Blast radius 'high' exceeds max 'medium'.

Exit code 2 on BLOCK. Add --request-approval to mint a signed approval request recorded in the agent-gate journal.

Gate ungoverned AI/ML workloads to production

valqore ai-gate ./

=== AI Promotion Gates: ml-inference -> production ===
  AI Registered: FAIL  ·  Human Oversight: FAIL  ·  EU AI Act: FAIL  ·  Kill Switch: FAIL
  Result: BLOCKED -- 4 of 5 gates failing

Shift-left cost gate (cost prevention in the PR)

valqore finops cost-gate ./proposed/ --baseline ./current/ --max-delta 500

Exit code 1 when the change adds more than $500/mo over the baseline — cost prevention in the PR, not a dashboard after the bill lands.

Audit container images

valqore image-audit ./ --check-updates

  redis     latest  ->  --       UNPINNED   HIGH
  nginx     1.21    ->  1.27.0   OUTDATED   HIGH

Export compliance evidence

valqore evidence hipaa -f ./           # add -f oscal for machine-readable NIST OSCAL

All 19 packs: hipaa, soc2, pci_dss, gdpr, iso27001, iso_42001, eu_ai_act, nist_csf, nist_ai_rmf, owasp_llm, owasp_agentic, owasp_mcp, dora, fedramp, sr_11_7, cra, pqc_migration, fda_samd, ai_finops.

GreenOps — carbon tracking (built in)

Every evaluate --score already includes a carbon estimate:

Carbon: 0.182 kg CO2e/mo (aws:us-east-1)

Valqore tracks CO2e per workload using grid carbon-intensity data across 77 cloud regions, suggests greener regions, enforces carbon budgets, and tracks GPU embodied emissions.

---

Commands that read your cloud account

These need read-only credentials, so they're shown in full docker run form (Valqore never writes to your cloud):

Cloud billing & budget gate (AWS):

docker run --rm \
  -e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY \
  -e AWS_DEFAULT_REGION=us-east-1 \
  ghcr.io/valqore/engine:latest valqore finops billing --cloud aws --daily --days 30

AWS Daily Cost Trend (last 30 days)  Total: $3,459.14
      $137 |                 #
      $120 |####             ##########
      $103 |#####           #############
       $86 |#############################
           +-----------------