Skip to content

Open Shadow AI v0.1.0 — Public preview

Pre-release
Pre-release

Choose a tag to compare

View all tags
@alebgl77 alebgl77 released this 26 Sep 22:55
v0.1.0
66315cb
This commit was signed with the committer’s verified signature.
alebgl77 Alexandre Beguel
SSH Key Fingerprint: S3zVgajq1s/11u/Ga2APkGunmjl/uglpRnFvjDWK0xs
Verified
Learn about vigilant mode.

Open Shadow AI v0.1.0 — public preview

Self-hosted AI discovery, with evidence behind every finding. This first Apache-2.0 release is intended for evaluation and controlled pilots, with one organization per deployment.

Included

  • An investigation interface with discovery, catalog and governance views, an isolated synthetic demo, a real dashboard screenshot and editable architecture diagrams.
  • DNS/proxy parsers, a syslog receiver and endpoint inventory, with explicit distinctions between presence, network observations and instrumented usage.
  • An OU-scoped, read-only Active Directory exporter and a Microsoft Entra service-principal inventory collector with optional grant collection. Entra AI matching requires administrator-reviewed application-ID mappings.
  • Authenticated canonical-event ingestion in bounded batches for custom collectors, backed by Redis workers, PostgreSQL detections and durable receipts, and ClickHouse events.
  • Secret-preserving bootstrap scripts, Docker Compose, a Kubernetes baseline for external stores, and English/French deployment and Microsoft guides.

Validation

All five CI jobs passed for source commit cea2bafab02bfe0298776ab4de679fd4f044acd6: Python 3.12 and 3.13 each passed 72 regression tests with the live integration test skipped, then that integration test passed separately against real PostgreSQL, Redis and ClickHouse. The frontend passed 13 tests and built successfully; PowerShell syntax/dry runs, fresh Docker builds/startup and the authenticated HTTP-to-storage smoke test also passed. See validation scope for reproducible checks and evidence boundaries.

Pilot limits

Live AD/Graph tenants, managed-fleet rollout, Kubernetes clusters and sustained load still require operational validation. Enterprise SSO/SCIM and isolated multi-tenancy are planned. Network or inventory signals do not prove prompt content, model usage or spend; model/token data requires instrumentation and costs remain estimates. This preview claims no production SLA, certification or universal infrastructure coverage.

Assets 2
Loading