Probo

Bring risks, controls, vendors, privacy, and audits into one GRC data model

The README covers risk registers and inherent/residual scoring, control libraries and framework import/export, vendor inventory, DPIA/TIA, access-review campaigns, audit programs, evidence, and document approvals.

It also includes public compliance pages, NDA and certification publishing, and cookie/consent management, extending beyond audit preparation into privacy and third-party risk.

Sources: [2]

Automate GRC with 270+ MCP tools, 44+ CLI command groups, and GraphQL

The MCP API exposes more than 270 tools across platform entities and operations, allowing compatible LLM agents to read and write GRC data, draft policies, run risk assessments, and generate evidence packs.

The prb CLI, GraphQL API, and n8n community node provide additional paths for CI/CD, scripts, and no-code compliance workflows.

Sources: [2]

Self-host a Go/PostgreSQL backend with a React/TypeScript frontend

The documented stack uses Go and PostgreSQL on the backend, GraphQL and MCP for APIs, React/TypeScript/Relay/Tailwind CSS on the frontend, and OpenTelemetry, Grafana, Prometheus, Loki, and Tempo for observability.

The Quick Start uses Docker to bring up PostgreSQL, object storage, and related infrastructure before running the probod server and web console locally.

Sources: [2]

For security and compliance teams moving from document-heavy GRC to API-driven workflows

It fits organizations that want SOC 2 or ISO 27001 work to share a data model with GDPR, HIPAA, access reviews, and vendor risk, especially when GRC operations need to be automated from engineering workflows through CLI, MCP, or GraphQL.

Write-capable AI-agent access requires explicit authorization boundaries

Probo's MCP surface includes write operations, not only read access. When connecting an LLM agent, define credential scope, RBAC, approval-sensitive operations, and audit-log review so agents cannot modify policies, risks, or evidence without appropriate controls.

Sources: [2]

The README Quick Start is a development setup, not a complete production deployment design

The Quick Start assumes Go, Node.js, npm, Docker, and mkcert and builds the source with a development configuration. Production self-hosting still needs decisions around databases, object storage, secrets, TLS, backups, upgrades, and observability.

Sources: [2]

The latest release tag versions the probod component rather than necessarily the entire monorepo

GitHub's latest release is probod/v0.289.0, published September 15, 2026, and distributes backend-daemon binaries. When operating the web console, CLI, and backend together, verify the compatible builds or release versions for each component.

Sources: [3][1]