Ingest run reports
Each Egret run POSTs a versioned Envelope (schema_version 1) to POST /ingest, bearer-token authenticated. Returns the new endpoints it saw.
Tier 3 · optional · self-hosted
Egret Nest.
The dashboard for your fleet.
Egret Nest ingests your Egret run reports and shows what your CI jobs connected to, what was flagged or blocked, and which endpoints are new - across every repo. A single Go binary you run on your own infrastructure. Your data never leaves it, and the agent never requires it.
The invariant
Never required. Always optional.
No headline feature of the Egret agent ever requires Nest. The agent
is server-agnostic - it only talks to Nest when you set
EGRET_INGEST_URL. Unset means nothing is sent.
What it does
Everything, on your own infra.
New-endpoint drift
Surfaces endpoints newly seen versus your baseline - the earliest signal of a dependency change or a supply-chain compromise.
Runs, repos & history
Browse runs list + detail, per-repository views, and what each CI job connected to over time - flagged, blocked, and allowed.
Auth trilogy
Local accounts with TOTP 2FA, GitHub OAuth, and generic OIDC - enable any combination. SSO configurable from the admin UI or env.
Org RBAC
Organizations with owner / admin / member / viewer roles, self-service org + member + token management.
Scoped ingest tokens
Per-scope, revocable ingest tokens; HMAC-SHA256-verified GitHub webhooks for a push-based ingest path.
The stack
One binary. No npm. No CGO.
Egret Nest is a single static Go binary with a pure-Go SQLite store
(modernc.org/sqlite - no CGO), an embedded html/template
UI, and zero third-party web framework. It ships as a binary,
a Docker image, and compose/Helm - hardened and security-reviewed.
Pull it from Docker Hub or GHCR, or grab the Go binary - all the ways to run it (with compose and Helm) are on the download page.
All install options → · Deploy guide & env reference → · Auth & security design →