Ingest
Each Egret run POSTs a versioned Envelope (schema_version 1) to POST /ingest with bearer-token auth; the response returns the endpoints newly seen.
Egret Nest - Features
Everything the dashboard does.
Egret Nest is the optional, self-hosted dashboard for your Egret fleet. It's a single Go binary - pure-Go SQLite, an embedded UI, and zero third-party web framework - that ingests run reports and never requires the agent to use it.
Observability
See your egress across the fleet.
Runs, repos & history
Runs list and detail, per-repository views, and what each CI job connected to over time - allowed, flagged, and blocked.
New-endpoint drift
Highlights endpoints newly seen versus your baseline - the earliest signal of a dependency change or a supply-chain compromise.
Authentication
The auth trilogy, plus 2FA.
Local + TOTP
Local accounts with TOTP two-factor. Seeds are encrypted at rest with your secret key. Ideal for air-gapped installs.
GitHub OAuth
Sign in with GitHub via the Egret App - inherits your org 2FA / SAML posture.
Generic OIDC
Okta, Entra, Google Workspace - any OIDC provider. Enable any combination; configure from the admin UI or env.
Access & multi-tenancy
Org RBAC and scoped tokens.
Organizations & RBAC
Organizations with owner / admin / member / viewer roles; self-service org, member, and token management.
Scoped ingest tokens
Per-scope, revocable ingest tokens so each repo or org pushes with its own credential.
HMAC webhooks
HMAC-SHA256-verified GitHub webhooks for a push-based ingest path (404s when unset).
Security & ops
Hardened, and ready to run.
Sessions, CSRF & audit
Server-side sessions, CSRF protection on every mutation, and an audit log of who viewed or changed what.
Secrets at rest & TLS
A secret key encrypts TOTP seeds + UI-stored SSO secrets; serve native TLS or run behind your proxy.
Metrics & health
Token-gated Prometheus /metrics, DB-checked /healthz liveness, and retention / pruning.
Get started
Bring up a dashboard in one command.
Self-host it, point your Egret runs at it, and watch your egress across the fleet. Apache-2.0, on your own infrastructure.