Paramify Fetchers

Paramify Fetchers collect evidence for your compliance program. They read the configuration and activity of the tools that you already run, such as AWS, Azure, GCP, Okta and Wiz. They turn that data into evidence for FedRAMP 20x Key Security Indicators and NIST 800-53 controls. You can then upload the evidence to Paramify.

Each fetcher is a small script that reads data with read-only access and writes JSON to disk. A separate uploader sends the evidence to Paramify. No data leaves your environment until you upload it. This repo contains the fetchers, the runner that executes them, and the uploader.

If you have a question about this repo, ask DeepWiki. It answers in plain English and links to the code that it read.

---

Supported services

AWS	Azure	Google Cloud	Wiz	Datadog	Okta
CrowdStrike	Splunk	SentinelOne	KnowBe4	GitLab	Kubernetes
Rippling	Paramify	Checkov	ServiceNow	Better Stack	Jira
Web	Zendesk	Oracle Cloud	GitHub	FedRAMP Marketplace	Qualys

python tools/generate_chart.py draws this chart from the git history by CI each time a new fetcher merges.

Coming soon

More integrations are in progress. To ask for a new platform or fetcher, post in Fetcher requests in Discussions. Upvote the requests that you want built next.

SSL Labs

Tenable

_{and more}

---

Try it in a minute

You do not need credentials. The bundled demo_hello fetcher writes synthetic evidence, so you can watch a full run before you connect a real service.

git clone https://github.com/paramify/paramify-fetchers.git && cd paramify-fetchers
python -m venv .venv && source .venv/bin/activate
pip install -e .
paramify run examples/demo.yaml                    # synthetic evidence, no credentials
paramify evidence evidence/run-*/demo_hello.json   # read what it wrote

---

Install

Prerequisites: Python 3.11 or later.

git clone https://github.com/paramify/paramify-fetchers.git
cd paramify-fetchers
python -m venv .venv && source .venv/bin/activate
pip install -e '.[all]'      # '[all]' bundles the TUI; use `pip install -e .` for the headless CLI only

Each platform has its own requirements:

• Most fetchers call a CLI, such as aws, jq, curl or kubectl. Install only the CLIs for the platforms that you use.
• Azure, GCP and Oracle Cloud use the official SDKs, not a CLI. Install them with pip install -e '.[azure]', pip install -e '.[gcp]' or pip install -e '.[oci]'. These extras are only needed for those platforms, so [all] does not include them. Azure signs in with DefaultAzureCredential and GCP with Application Default Credentials, so neither one needs a key file. OCI uses an API signing key that the runner injects as a secret, or an instance or resource principal where it is deployed; see fetchers/oci/README.md.
• Most platforms have a credential setup guide at fetchers/<category>/README.md. Select a logo under Supported services to open its folder.

---

Use it

You can use the fetchers in three ways. All three go through one facade (framework.api), so they behave the same.

The TUI

paramify tui browses the catalog, builds and validates a manifest, runs it, and shows the evidence. You do all of this from the keyboard.

Drive it with an AI agent

Every command takes --json, and each paramify manifest edit returns a stable {ok, path, errors} object. As a result, an agent can build a runnable manifest and does not have to read the screen output. The repo also ships Claude Code skills in .claude/skills/. They scaffold a fetcher, onboard a new platform, wire a fetcher into a manifest, and propose validators.

Using the CLI

The CLI does the same operations by hand:

paramify catalog                 # browse the fetchers
paramify describe <fetcher>      # see what one fetcher needs
paramify manifest init           # start a manifest, then add fetchers and secrets
paramify run manifest.yaml       # collect evidence
paramify upload                  # send the latest run to Paramify

docs/cli_guide.md is the full CLI reference and has a complete walk-through. examples/ has sample manifests, and deploy/README.md shows how to run on a schedule in a container.

---

Contributing

To ask for a new platform or fetcher, post in Fetcher requests. To add a fetcher yourself, start with CONTRIBUTING.md. It gives the dev setup, the checks that CI runs, the ground rules, and the guides for each kind of fetcher.

---

Where to read next

• Set up a platform: most platforms have a guide for their credentials and permissions. Select a logo under Supported services to open its folder.
• Run fetchers: docs/cli_guide.md is the full CLI reference. docs/run_manifest_guide.md builds a manifest step by step.
• Send results to Paramify: use docs/uploader_guide.md for evidence and docs/pipelines_guide.md for scan reports.
• Write a fetcher: read docs/authoring_fetcher_guide.md.
• Match records across fetchers: docs/comparators_guide.md writes a comparator.
• How it works: docs/architecture.md explains the four parts, the evidence envelope and the repo layout.
• FedRAMP KSI coverage: read docs/ksi_mapping.md.

The documentation index lists every other guide and reference page.

License

This project uses the GNU General Public License v3.0. See LICENSE.