Cartography
Cartography is free, open-source software for mapping infrastructure assets and their relationships in a Neo4j graph database.
What Cartography is
Cartography is free, open-source software for mapping infrastructure assets and their relationships in a Neo4j graph database. The resulting graph can help teams investigate datastore identity access, critical vulnerabilities, network paths, internet-exposed compute, and permissions held by production AI agents. Documentation lists integrations with AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra ID, CrowdStrike, and more than 30 other platforms. Cartography Rules provides predefined and custom queries for identifying possible attack surfaces and security gaps once data is populated. The tool can be installed with Docker Compose or natively, but requires a reachable Neo4j database. Its install guide specifies Python 3.13 and Neo4j 5.23 or higher; Python 3.11 and 3.12 may work but are untested, while Python 3.10 and earlier are unsupported. Native installation is described for Linux, Mac, and Windows, though Windows has not been tested much. The project says it began at Lyft and is now a CNCF Sandbox project. The repository uses the Apache 2.0 license.
Good
- Free and licensed under Apache 2.0
- Maps relationships across more than 30 listed integrations
- Includes predefined and custom security queries
- Supports Docker Compose or native installation
Watch out
- A reachable Neo4j database is required
- Python 3.13 and Neo4j 5.23 or higher are specified
- Windows has not been tested much
Who it suits
Cartography suits teams that need to map infrastructure relationships and investigate potential security gaps. It is for users able to provide a reachable Neo4j database and meet the stated runtime requirements.
Verdict
Cartography provides a self-hosted graph view for infrastructure relationships and security investigations. Check its Neo4j and Python requirements, along with the limited Windows testing, before choosing a deployment approach.
Plans and prices
From Cartography's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Cartography | Free | Open-source infrastructure mapping tool |
The facts
Each one read from Cartography's own pages, with the date it was checked.
What it does
- API permissions
- For GitHub, Cartography supports fine-grained personal access tokens, classic personal access tokens, and GitHub Apps, with optional permissions allowing unavailable data to be skipped while ingestion continues.checked 4 Oct 2026
- Deployment
- The install guide supports Docker Compose or native installation and requires a reachable Neo4j database.checked 4 Oct 2026
- Integration limit
- The Orca Security module requires organization-wide read access; partial account, business-unit, or asset access is unsupported.checked 4 Oct 2026
- Integrations
- The project documentation lists integrations including AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra ID, CrowdStrike, and more than 30 other platforms.checked 4 Oct 2026
- License
- The project repository states that Cartography is licensed under Apache 2.0.checked 4 Oct 2026
- Operating systems
- The native install guide says Cartography should work on Linux, Mac, and Windows, while noting Windows has not been tested much.checked 4 Oct 2026
- Project status
- The project says it was created at Lyft and is now a CNCF Sandbox project.checked 4 Oct 2026
- Purpose
- Cartography is an open-source tool for mapping infrastructure assets and their relationships in a Neo4j graph database.checked 4 Oct 2026
- Runtime requirements
- The install guide specifies Python 3.13 and Neo4j 5.23 or higher; Python 3.11 and 3.12 may work but are not tested, and Python 3.10 and older are unsupported.checked 4 Oct 2026
- Secret handling
- The GitHub module reads secret metadata but never loads secret values.checked 4 Oct 2026
- Security questions
- It helps investigate identity access to datastores, critical vulnerabilities, network paths, internet-exposed compute, and production AI agents and their permissions.checked 4 Oct 2026
- Security rules
- Cartography Rules provides predefined and custom security queries for identifying potential attack surfaces and security gaps in a populated graph.checked 4 Oct 2026
- Support and community
- The project directs bug reports and feature requests to GitHub Issues, broader discussions to GitHub Discussions, and community participation to the CNCF Slack #cartography channel.checked 4 Oct 2026
Alternatives to Cartography
- 1
Netdata
Free planOpen sourceAndroidiOSWebAPI8.7From $4.50 a month - 2
Jira
Free planAndroidiOSWebAPI8.4Free plan - 3
Lansweeper
Free planWebAPILinuxmacOS8.0Free plan - 4
ManageEngine Applications Manager
Free planAndroidiOSWebLinux7.1From $395 a year - 5
New Relic Session Replay
Free planAndroidiOSWeb7.1From $10 a month - 6
Port
Free planWebAPIExtension6.9From $30 a month