Freedom251 › Application Dependency Mapping Software
Cartography
What Cartography is
Cartography is an open-source tool that maps infrastructure assets and their relationships in a Neo4j graph database. Its graph can help teams investigate identity access to datastores, critical vulnerabilities, network paths, internet-exposed compute, and production AI agents and their permissions. The project documentation lists integrations such as AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra ID, and CrowdStrike, among more than 30 other platforms. Cartography Rules offers predefined and custom queries for finding possible attack surfaces and security gaps in a populated graph. Deployment options include Docker Compose or native installation, and both require a reachable Neo4j database. The install guide specifies Python 3.13 and Neo4j 5.23 or higher; Python 3.11 and 3.12 may work but are untested, while Python 3.10 and older are unsupported. The native guide says Linux, Mac, and Windows should work, though Windows has not been tested much. Cartography is free, self-hosted software under the Apache 2.0 license. The project says it began at Lyft and is now a CNCF Sandbox project.
Who it suits
Cartography suits teams that want to map infrastructure relationships and investigate potential security gaps using a Neo4j graph. It is appropriate for teams able to provide a reachable Neo4j database and manage a self-hosted installation.
What it does well
- Open-source and free under Apache 2.0.
- Lists more than 30 platform integrations.
- Rules support predefined and custom security queries.
- Offers Docker Compose and native installation.
What to know first
- Requires a reachable Neo4j database.
- Python 3.10 and older are unsupported.
- Windows has not been tested much.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Cartography | Open-source infrastructure mapping tool | Free |
As cartography.dev lists them, read 4 Oct 2026. The maker's own page has the final word.
Getting started
- Install or provide a reachable Neo4j database, version 5.23 or higher.
- Choose Docker Compose or the native installation route.
- For native installation, use Python 3.13; Python 3.11 and 3.12 may work but are untested.
- Connect the integrations you want to map, such as AWS, GitHub, or Kubernetes.
- Use Cartography Rules to run predefined or custom security queries.
Verdict
Cartography provides free, self-hosted infrastructure mapping and security queries across a broad set of integrations. Teams need a reachable Neo4j database and should account for the stated Python requirements.
Questions
How much does Cartography cost?
Cartography is free and open source; the listed plan is free.
Is Cartography self-hosted?
Yes. It is a self-hosted tool, with Docker Compose and native installation options.
What does Cartography require?
The installation requires a reachable Neo4j database. The guide specifies Neo4j 5.23 or higher and Python 3.13 for native installation.
Which operating systems does it support?
The native guide says it should work on Linux, Mac, and Windows, but notes Windows has not been tested much.
What integrations are listed?
The documentation lists AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra ID, CrowdStrike, and more than 30 other platforms.
Who created Cartography, and what is its license?
The project says it was created at Lyft and is now a CNCF Sandbox project. Its repository states that it is licensed under Apache 2.0.
Facts from Cartography's own pages
- API permissions
- For GitHub, Cartography supports fine-grained personal access tokens, classic personal access tokens, and GitHub Apps, with optional permissions allowing unavailable data to be skipped while ingestion continues. · docs.cartography.dev, 4 Oct 2026
- Deployment
- The install guide supports Docker Compose or native installation and requires a reachable Neo4j database. · docs.cartography.dev, 4 Oct 2026
- Integration limit
- The Orca Security module requires organization-wide read access; partial account, business-unit, or asset access is unsupported. · docs.cartography.dev, 4 Oct 2026
- Integrations
- The project documentation lists integrations including AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra ID, CrowdStrike, and more than 30 other platforms. · github.com, 4 Oct 2026
- License
- The project repository states that Cartography is licensed under Apache 2.0. · github.com, 4 Oct 2026
- Operating systems
- The native install guide says Cartography should work on Linux, Mac, and Windows, while noting Windows has not been tested much. · docs.cartography.dev, 4 Oct 2026
- Project status
- The project says it was created at Lyft and is now a CNCF Sandbox project. · cartography.dev, 4 Oct 2026
- Purpose
- Cartography is an open-source tool for mapping infrastructure assets and their relationships in a Neo4j graph database. · cartography.dev, 4 Oct 2026
- Runtime requirements
- The install guide specifies Python 3.13 and Neo4j 5.23 or higher; Python 3.11 and 3.12 may work but are not tested, and Python 3.10 and older are unsupported. · docs.cartography.dev, 4 Oct 2026
- Secret handling
- The GitHub module reads secret metadata but never loads secret values. · docs.cartography.dev, 4 Oct 2026
- Security questions
- It helps investigate identity access to datastores, critical vulnerabilities, network paths, internet-exposed compute, and production AI agents and their permissions. · cartography.dev, 4 Oct 2026
- Security rules
- Cartography Rules provides predefined and custom security queries for identifying potential attack surfaces and security gaps in a populated graph. · docs.cartography.dev, 4 Oct 2026
- Support and community
- The project directs bug reports and feature requests to GitHub Issues, broader discussions to GitHub Discussions, and community participation to the CNCF Slack #cartography channel. · github.com, 4 Oct 2026