Deploy Keygraph's full security suite inside your network. Source code never leaves your environment. Only findings metadata is sent to the cloud.
Keygraph's self-hosted solution separates management and scanning workloads. The control plane runs in our cloud, while your data plane operates entirely within your infrastructure.
| Aspect | Control Plane | Data Plane |
|---|---|---|
| Managed by | Keygraph | Your infrastructure team |
| Components | API, UI, Database, Storage | Scanners, Temporal, Agent |
| Data stored | Findings metadata, configuration | Source code, temporary scan state |
| Communication | Unidirectional: data plane polls control plane every 5 minutes | |
| Network | Outbound HTTPS only, no inbound connections required | |
| Updates | Keygraph pushes updates instantly | Controlled by you, on your schedule |
Deploy Keygraph's complete security scanning stack inside your network. Every component runs locally, giving you full control and visibility.
Advanced static analysis powered by a 5-phase pipeline for accurate vulnerability detection.
AI-powered penetration testing agent for dynamic security testing and exploitation.
Detect and remediate hardcoded credentials, API keys, and sensitive tokens in your codebase.
Generate complete software bill of materials and identify known vulnerabilities in dependencies.
Complete transparency on what leaves your environment. Only non-sensitive finding metadata and telemetry are transmitted to Keygraph Cloud.
Rule-based scans run entirely in your data plane. AI-powered analysis only sends code to Anthropic API when explicitly enabled, with strict data handling agreements.
Rule IDs, severity levels, file paths, and line numbers are transmitted for dashboard visualization and historical tracking.
Findings are stripped of vulnerable code excerpts before transmission. Full details remain in your SARIF reports and local dashboard.
Complete vulnerability data remains in your environment. Only metadata syncs to the cloud for centralized reporting and compliance tracking.
Your authentication credentials are hashed immediately. Never stored in plaintext. Each data plane instance receives its own isolated key.
Your data plane polls the control plane every 5 minutes. No inbound connections required. Firewalls can block all incoming traffic.
Keygraph provides a fully automated setup experience. One command deploys your entire scanning infrastructure.
You'll receive keygraph-scanner-setup.sh which automates the entire deployment process. The script handles Docker Compose orchestration, container initialization, and agent registration in seconds.
Docker Compose Stack
Image Size Breakdown
Deploy with a single command:
Simple, controlled, and secure. Get your self-hosted scanning environment running in minutes.
Your admin creates a new API key in Settings > API Keys. The key is displayed once and immediately hashed with SHA-256 for storage.
kg_v1_xxxxxxxxxxxxxxxxxxxxxx
DevOps engineer runs the setup script in your environment. The agent registers as PENDING_APPROVAL. Admin approves it in the Devices list to activate scanning.
Approval grants scanning permissions
Start scans from the UI. Your agent polls for tasks every 5 minutes. Findings stream back to your dashboard in real-time. Monitor in Keygraph Cloud or your own SIEM.
Full audit trail for compliance
Your scanning engine is protected with multiple layers of security to prevent reverse engineering and tampering.
Multi-stage Docker builds discard source code after compilation. Only compiled artifacts and binaries remain in the image.
javascript-obfuscator with RC4 string array encoding prevents static analysis. Deobfuscation requires knowledge of runtime state.
SHA-256 checksums verified at startup. Container runtime corruption is detected and reported immediately.
Non-root user, read-only filesystem, and dropped Linux capabilities. Running processes have minimal system access.
Keygraph scanner images are distributed via Cloudflare R2 with support for offline, air-gapped deployments. No container registry account required.
All scanner images are available as tar.gz tarballs, enabling deployment in restricted network environments without external registry access.
Download example:
Get started with Keygraph Self-Hosted Scanning today. Deploy in your network, maintain complete control.
Request Self-Hosted Demo