AI-assisted security investigation and remediation with policy checks, risk scoring, approvals, and audit records around governed execution paths. Bring connected security evidence, multiple Brains, and 26 capability areas into one local control plane.
Required — Docker Desktop. Enkstein runs its governed services locally. Every launch checks Docker first, opens it when stopped, and waits for docker info before starting services. If it is missing, the official Docker installation flow opens and Enkstein keeps checking until the engine is ready. Allow 4 GB RAM.
Optional — Ollama. Free local Brains that work offline. Without it Enkstein still runs on your own Codex or Claude subscription, or an API key.
The Trust Fabric is Enkstein's central enforcement layer — a 6-stage pipeline that evaluates every security action before it executes.
Each Capability Node is a self-contained security domain module with its own provider adapters, findings engine, and governance integration. Core surfaces add model routing, command control, and governed deployment release gates.
Beyond the 26 capability areas and core control surfaces, these engines provide policy, orchestration, and evidence services to the workflows wired through them.
execution_ring_violation deny reason on all violations.A modern, containerized stack with security principles baked into every layer.
Enkstein operationalizes zero trust beyond network segmentation — enforcing governance at every layer of the security stack.
Use a native macOS .pkg or Windows setup.exe when that asset is present on the release, or use the portable bundle. The launcher creates unique secrets and starts the backend API, production Next.js frontend, PostgreSQL, and Redis through Docker Desktop.
The launcher tries versioned backend and frontend images first. If either image is unavailable, it builds both from the bundled source; the backend build can take many minutes while Prowler and its dependencies install. The universal macOS app waits for the Cortex and UI to become healthy before loading Enkstein in its native desktop window.
The control plane is self-hosted. Connector credentials are encrypted in the local secret volume and are sent only to the provider endpoints those connectors authenticate against. Prompts leave the device only when you select a cloud, subscription, or browser Brain, subject to the active policy and redaction decision.
Security: Never commit backend/.secrets/ to git. This folder holds your encryption key and is gitignored by default. Each deployment generates its own isolated key on first run.
# Download a GitHub Release bundle tar -xzf enkstein-VERSION.tar.gz cd enkstein-VERSION ./install.sh # Open the platform # Dashboard: http://localhost:3000 # API Docs: http://localhost:8000/docs # Add your own credentials # → Go to Connectors → click any connector # → Enter your API key/token — encrypted at rest # → Capability Node switches from demo data to your real environment