{"id":51566325,"url":"https://github.com/ethanolivertroy/flue-grc-engineer-demo","last_synced_at":"2026-07-10T15:02:33.566Z","repository":{"id":355121259,"uuid":"1226852125","full_name":"ethanolivertroy/flue-grc-engineer-demo","owner":"ethanolivertroy","description":"Demo Flue GRC engineer agent on Cloudflare Workers with Workers AI, Cloudflare Containers, and configurable auth.","archived":false,"fork":false,"pushed_at":"2026-05-01T23:14:18.000Z","size":162,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-02T01:15:22.773Z","etag":null,"topics":["ai-agent","cloudflare-containers","cloudflare-workers","flue","governance-risk-compliance","grc","workers-ai"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ethanolivertroy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-01T22:43:35.000Z","updated_at":"2026-05-01T23:22:08.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/ethanolivertroy/flue-grc-engineer-demo","commit_stats":null,"previous_names":["ethanolivertroy/flue-grc-engineer-demo"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/ethanolivertroy/flue-grc-engineer-demo","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ethanolivertroy%2Fflue-grc-engineer-demo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ethanolivertroy%2Fflue-grc-engineer-demo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ethanolivertroy%2Fflue-grc-engineer-demo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ethanolivertroy%2Fflue-grc-engineer-demo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ethanolivertroy","download_url":"https://codeload.github.com/ethanolivertroy/flue-grc-engineer-demo/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ethanolivertroy%2Fflue-grc-engineer-demo/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35334719,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-10T02:00:06.465Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-agent","cloudflare-containers","cloudflare-workers","flue","governance-risk-compliance","grc","workers-ai"],"created_at":"2026-07-10T15:02:32.862Z","updated_at":"2026-07-10T15:02:33.561Z","avatar_url":"https://github.com/ethanolivertroy.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Flue GRC Engineer Demo\n\nA small Flue demo agent for governance, risk, and compliance engineering tasks, deployed on Cloudflare Workers.\n\n## What is Flue?\n\n[Flue](https://github.com/withastro/flue) is an experimental sandbox agent framework from the Astro team. It lets you build AI agents as small TypeScript handlers that can be invoked over HTTP or from automation.\n\nA Flue agent usually has three parts:\n\n- **Agent handler**: TypeScript code in `agents/` that receives a payload, initializes a model/sandbox, and runs prompts or skills.\n- **Model**: The LLM used by the agent. This project uses Cloudflare Workers AI with Kimi K2.6: `cloudflare-workers-ai/@cf/moonshotai/kimi-k2.6`.\n- **Sandbox**: An isolated environment where the agent can read/write files and run shell commands. This project uses Cloudflare's full container sandbox.\n\nIn this repo, Flue builds the `agents/grc-engineer.ts` handler into a Cloudflare Worker endpoint:\n\n```txt\nPOST /agents/grc-engineer/:id\n```\n\nThe `:id` acts like a session/agent instance id. Reusing the same id can preserve agent/session state; using a new id starts a separate session.\n\n## Sandbox model\n\nThis project uses a **full Cloudflare Container sandbox** via `@cloudflare/sandbox`:\n\n```ts\nconst sandbox = getSandbox(env.Sandbox, id);\n\nconst agent = await init({\n  sandbox,\n  model: 'cloudflare-workers-ai/@cf/moonshotai/kimi-k2.6',\n});\n```\n\nWhat that means:\n\n- Each agent id/session gets a real isolated Linux container sandbox.\n- The container image is defined in `Dockerfile`.\n- The starter image includes Node.js, git, curl, CA certificates, and Python 3.\n- The agent can use a real Linux filesystem and shell inside the sandbox.\n- Cloudflare Durable Objects coordinate sandbox/session persistence.\n- Your `.env` secrets are Worker environment values; they are not automatically written into the agent prompt.\n\nWhy this is different from Flue's default virtual sandbox:\n\n- The default virtual sandbox is lighter, cheaper, and faster for simple prompt-and-response agents.\n- This container sandbox is heavier, but useful when the agent needs real system tools, package installs, git operations, Python scripts, or a more realistic coding/data environment.\n\nDocs:\n\n- Flue Cloudflare container agents: https://github.com/withastro/flue/blob/main/docs/deploy-cloudflare.md#container-agents\n- Cloudflare Containers: https://developers.cloudflare.com/containers/\n\n## Auth model\n\nThe generated Worker supports configurable auth for `/agents` routes via `GRC_AUTH_MODE`.\n\n### Option 1: Bearer token auth\n\nUse this for local testing or simple private API access:\n\n```env\nGRC_AUTH_MODE=\"token\"\nGRC_AGENT_TOKEN=\"some-long-random-token\"\n```\n\nRequests must include:\n\n```bash\n-H \"Authorization: Bearer $GRC_AGENT_TOKEN\"\n```\n\n### Option 2: Cloudflare Access\n\nUse this when the Worker is deployed publicly but should only be reachable by approved Cloudflare Access users.\n\n```env\nGRC_AUTH_MODE=\"cloudflare-access\"\nGRC_ACCESS_TEAM_NAME=\"your-team-name\"\nGRC_ACCESS_AUD=\"your-access-application-aud\"\nGRC_ACCESS_ALLOWED_EMAILS=\"alice@example.com,bob@example.com\"\n```\n\nHow it works:\n\n- Cloudflare Access sits in front of the Worker and handles login/identity.\n- The Worker validates the `Cf-Access-Jwt-Assertion` JWT signature using your Cloudflare Access signing keys.\n- Set `GRC_ACCESS_TEAM_NAME` to the team name in `https://\u003cteam-name\u003e.cloudflareaccess.com`.\n- Set `GRC_ACCESS_AUD` to the Access application AUD tag from the Zero Trust dashboard.\n- If `GRC_ACCESS_ALLOWED_EMAILS` is set, the Worker also checks that the verified JWT email is on that allowlist.\n- If the allowlist is blank, any user who passes your Cloudflare Access policy is allowed.\n\nYou still need to configure a Cloudflare Access application/policy in the Cloudflare dashboard for the deployed Worker hostname. The app-level JWT validation here is a fail-closed guard and defense-in-depth check.\n\n### Option 3: No app-level auth\n\nOnly use this for local/private experiments:\n\n```env\nGRC_AUTH_MODE=\"none\"\n```\n\nSecurity notes:\n\n- Do not commit `.env`.\n- Treat `GRC_AGENT_TOKEN` like a password. Rotate it if it leaks.\n- Prefer Cloudflare Access for shared/team usage.\n\n## Setup\n\n```bash\nnpm install\ncp .env.example .env\n# edit .env and set CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_KEY, and auth settings\n```\n\nGenerate a token if you use token auth:\n\n```bash\nopenssl rand -hex 32\n```\n\n## Develop locally\n\n```bash\nnpm run dev\n```\n\nThen call the agent:\n\n```bash\nsource .env\n\ncurl http://localhost:3583/agents/grc-engineer/test-1 \\\n  -H \"Authorization: Bearer $GRC_AGENT_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"framework\": \"SOC 2\",\n    \"system\": \"a SaaS application running on Cloudflare Workers\",\n    \"request\": \"draft control considerations for access reviews and audit evidence\"\n  }'\n```\n\nNote: `npm run build` patches the generated Cloudflare Worker with auth for `/agents` routes. Use `npm run dev` or `npm run deploy` so the auth patch is applied.\n\n## Build and deploy\n\n```bash\nnpm run build\nnpm run deploy\n```\n\nWrangler reads `.env` during deploy via `--secrets-file .env`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fethanolivertroy%2Fflue-grc-engineer-demo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fethanolivertroy%2Fflue-grc-engineer-demo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fethanolivertroy%2Fflue-grc-engineer-demo/lists"}